UltraVNC 1.8.3.2 (release): - - - https://uvnc.com/downloads/ultravnc/175-ultravnc-1-8-3-2.html Social network announcements, please share, like, boost, favorit

Conexiunile la distanță pentru PC sunt acum disponibile în Windows App, oferind acces simplu la dispozitive Windows fizice și virtuale.

RemotePC is a remote access and remote control software application, developed and owned by IDrive

ALT: Pingu Mad

UltraVNC 1.8.3.0 (release): - - https://uvnc.com/downloads/ultravnc.html - https://uvnc.com/downloads/ultravnc/172-ultravnc-1-8-3-0.html Social network announce

UltraVNC 1.8.2.9 (release): - - https://uvnc.com/downloads/ultravnc.html - https://uvnc.com/downloads/ultravnc/172-ultravnc-1-8-2-9.html Social network announce

Remote desktop access solutions by TeamViewer: connect to remote computers, provide remote support, and collaborate online ➤ Free for personal use!

Discover AnyDesk, the secure and intuitive remote desktop app with innovative features, perfect for seamless remote desktop application across devices.

Remote desktop access solutions by TeamViewer: Connect to remote computers, provide remote support, and collaborate online. Free for personal use!

The Consumer plan ($29.50 per year; one license for remote access to one computer) gives you unlimited concurrent remote access sessions across Linux, macOS, and Windows machines. At this level, you get file transfer, mic pass-through, remote printing, session recording, and whiteboard features.

Prinz Eugen is a newly observed Go-based ransomware family that uses recursive encryption, ChaCha20-Poly1305, and aggressive file targeting while avoiding ransom notes and deleting itself to hinder analysis. The campaign has been linked to Standard Bank Group and other victims, with infrastructure and attribution trails pointing to ROOTBOY, the German-themed operator behind the extortion activity. #PrinzEugen #StandardBankGroup #ROOTBOY #RemotePC #germania

Prinz Eugen is a new ransomware operation that targets recently modified files first, uses hands-on-keyboard tactics, and avoids leaving a ransom note on infected systems. Threatdown says the attackers rely on stolen RDP credentials, RMM tools like RemotePC, and a backdoor admin account, while their victims include Standard Bank. #PrinzEugen #Threatdown #RemotePC #StandardBank

