WithSecure Labs security analysts noted multiple instances of Prince Ransomware-based attacks, including a prominent case in February 2025, when Taiwan’s Mackay Memorial Hospital fell victim to “CrazyHunter” ransomware. This architecture represents a significant evolution in the ransomware threat landscape, enabling a new generation of cyber attackers to deploy sophisticated encryption capabilities with minimal technical knowledge. The tool’s architecture enables even those with limited technical expertise to generate fully functional ransomware by simply modifying a configuration file to customize elements like ransom notes and encrypted file extensions. Attack vectors vary by deployment, but in documented cases, attackers combined Prince-built ransomware with defense evasion techniques like “Bring Your Own Vulnerable Driver” (BYOVD) and lateral movement tools such as SharpGPOAbuse to maximize impact across networks. ---------- Prince Ransomware ---------- Your files have been encrypted using Prince Ransomware! They can only be decrypted by paying us a ransom in cryptocurrency. The researchers found that Prince Ransomware generates variants with minimally modified ransom notes, demonstrating how little customization is needed to deploy new ransomware strains. This combination has proven particularly effective, allowing threat actors to disable security products and spread ransomware throughout organizational networks. For each file, the builder generates a unique ChaCha20 key and nonce, then encrypts using a pattern where 1 byte is encrypted followed by 2 bytes left unencrypted. This Go-language builder was freely available on GitHub, significantly lowering the technical barrier for attackers to launch sophisticated ransomware campaigns. The ChaCha20 key and nonce are encrypted using an ECIES public key and appended to the file beginning, making decryption without the private key extremely difficult. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. The encryption mechanism employed by Prince Ransomware demonstrates considerable sophistication.
This Cyber News was published on cybersecuritynews.com. Publication date: Thu, 03 Apr 2025 06:40:16 +0000