Skip to main content
Darkfield

Operator dossier

PrinzEugen (also tracked as prinz eugen) is a ransomware operator currently active on public leak sites. Darkfield has indexed 11 public victims claimed by this operator between May 4, 2026 and June 28, 2026. PrinzEugen is a relatively obscure ransomware group that first emerged in May 2026, appearing to be financially motivated based on their operational profile. The group's country of origin and potential affiliations with other ransomware operations remain unknown due to limited public reporting and intelligence documentation. With only one documented victim to date, detailed information about PrinzEugen's attack methodology, initial access vectors, and encryption techniques has not been extensively analyzed or publicly documented by major cybersecurity firms or law enforcement agencies. The group has demonstrated a focus on the financial services sector, with their sole known victim located in South Africa, though it is unclear whether this geographic and sectoral targeting represents a deliberate strategy or is simply reflective of their limited observed activity. Given the recent emergence of this group in 2026 and the lack of comprehensive reporting from established threat intelligence sources such as CISA, FBI, or Mandiant, PrinzEugen's current operational status and capabilities remain largely uncharacterized in the public threat landscape.

Most-targeted sectors

Most-affected countries

Recent disclosures by PrinzEugen

All 11 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for PrinzEugen →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Active ransomware operator

← All groups

PrinzEugen

aka prinz eugen · 11 victims indexed · first seen 2 months ago · last activity 17 days ago

11
Victims indexed
#204 of 364 tracked operators
1m
Active period
May 2026 → Jun 2026
1
Countries hit
top ZA · 1

At a glance

Status
active
Aliases
prinz eugen
First seen
2 months ago
Last activity
17 days ago
Onion sites
3 known endpoints
Primary sector
Financial Services · 1 hits

About

PrinzEugen is a relatively obscure ransomware group that first emerged in May 2026, appearing to be financially motivated based on their operational profile. The group's country of origin and potential affiliations with other ransomware operations remain unknown due to limited public reporting and intelligence documentation. With only one documented victim to date, detailed information about PrinzEugen's attack methodology, initial access vectors, and encryption techniques has not been extensively analyzed or publicly documented by major cybersecurity firms or law enforcement agencies. The group has demonstrated a focus on the financial services sector, with their sole known victim located in South Africa, though it is unclear whether this geographic and sectoral targeting represents a deliberate strategy or is simply reflective of their limited observed activity. Given the recent emergence of this group in 2026 and the lack of comprehensive reporting from established threat intelligence sources such as CISA, FBI, or Mandiant, PrinzEugen's current operational status and capabilities remain largely uncharacterized in the public threat landscape.

References

1 link

External sources curated by the MISP threat-intel community.

Timeline

1 months
2026-05-01T00:00:00+00:00 · 1
2026-05-01T00:00:00+00:002026-05-01T00:00:00+00:00

Top countries

🇿🇦 South Africa
1
South Africa dossier →

Top sectors

Financial Services
1
Financial Services dossier →

MITRE ATT&CK

1 techniques · 1 tactics

Tactics

Impact

Techniques

  • T1486Data Encrypted for Impact

Recent victims

Loading…

Onion infrastructure

3 known
  • http://6cudc5cqa2bjpwdhcwm2lj6dbqejjjqzeo6ipwvmbazr6cgu7vfk3dad.onion
  • http://prinzfkbjiazbrur4mjje6mntjc4vydx3iatkkzycufoylqcoo4y7pqd.onion
  • http://prinzkpn6d3itrgcytmsmlcpt5mgwn3ihpck2hsed5cezlbtbi3wklid.onion

Source

Updated 17 days ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time PrinzEugen posts a victim.

Add PrinzEugen to your watchlist — Pro pings you within 5 minutes of any new PrinzEugen leak-site post, Telegram callout, or affiliate-rebrand inference.