New Go ransomware Prinz Eugen hits newest files first

A potent new ransomware variant, 'Prinz Eugen,' is disrupting organizations by flipping the script on traditional cyberattacks, specifically targeting and encrypting a victim's newest and most actively used files first. This Go-based encryptor, first identified in June 2026 by researchers at ThreatDown, aims to maximize immediate operational pain, making crucial, active business data inaccessible within minutes and intensifying pressure on affected companies to pay a ransom. Unlike many predecessors, Prinz Eugen often bypasses leaving a visible ransom note, instead opting for 'out-of-band' communication to complicate detection and forensic efforts. This aggressive approach signifies a deliberate evolution in ransomware tactics, moving beyond indiscriminate file encryption to directly hit an organization's most valuable, current work. Threat actors behind Prinz Eugen are gaining initial access primarily through compromised Remote Desktop Protocol (RDP) credentials, then leveraging legitimate Remote Monitoring and Management (RMM) software and 'living-off-the-land' techniques to move stealthily within networks before deploying the 'servertool.exe' payload. Attributed to an actor known as ROOTBOY, this operation highlights a sophisticated, hands-on-keyboard style that eschews the common Ransomware-as-a-Service (RaaS) model, focusing on targeted, high-impact breaches. Organizations need to urgently reinforce their defenses against this new threat. Immediate steps include securing all internet-facing RDP access with Multi-Factor Authentication (MFA) and bolstering Endpoint Detection and Response (EDR) systems to monitor for unusual activity from legitimate management tools. Furthermore, prioritizing frequent, isolated backups of active business data is critical, as Prinz Eugen's targeting strategy means even recent daily work could be compromised before a traditional backup schedule kicks in. The shift towards maximizing immediate operational disruption demands a proactive and adaptive cybersecurity posture.