Senvibe Data Breach

Senvibe, a Serbian technology entity operating with the domain senvibe[.]ni[.]ac[.]rs, was listed on Panzer’s leak site on August 24, 2026. The domain’s affiliation with the University of Nis network infrastructure is a key contextual factor, as academic or research-affiliated entities connected to Serbian universities align with Panzer’s established regional targeting patterns. In the 60 days leading up to this listing, Panzer claimed 16 victims. The ransomware group’s most frequently targeted sectors are Technology, Manufacturing, and Government & Defense, with Serbia identified as its primary geographic focus. Panzer has concentrated its operations in Serbia and Italy, with some activity also noted in Indonesia. Notable victims similar to Senvibe in terms of regional and sectoral overlap include Nteitalia, Infosat, Xpress Tech, and the Government of Vojvodina.

SOCRadar’s stealer-log telemetry returned no records for the queried domain, senvibe[.]ni[.]ac[.]rs. It is important to note that academic and research-network-affiliated entities often operate under institutional domains that might be underrepresented in commercial stealer-log feeds. Therefore, the absence of records in this specific query may indicate a coverage gap in the data rather than a confirmed lack of credential exposure. Panzer’s operational methodology typically involves a common credential pipeline driven by initial access brokers. This process includes acquiring fresh infostealer logs from underground markets, validating credentials, and then authenticating against VPN or remote-access portals before deploying ransomware. For entities affiliated with Serbian university networks, the potential credential surface may encompass both institutional Single Sign-On (SSO) systems and any externally accessible research or administrative portals. Standard searches for commercial domain-based stealer logs might not capture exposures stemming from institutional login systems.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.