Hackers Use RemotePC RMM and PowerShell Stagers to Deploy Prinz Eugen Ransomware

HomeCyber Security News Hackers Use RemotePC RMM and PowerShell Stagers to Deploy Prinz Eugen Ransomware By Tushar Subhra Dutta June 22, 2026 A newly identified ransomware group is using remote management software and scripted attack tools to compromise organizations and deploy a sophisticated encryption threat called Prinz Eugen. The campaign has claimed victims across multiple countries, with targets ranging from major financial institutions to regional training firms. Prinz Eugen first surfaced on April 16, 2026, when a social media post flagged a new ransomware leak portal linked to an attack on Standard Bank Group, a leading financial institution in South Africa. The threat gained wider attention as attackers escalated tactics, releasing stolen data in daily batches after the bank refused to pay. The name references a German heavy cruiser from World War II, the first of several German-language references woven through this campaign. Researchers at ThreatDown investigated an infected customer environment on May 11, 2026, and published a detailed analysis of the encryptor’s capabilities. According to ThreatDown said in a report shared with Cyber Security News (CSN), the ransomware is written in Go, making it harder to reverse-engineer than many older threats. It was built with technical care that sets it apart from most first-wave ransomware samples seen in recent years. What makes Prinz Eugen particularly dangerous is how it selects files. File iteration logic with the most recently modified files displayed first (Source – ThreatDown) Rather than working alphabetically, it targets the most recently modified files first, hitting active documents, open databases, and freshly saved work. This puts maximum pressure on victims to pay before backups can help. Once encryption is complete, the malware quietly removes itself, erasing any trace it was present. The group is believed to be a single operator known as ROOTBOY, who had been selling stolen data under the alias GERMANIA before Prinz Eugen existed. Prior activity includes breaches affecting a US driving-school software provider and a 700Credit database holding over 8.4 million records. This history reflects someone with established criminal marketplace access and real experience running extortion operations. Hackers Use RemotePC RMM and PowerShell Stagers In the incident analyzed, the attacker gained initial access through compromised Remote Desktop Protocol credentials. The encryptor executable, named servertool.exe, was downloaded using Chrome and placed in the victim’s Music folder. Temporary file encryption (Source – ThreatDown) The attacker then used RemotePC, a legitimate remote management tool, to launch PowerShell stagers and pull additional payloads from a command-and-control server at 212.80.7.74. Those payloads were likely remote access tools built for data theft and exfiltration. The attacker also created a hidden admin account using the command net user admin germania /add, establishing a persistent foothold in the environment. Using legitimate RMM software allowed the operator to blend into normal enterprise traffic and avoid triggering standard alerts. The infrastructure supporting the campaign was deliberate but compact. Three domains resolved to the same server, including a typosquat of Standard Bank’s domain and a fake CAPTCHA page likely used to lure victims into executing malicious code. After the server IP became public, the operator dismantled everything, removing DNS records and wiping the admin panel. Encryption Behavior and Anti-Forensic Design The encryptor uses ChaCha20-Poly1305 with a unique key per file, a three-stage key derivation process, and one-megabyte chunk processing, making decryption without the original key nearly impossible. Each encrypted file receives the .prinzeugen extension, but no ransom note is ever written to disk. All victim communication happens through out-of-band channels such as direct email or dark-web portals, removing a key forensic indicator investigators rely on. Before exiting, the malware wipes its encryption key from memory, runs garbage collection to clear residuals, and deletes itself