Daily Trust

Threat profile: Panzer

Panzer is a ransomware-as-a-service (RaaS) operation using double extortion: data theft followed by encryption, with the threat of publication on its leak site. Its tooling targets Windows, Linux, VMware ESXi, and FreeBSD. The group recruits affiliates through a structured program (80% revenue share to affiliates) and had already claimed at least 16 victims across 11+ countries within its first month, mostly in technology and manufacturing.

Observed behavioral indicators

• Shadow-copy deletion (vssadmin delete shadows, wmic shadowcopy delete)
• Boot-recovery tampering (bcdedit /set recoveryenabled no)
• Abuse of unauthorized remote-monitoring (RMM) tools
• Mass archiving and exfiltration via rclone, 7-Zip, or WinRAR before encryption
• Lateral movement via PsExec and internal RDP/SMB sessions following suspicious VPN logins
• Attempts to disable EDR/antivirus tools

Associated MITRE ATT&CK techniques

• T1003 — OS Credential Dumping (Credential Access)
• T1110 — Brute Force (Credential Access)
• T1046 — Network Service Discovery (Discovery)
• T1685 — Disable or Modify Tools (Defense Evasion)
• T1078 — Valid Accounts (Persistence)
• T1021 — Remote Services (Lateral Movement)
• T1005 — Data from Local System (Collection)
• T1048 — Exfiltration Over Alternative Protocol (Exfiltration)
• T1486 — Data Encrypted for Impact (Impact)
• T1657 — Financial Theft (Impact)

Mitigation recommendations

• Enforce phishing-resistant MFA on all remote, VPN, and privileged accounts
• Monitor and alert on shadow-copy deletion and boot-recovery setting changes
• Deploy tamper-protected EDR across all endpoints, including ESXi hypervisors
• Maintain immutable, offline backups and test restores regularly
• Segment the network: isolate domain controllers, backups, and the virtualization layer

Sources (published public security research, not the group's own leak site): GBHackers, CyberXtron

Your organization could be next.

A free scan shows exactly where you're exposed.