Ransomware needs a way in. Stolen credentials are the cheapest one.
panzer Ransomware Group
Ransomware group profile
Description
Panzer is a financially motivated ransomware group that emerged in August 2026, known for its rapid targeting of high-profile international organizations. The group utilizes a double-extortion model, threatening to release sensitive data if ransom demands are not met, and features a dedicated TOR leak site for operational communications and victim pressure.
Key insights
- •Employs custom file-encrypting malware and appends extortion-related tags to files.
- •Exfiltrates confidential corporate documents and sensitive customer records for leverage.
- •Targets various sectors including education, energy, manufacturing, and retail.
- •Operates a dark web leak site to facilitate extortion and recruit affiliates.
- •Shows rapid operational deployment with a focus on high-profile targets.
Threat Level & Status Breakdown
For panzer · Based on incidents in selected period
Status Breakdown
Recent activity
Monthly attack count for panzer in the selected period
Intelligence
IOCs, YARA/Sigma rules, and related families for panzer
- pnzruro7syvwvefx5mpo2fhzi4jftgquynsqf3vy5x3no57yp2iz4nyd.onion
- ixxrzs3zo57qhbscszen2nvx6hgav5zrx6tjs7lq6unsphwcadeadlid.onion
- 34enzhp4pkfrj5bnmede23wk2io2a44nj23ldwvv3stkaewurup7svad.onion
- qxstd6r6zkzgoolpdqsdxf4lq6rhukgpngwrgbejyyioqy2kwbkxpiyd.onion
- tvhm7xw756yscfixmoyr2aymgu4oan66ospp44vcykvgxmgyq3ua2vyd.onion
- uchhaxue34fz6r2nyrvatxynponoe7wy6ffhwwigpfbz5zgz24w5b6id.onion
TTPs & Attack Vectors
Tools, initial access, and MITRE ATT&CK techniques for panzer
T1003
OS Credential Dumping
T1110
Brute Force
T1562
Impair Defenses
T1046
Network Service Discovery
T1059
Command and Scripting Interpreter
T1486
Data Encrypted for Impact
T1490
Inhibit System Recovery
T1021
Remote Services
T1078
Valid Accounts
T1547
Boot or Logon Autostart Execution
Victims(46)
| Company | Country | Status | Discovered | |
|---|---|---|---|---|
| Stim | France | Claimed | about 12 hours ago | |
| Inovapy | Brazil | Claimed | about 12 hours ago | |
| Universitt Hamburg | Germany | Claimed | about 12 hours ago | |
| Nielsen Design | Germany | Claimed | 2 days ago | |
| Honda | Peru | Claimed | 3 days ago | |
| Cerámicas Kantu S.A.C. | Peru | Claimed | 5 days ago | |
| ห้างหุ้นส่วนจำกัด ลาวรรณพาณิชย์ | — | Claimed | 5 days ago | |
| Backups | — | Claimed | 7 days ago | |
| Photos | — | Claimed | 7 days ago | |
| Documents | — | Claimed | 7 days ago | |
| E-PAPERS | — | Claimed | 7 days ago | |
| Career | — | Claimed | 7 days ago | |
| VIDEOS | — | Claimed | 7 days ago | |
| Konica Minolta Bulgaria | Bulgaria | Claimed | 7 days ago | |
| Agencia Estatal de Meteorología | Spain | Claimed | 7 days ago | |
| FESTINA | — | Claimed | 8 days ago | |
| Aqualogus | Portugal | Claimed | 9 days ago | |
| Coop Database | — | Claimed | 9 days ago | |
| Classified Database | — | Claimed | 9 days ago | |
| Newswrap Files | — | Claimed | 9 days ago |
Page 1 of 3
Affected countries(23)
Countries where this group has been reported to target or leak victims.