Threat Actor
ROOTBOY
- First Reported
- Apr 17, 2026
- Latest Reported
- Jun 22, 2026
Reported Context (2)
- Public leak-site tracking identifies ROOTBOY as the Prinz Eugen site's affiliate, and reporting attributes the Standard Bank breach to ROOTBOY. The article says the attribution is supported by account history and the GERMANIA alias, while noting a separate encryptor developer may have been involved. ThreatDown Details Prinz Eugen Ransomware’s Encryption and Anti-Forensic Tactics
- Identified in the article as the threat actor associated with the staged data publications. Claims attributed to Rootboy's leak portal include exfiltrating 1.2 TB from Standard Bank and Liberty, publishing more than 154 million rows, and seeking 1 BTC; the exfiltration volume and extortion demand are not independently confirmed in the article. Standard Bank confirms unauthorized access as Rootboy publishes customer-data dumps
Malware (1)
People (1)
Threat Actors (1)
MITRE ATT&CK (9)
Vendors (1)
Products (4)
Tools (1)
Industries (2)
Countries (4)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.