Panzer — Ransomware Profile

Panzer is an extortion crew first observed on its Tor-based data-leak site in August 2026, and leak-site trackers have since recorded at least 17 claimed victims across at least eleven countries. WatchGuard profiles it as an emerging ransomware-as-a-service operation running double extortion, pairing data theft with encryption and listing a Tox contact channel, and notes early listings spanning education, media, jewelry, oil-and-gas and food businesses in Indonesia, Spain, Nigeria and Thailand. Claims against government bodies followed: DeXpose reported its late-August leak-site claim against Serbia's Government of Vojvodina, while the site has also listed Portugal's Directorate-General for Education, Spain's Castilla-La Mancha region and South Korea's DL E&C. Ransomware.live rates Panzer an emerging group and cautions that its claims remain unverified.

IntelFusions coverage (3)

Japan takes a month of hacktivist DDoS and real breaches 2026-09-14 · Cyber Incidents
More ransomware crews, but far fewer victims each 2026-09-13 · Ransomware
Spain's national weather agency lands on a leak site 2026-09-11 · Ransomware

Recent claimed victims

Inovapy 2026-09-18
K3G Solutions Brazil 2026-09-18
Stim 2026-09-18
Universitt Hamburg 2026-09-18
Nielsen Design 2026-09-16
Honda (Peru) 2026-09-15
Cerámicas Kantu 2026-09-13
Konica Minolta Bulgaria 2026-09-11
Agencia Estatal de Meteorología 2026-09-11
Aqualogus 2026-09-09
Financière d'Uzès 2026-09-08
KHALED ALFAGIH ENGINEERING CONSULTANCY 2026-09-06
Edacentrum 2026-09-06
Hochschule Heilbronn Bildungscampus 2026-09-04
Dinas Komunikasi dan Informatika 2026-09-03
Directorate-General for Education 2026-08-28
Government of Vojvodina 2026-08-24
Senvibe 2026-08-24
Nteitalia 2026-08-21
Frisian Flag Indonesia 2026-08-20
Castilla La Mancha 2026-08-17
DL E&C 2026-08-17
Doimo Cucine 2026-08-17
SAGASTA sro 2026-08-16
Infosat 2026-08-16

Read the full analysis on IntelFusions