A newly identified ransomware group is using remote management software and scripted attack tools to compromise organizations and deploy a sophisticated encryption threat called Prinz Eugen. The campaign has claimed victims across multiple countries, with targets ranging from major financial institutions to regional training firms. Prinz Eugen first surfaced on April 16, 2026, when a social media post flagged a new ransomware leak portal linked to an attack on Standard Bank Group, a leading financial institution in South Africa. The threat gained wider attention as attackers escalated tactics, releasing stolen data in daily batches after the bank refused to pay. The name references a German heavy cruiser from World War II, the first of several German-language references woven through this campaign. Researchers at ThreatDown investigated an infected customer environment on May 11, 2026, and published a detailed analysis of the encryptor’s capabilities. According to ThreatDown said in a report shared with Cyber Security News (CSN), the ransomware is written in Go, making it harder to reverse-engineer than many older threats. It was built with technical care that sets it apart from most first-wave ransomware samples seen in recent years. What makes Prinz Eugen particularly dangerous is how it selects files. File iteration logic with the most recently modified files displayed first (Source – ThreatDown) Rather than working alphabetically, it targets the most recently modified files first, hitting active documents, open databases, and freshly saved work. This puts maximum pressure on victims to pay before backups can help. Once encryption is complete, the malware quietly removes itself, erasing any trace it was present. The group is believed to be a single operator known as ROOTBOY, who had been selling stolen data under the alias GERMANIA before Prinz Eugen existed. Prior activity includes breaches affecting a US driving-school software provider and a 700Credit database holding over 8.4 million records. This history reflects someone with established criminal marketplace access and real experience running extortion operations. Hackers Use RemotePC RMM and PowerShell Stagers In the incident analyzed, the attacker gained initial access through compromised Remote Desktop Protocol credentials. The encryptor executable, named servertool.exe, was downloaded using Chrome and placed in the victim’s Music folder. Temporary file encryption (Source – ThreatDown) The attacker then used RemotePC, a legitimate remote management tool, to launch PowerShell stagers and pull additional payloads from a command-and-control server at 212.80.7.74. Those payloads were likely remote access tools built for data theft and exfiltration. The attacker also created a hidden admin account using the command net user admin germania /add, establishing a persistent foothold in the environment. Using legitimate RMM software allowed the operator to blend into normal enterprise traffic and avoid triggering standard alerts. The infrastructure supporting the campaign was deliberate but compact. Three domains resolved to the same server, including a typosquat of Standard Bank’s domain and a fake CAPTCHA page likely used to lure victims into executing malicious code. After the server IP became public, the operator dismantled everything, removing DNS records and wiping the admin panel. Encryption Behavior and Anti-Forensic Design The encryptor uses ChaCha20-Poly1305 with a unique key per file, a three-stage key derivation process, and one-megabyte chunk processing, making decryption without the original key nearly impossible. Each encrypted file receives the .prinzeugen extension, but no ransom note is ever written to disk. All victim communication happens through out-of-band channels such as direct email or dark-web portals, removing a key forensic indicator investigators rely on. Before exiting, the malware wipes its encryption key from memory, runs garbage collection to clear residuals, and deletes itself using a timed Windows command. The C2 panel at the time of writing (Source – ThreatDown) This deliberate cleanup limits what forensic teams can recover after an attack. The design reflects an operator comfortable with both enterprise environments and the limits of standard incident response. Security teams should monitor for unauthorized use of remote management tools, especially when tied to PowerShell execution. Blocking untrusted RDP access, enforcing multi-factor authentication , and watching for suspicious new local admin accounts are critical steps organizations must take to reduce exposure to this threat. Indicators of Compromise (IoCs):- Type Indicator Description IP Address 212[.]80[.]7[.]74 C2 / panel / payload host (AS215439, Play2go International, Frankfurt, DE) Domain stndrdbnk[.]cc Standard Bank typosquat; resolved to C2 IP Domain g-captchafestung[.]sbs Fake-CAPTCHA / possible ClickFix-style lure; resolved to C2 IP Domain festung-e.duckdns[.]org Dynamic-DNS host; observed between May 23 and 30, 2026 Onion (Leak Site) prinzfkbjiazbrur4mjje6mntjc4vydx3iatkkzycufoylqcoo4y7pqd[.]onion Active Prinz Eugen leak site Onion (Leak Site) 6cudc5cqa2bjpwdhcwm2lj6dbqejjjqzeo6ipwvmbazr6cgu7vfk3dad[.]onion Original leak site; currently down Actor Handle ROOTBOY Primary threat actor handle (Exploit, DarkForums) Actor Handle avtokz Earlier alias used on XSS forum Actor Handle GERMANIA Extortion alias used in 700Credit data sale TOX ID 496187425B2944D73FBB17CAF3F9FD569B9ED3A08A497A8314CB4F27A51E65081ACEE1E22F21 Actor contact identifier Email prinzeugen@mail2tor[.]co Actor contact email Email standardbankcc@cock[.]li Actor contact email linked to Standard Bank extortion BTC Address bc1q2ztpcvqdaptej6uu2ywt9mrlatx6envu34rf0v Actor Bitcoin wallet File Name servertool.exe Prinz Eugen ransomware encryptor payload File Extension .prinzeugen Extension appended to all encrypted files Go Package scorched-earth-ausfc Internal Go package containing encryption functions File Header Magic CHV1 Magic bytes in encrypted file header SHA-256 Hash 686213cc11d36af764de824801bced9366dfca3823fe0d51b752f74149bcf1f4 Hash of servertool.exe payload Persistence Command net user admin germania /add Backdoor admin account creation command Self-Delete Command cmd.exe /C ping 127.0.0.1 -n 2 > nul & del /F /Q …\Music\servertool.exe Malware self-deletion mechanism RMM Tool RemotePC (IDrive) Legitimate RMM tool abused for PowerShell staging URL https://212[.]80[.]7[.]74/serverscan.ps1 PowerShell stager download URL URL https://212[.]80[.]7[.]74/stager/mini PowerShell stager download URL URL https://212[.]80[.]7[.]74/stager/ps1 PowerShell stager download URL Crypto Algorithm ChaCha20-Poly1305 (AEAD) Encryption scheme; 32-byte master key, 1MB chunks, per-file random IVs, KDF: Argon2id to SHA-256 to HKDF-SHA256 Note:   IP addresses and domains are intentionally defanged (e.g.,  [.] ) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM . Follow us on  Google News ,  LinkedIn , and  X  to Get More Instant Updates ,  Set CSN as a Preferred Source in Google . The post Hackers Use RemotePC RMM and PowerShell Stagers to Deploy Prinz Eugen Ransomware appeared first on Cyber Security News .

Best Enterprise Remote Access Software: 1. Perimeter81 2. TeamViewer 3. ISL Online 4. AnyDesk 5. GoToMyPC 6. RemotePC and more.

Best Enterprise Remote Access Software: 1. Perimeter81 2. TeamViewer 3. Chrome Remote Desktop 4. AnyDesk 5. GoToMyPC 6. RemotePC

Prinz Eugen ransomware uses remote management tools and scripts to hit firms worldwide, leaking stolen data when victims refuse to pay.

Quote from: AntonyZ0 on Yesterday at 10:19:48 > Any ideas? > Yes, it's closed-source precompiled against systemd and you'd be better off using some other solution. Unless you can successfully request a clean binary.

Yes it is from AUR! Any ideas?

Is this from the AUR? They've compiled it against systemd, you can't (easily) run it in Artix.