Prinz Eugen Ransomware Targets Recent Files and Avoids On-System Ransom Notes
Summary
ThreatDown researchers describe Prinz Eugen ransomware’s file-prioritizing encryption, likely stolen-RDP access, and use of legitimate tools. The malware leaves no ransom note; researchers identified at least five victims.
Key points
- ThreatDown researchers say the Go-based malware encrypts recently modified files first, processing same-timestamp files alphabetically.
- Initial access was likely through stolen RDP credentials; researchers observed manual execution of servertool.exe, RemotePC RMM software, and a backdoor administrator account.
- The ransomware uses ChaCha20-Poly1305 encryption, with Argon2id, SHA-256, and HKDF-SHA256 in its key derivation process; it encrypts files in 1 MB chunks.
- Researchers observed a check that files can be decrypted before originals are deleted; the malware then overwrites the encryption key with zeroes and self-deletes.
- The malware does not drop a ransom note or change the desktop wallpaper; researchers say extortion communications happen out-of-band.
- Researchers identified at least five victims. In the Standard Bank case, the attacker reportedly demanded 1 BTC, which was refused.
Article Details
- Attack Vectors
- Initial access was likely obtained using stolen RDP credentials.
- In an investigated incident, the attackers used the RemotePC RMM tool and a backdoor administrator account for persistence.
- The main payload, servertool.exe, was manually downloaded and executed.
- Defensive Notes
- Do not rely on an on-host ransom note or wallpaper change to detect an attack; the analyzed malware did neither, and researchers say ransom communications may occur out-of-band.
- The researchers identified indicators of compromise to support detection and defense, but no specific indicator values are included in the supplied article.
MITRE ATT&CK
T1021.001 · Remote Desktop ProtocolThe attackers reportedly used stolen credentials to gain access through RDP.T1078 · Valid AccountsInitial access was reportedly likely achieved using stolen RDP credentials.T1105 · Ingress Tool TransferThe main payload, servertool.exe, was manually downloaded before execution.T1219 · Remote Access ToolsResearchers observed the use of the RemotePC RMM tool in an investigated incident.T1486 · Data Encrypted for ImpactThe Prinz Eugen ransomware encrypts victim files, prioritizing the most recently modified files.