Loading threat actor…
Panzer is an emerging ransomware-as-a-service operation active in 2026. It has been advertised on a Russian-speaking cybercriminal forum with an affiliate model that reportedly offers an 80/20 revenue split and automated management features for affiliates. The operation claims support for ransomware builds targeting Windows, Linux, ESXi, and FreeBSD, along with victim negotiation portals and a leak site used to pressure victims through publication of stolen data. Public reporting also indicates affiliate rules that prohibit targeting CIS countries. Panzer has been associated with claimed ransomware incidents affecting organizations in multiple countries, including the Czech Republic, the United States, Germany, Thailand, Nigeria, Switzerland, and Indonesia. Reported victims span engineering, technology, manufacturing, food and beverage, energy distribution, media, retail, and education. These incidents are described as ransomware attacks accompanied by data breaches, indicating both encryption and data theft extortion behavior. Operationally, Panzer has been linked to capabilities consistent with ransomware and extortion workflows, including data encryption for impact, exfiltration, defense evasion, and post-compromise victim negotiation. The service advertises anti-detection measures, execution monitoring, leak-site publication controls, and affiliate administration features. However, some early claims about the platform, tooling, and incidents remain only partially corroborated, and public malware samples have not been broadly available.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
5 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 malware family attributed to this actor across reporting.
5 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Conducting a ransomware attack resulting in a data breach against SAGASTA sro.
Conducting a ransomware attack against Infosat, a technology-sector organization in the United States.
Conducting a ransomware attack against Alpine Electronics Europe.
Emerging ransomware-as-a-service operation recruiting affiliates on a Russian-speaking cybercrime forum, advertising an automated platform for ransomware deployment, victim negotiation portals, leak-site extortion, and multi-platform locker builds.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.