ThreatDown In The News

Prinz Eugen ransomware targets recently modified files first and skips ransom notes, exposing backup, EDR, and incident response gaps for IT teams. The encryptor prioritizes same-day work over older archives, meaning nightly backups may not cover the most critical files at the time of an attack. With no ransom note, wallpaper change, or on-disk demand, standard detection playbooks can fail to trigger, requiring teams to rely on behavioral signals instead. The article outlines where response processes are most likely to break and what IT teams should verify before an incident occurs.

A newly discovered ransomware operation called Prinz Eugen maximizes attack impact by targeting the most recently modified files first and leaving no ransom note behind. Research from ThreatDown uncovered a hands-on threat actor that leverages legitimate RMM tools and living-off-the-land techniques to evade detection, with initial access gained through stolen RDP credentials. The Go-based encryptor uses advanced cryptography and self-destructs after wiping its own encryption keys from memory. Operating outside the RaaS model, Prinz Eugen moves extortion communications entirely off-system, a tactic increasingly favored by organized ransomware groups to reduce forensic artifacts and complicate detection.

ThreatDown has grown its distribution-led business from approximately 1% to roughly 40% of total transactions in under a year, reflecting strong partner confidence in its channel-first approach. The company launched the Nexus Partner Program, which introduces genuine deal registration enforcement, margin retention, competitive renewal discounting, and new MDF and rebate structures. A redesigned pod-based sales model aligns dedicated channel, renewals, MSP, engineering, and customer success resources around shared partner sets. CRN awarded ThreatDown a 5-Star Partner Program Award in 2026 and named three executives to its Channel Chiefs list.

ThreatDown's Marco Giuliani reveals how attackers weaponized the Deno JavaScript runtime to deliver fileless malware hidden inside a JPEG and executed entirely in memory, bypassing traditional antivirus and EDR detection. He also explains why AI skill files in open repositories are becoming the next major attack surface.

ThreatDown announced significant channel momentum, growing its distribution-led business from approximately 1% to roughly 40% of total transactions in under a year. The company launched the Nexus Partner Program, offering deal registration enforcement, margin retention, competitive renewal discounting, and new MDF and rebate structures. A redesigned pod-based sales model pairs dedicated channel, renewals, MSP, engineering, and customer success resources around shared partner sets. CRN recognized ThreatDown with a 5-Star Partner Program Award in 2026 and named three executives to its Channel Chiefs list.