Latest Research on INC and The Gentlemen Ransomware: Exposed AI Infrastructure
panzer Ransomware Group
Ransomware group profile
Description
Panzer is a financially motivated ransomware group that emerged in August 2026, known for its rapid targeting of high-profile international organizations. The group utilizes a double-extortion model, threatening to release sensitive data if ransom demands are not met, and features a dedicated TOR leak site for operational communications and victim pressure.
Key insights
- •Employs custom file-encrypting malware and appends extortion-related tags to files.
- •Exfiltrates confidential corporate documents and sensitive customer records for leverage.
- •Targets various sectors including education, energy, manufacturing, and retail.
- •Operates a dark web leak site to facilitate extortion and recruit affiliates.
- •Shows rapid operational deployment with a focus on high-profile targets.
Threat Level & Status Breakdown
For panzer · Based on incidents in selected period
Status Breakdown
Recent activity
Monthly attack count for panzer in the selected period
Intelligence
IOCs, YARA/Sigma rules, and related families for panzer
- pnzruro7syvwvefx5mpo2fhzi4jftgquynsqf3vy5x3no57yp2iz4nyd.onion
- ixxrzs3zo57qhbscszen2nvx6hgav5zrx6tjs7lq6unsphwcadeadlid.onion
- 34enzhp4pkfrj5bnmede23wk2io2a44nj23ldwvv3stkaewurup7svad.onion
- qxstd6r6zkzgoolpdqsdxf4lq6rhukgpngwrgbejyyioqy2kwbkxpiyd.onion
- tvhm7xw756yscfixmoyr2aymgu4oan66ospp44vcykvgxmgyq3ua2vyd.onion
- uchhaxue34fz6r2nyrvatxynponoe7wy6ffhwwigpfbz5zgz24w5b6id.onion
- pnzr4delgur5dlhtqcy7qqm6m7dkivxwh742enezpks5kswfpx7qrsid.onion
- q5tb6pspk3ndnjb3hrjncxwjhcbdjs3gneyucav5nniv4zj7od5tehad.onion
- nrr5343n4rl7ymxhajoplth5bvrfdn5dm4pt4cifa2ypiqpvdk7l3xid.onion
- 2v75pgpqlguqpflfjtz6iynwg3ndshjhh6vkxyldorarc6mpc5if5qqd.onion
- vqyux3rgt3ips2kecakobstj4ht2bmfjvpqdignb6zpjpstkmbun5fqd.onion
- p6hck3674wix7hcbeaxndqu45vkiafwokbtojykqxjwqkzwel3js3fqd.onion
- yyjcykk6afxf6vtteeullde6qokefy7phsuxbplcswdqxjdqhkcf6ryd.onion
- exkbqpb36xgih7jgfobhwtvx3cxgdzsf6ccjzvsxpfycnmaq7fzlcfad.onion
- atr2t37ngllrkkbt7tsxprlnuejxknxjjiqvy3woralbuok3unhuzeqd.onion
- af2tfcqmwc3crg56d5iirf3u5znrqc36wxn4mst4ytljm56dwtxgkfid.onion
- sl3iwbho7zdqjc3phm24pcd2xnko3nympkiplp6xthkc4775lb6nmxqd.onion
- czxzcu2smxtrbm7rj4eclskgydq5kiif4tgrvlsn2ri5rbndj5hu6wad.onion
- wjn5eyu4jxe3e27rqrlsf7s672s37z2ivpdpdzx3r67aqzcpxpt6abqd.onion
- xaic33d75dantn47hqcrpyzzqvpcl3mdes7wkmmkvz35l3aaznfxoaqd.onion
- 4ee4snln5yuwmjdxwgznj5lahs24loa54f6aoehbeu6pc3axbcuzepyd.onion
- 4tumprjdxgadgyffjxce3be3adxvhrl4hud5rksy6yam3hc2uslfh5ad.onion
- qrgzshm3khqnud3kfcym4uw3zezjwaek35x6mjnflun4txxglm2cpoid.onion
- knecibfact4epasdbj7dzwfpl5k54z3g22vvcnxkvnflnobhxycolpyd.onion
- bq2uu6vdafrufhfwheghkmurzogtmum67ffah7sqkqyzw36wps2l6xqd.onion
- mbqq27t4idm3im2wqtb2sziynr4gtatqbeozrrvkdy7pco4ah3roxfyd.onion
- h5wpqxywtw5dgmrfczpzdtvyib7ajg3oc6vj6bwxyx3eryphuvb2aaad.onion
- hohn365wbtrynmfw57z3crqgjyu2rwlcn2mfq7j2rwyhcfxfsuanakyd.onion
- srglqrcvuey6p3a352d7hnqdnxwfvwfmlkclvs5u5zydvr6c2cq6mtad.onion
- v2puzhht3hgoduknhwjy6gpc4ylcgnkjepqhpzcmzx2qrj3ibwnicqyd.onion
- mipwc5byekofoatzrgj3wwxsy5wunjqprp2qakdddgbufc3bqgpxtoqd.onion
- aket65o2xznczt5ef4xtlo46g6lv5nlebjpsjrl3ihrvq3pmysekhhyd.onion
- kcipytrnpyvvjygeh5dtehdlhzc6i6ijvsivbgvvevuvbsplgawdezyd.onion
TTPs & Attack Vectors
Tools, initial access, and MITRE ATT&CK techniques for panzer
T1003
OS Credential Dumping
T1110
Brute Force
T1562
Impair Defenses
T1046
Network Service Discovery
T1059
Command and Scripting Interpreter
T1486
Data Encrypted for Impact
T1490
Inhibit System Recovery
T1021
Remote Services
T1078
Valid Accounts
T1547
Boot or Logon Autostart Execution
Victims(61)
| Company | Country | Status | Discovered | |
|---|---|---|---|---|
| Yodingenierie | France | Claimed | 3 days ago | |
| Family Planning Association of Pakistan | Pakistan | Claimed | 4 days ago | |
| Valode & Pistre | France | Claimed | 15 days ago | |
| Zenidoc | France | Claimed | 15 days ago | |
| Supreme Energy | Singapore | Claimed | 18 days ago | |
| solutend | Bolivia | Claimed | 18 days ago | |
| alpine | — | Claimed | 20 days ago | |
| University of Rostock | Germany | Claimed | 21 days ago | |
| EDFelectronics | Poland | Claimed | 21 days ago | |
| SweetRush | United States | Claimed | 22 days ago | |
| Paessolucoes | Brazil | Claimed | 26 days ago | |
| SMCare | United Kingdom | Claimed | about 1 month ago | |
| Ressources Si | France | Claimed | about 1 month ago | |
| Asesoría FAR | Spain | Claimed | about 1 month ago | |
| K3G Solutions | Brazil | Claimed | about 1 month ago | |
| Stim | France | Claimed | about 1 month ago | |
| Inovapy | Brazil | Claimed | about 1 month ago | |
| Universitt Hamburg | Germany | Claimed | about 1 month ago | |
| Nielsen Design | Germany | Claimed | about 1 month ago | |
| Honda | Peru | Claimed | about 1 month ago |
Page 1 of 4
Affected countries(30)
Countries where this group has been reported to target or leak victims.