using a timed Windows command. The C2 panel at the time of writing (Source – ThreatDown) This deliberate cleanup limits what forensic teams can recover after an attack. The design reflects an operator comfortable with both enterprise environments and the limits of standard incident response. Security teams should monitor for unauthorized use of remote management tools, especially when tied to PowerShell execution. Blocking untrusted RDP access, enforcing multi-factor authentication, and watching for suspicious new local admin accounts are critical steps organizations must take to reduce exposure to this threat. Indicators of Compromise (IoCs):- Type Indicator Description IP Address 212[.]80[.]7[.]74 C2 / panel / payload host (AS215439, Play2go International, Frankfurt, DE) Domain stndrdbnk[.]cc Standard Bank typosquat; resolved to C2 IP Domain g-captchafestung[.]sbs Fake-CAPTCHA / possible ClickFix-style lure; resolved to C2 IP Domain festung-e.duckdns[.]org Dynamic-DNS host; observed between May 23 and 30, 2026 Onion (Leak Site) prinzfkbjiazbrur4mjje6mntjc4vydx3iatkkzycufoylqcoo4y7pqd[.]onion Active Prinz Eugen leak site Onion (Leak Site) 6cudc5cqa2bjpwdhcwm2lj6dbqejjjqzeo6ipwvmbazr6cgu7vfk3dad[.]onion Original leak site; currently down Actor Handle ROOTBOY Primary threat actor handle (Exploit, DarkForums) Actor Handle avtokz Earlier alias used on XSS forum Actor Handle GERMANIA Extortion alias used in 700Credit data sale TOX ID 496187425B2944D73FBB17CAF3F9FD569B9ED3A08A497A8314CB4F27A51E65081ACEE1E22F21 Actor contact identifier Email prinzeugen@mail2tor[.]co Actor contact email Email standardbankcc@cock[.]li Actor contact email linked to Standard Bank extortion BTC Address bc1q2ztpcvqdaptej6uu2ywt9mrlatx6envu34rf0v Actor Bitcoin wallet File Name servertool.exe Prinz Eugen ransomware encryptor payload File Extension .prinzeugen Extension appended to all encrypted files Go Package scorched-earth-ausfc Internal Go package containing encryption functions File Header Magic CHV1 Magic bytes in encrypted file header SHA-256 Hash 686213cc11d36af764de824801bced9366dfca3823fe0d51b752f74149bcf1f4 Hash of servertool.exe payload Persistence Command net user admin germania /add Backdoor admin account creation command Self-Delete Command cmd.exe /C ping 127.0.0.1 -n 2 > nul & del /F /Q …\Music\servertool.exe Malware self-deletion mechanism RMM Tool RemotePC (IDrive) Legitimate RMM tool abused for PowerShell staging URL https://212[.]80[.]7[.]74/serverscan.ps1 PowerShell stager download URL URL https://212[.]80[.]7[.]74/stager/mini PowerShell stager download URL URL https://212[.]80[.]7[.]74/stager/ps1 PowerShell stager download URL Crypto Algorithm ChaCha20-Poly1305 (AEAD) Encryption scheme; 32-byte master key, 1MB chunks, per-file random IVs, KDF: Argon2id to SHA-256 to HKDF-SHA256 Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM. Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google. Tags cyber security cyber security news Copy URL Linkedin Twitter ReddIt Telegram Tushar Subhra Dutta Tushar is a senior cybersecurity and breach reporter. He specializes in covering cybersecurity news, trends, and emerging threats, data breaches, and malware attacks. With years of experience, he brings clarity and depth to complex security topics. Trending News Novo Nordisk Confirms Cyber Attack — Hackers Accessed Patient Medical Data and Internal AI Assets Chinese Cyber Contractors Use Malware, Botnets, and Stolen Data to Enable State Operations Critical Cisco ISE Vulnerability Allows Attacker to Execute Malicious Code Remotely Multiple Vulnerabilities in Firefox 152 Enables Remote Code Execution Attacks Hackers Abuse Claude.ai Shared Chat Feature to Host the ClickFix Social Engineering Instructions Latest News Cyber Security Klue Hack Leads to Data Breach Across Multiple Cybersecurity Companies Cyber Security 29-Year-Old ‘Squidbleed’ Vulnerability Discovered With the Aid of Claude Mythos Preview Cyber Security News Microsoft’s New Option Allows Organizations to Block Copilot Access to Office Files Cyber Security News Microsoft has urged IT Admins to Prepare for Windows 11, Version 26H2 Update Cyber Security News New Malware Attack Via WhatsApp Attacking Windows System to Enable Remote Access For Attackers