THREAT ACTOR
PANZER_
ActivePANZER is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem: file encryption combined with the threat of stolen-data publication on a public leak site. It continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of PANZER, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.
Victims by year
- 2026 29
Leak site mirrors
12 mirrors tracked, 5 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.
-
pnzruro7syvwvefx5mpo2fhzi4jftgquynsqf3vy5x3no57yp2iz4nyd.onionPanzer snapshot · 2026-09-23 02:02 -
34enzhp4pkfrj5bnmede23wk2io2a44nj23ldwvv3stkaewurup7svad.onionPanzer | Cloud . festina-group snapshot · 2026-09-23 02:01 -
tvhm7xw756yscfixmoyr2aymgu4oan66ospp44vcykvgxmgyq3ua2vyd.onionPanzer | Cloud . surakarta-unv snapshot · 2026-09-23 00:09 -
ixxrzs3zo57qhbscszen2nvx6hgav5zrx6tjs7lq6unsphwcadeadlid.onionPanzer | Cloud . daily-trust snapshot · 2026-09-23 00:32 -
qxstd6r6zkzgoolpdqsdxf4lq6rhukgpngwrgbejyyioqy2kwbkxpiyd.onionPanzer | Cloud . siamoil snapshot · 2026-09-23 02:04 -
uchhaxue34fz6r2nyrvatxynponoe7wy6ffhwwigpfbz5zgz24w5b6id.onionPanzer | Cloud . Alpine Company snapshot · 2026-09-22 23:00 -
vqyux3rgt3ips2kecakobstj4ht2bmfjvpqdignb6zpjpstkmbun5fqd.onionPanzer | Cloud . SAGASTA snapshot · 2026-09-22 23:01 -
sl3iwbho7zdqjc3phm24pcd2xnko3nympkiplp6xthkc4775lb6nmxqd.onionPanzer | Cloud . doimocucine snapshot · 2026-09-23 02:17 -
mbqq27t4idm3im2wqtb2sziynr4gtatqbeozrrvkdy7pco4ah3roxfyd.onionPanzer | Cloud . Castilla la mancha snapshot · 2026-09-23 00:00 -
czxzcu2smxtrbm7rj4eclskgydq5kiif4tgrvlsn2ri5rbndj5hu6wad.onionPanzer | Cloud . dlenc snapshot · 2026-09-23 00:11 -
aket65o2xznczt5ef4xtlo46g6lv5nlebjpsjrl3ihrvq3pmysekhhyd.onionPanzer | Cloud . Nteitalia snapshot · 2026-09-23 00:01 -
2v75pgpqlguqpflfjtz6iynwg3ndshjhh6vkxyldorarc6mpc5if5qqd.onionPanzer | Cloud . Frisian snapshot · 2026-09-23 01:02
Recent victims
The 50 most recent victims claimed by PANZER. Total in the index: 29.
| Date listed | Victim | Description |
|---|---|---|
| 2026-09-21 | Universitt Hamburg | Universität Hamburg is the largest research and educational institutio… |
| 2026-09-21 | Inovapy | INOVAPY is a technology company specializing in software development a… |
| 2026-09-21 | Stim | Stim France specializes in video surveillance solutions within the sec… |
| 2026-09-21 | K3G Solutions Brazil | K3G Solutions is a Brazilian telecom/IT consulting company based in Ma… |
| 2026-09-16 | Nielsen Design | Helmar Nielsen dreamed of a frame that was accessible, precise, and ab… |
| 2026-09-15 | Honda (Peru) | Honda is a global automotive and motorcycle manufacturer founded in 19… |
| 2026-09-14 | Financière d'Uzès | Financière d'Uzès offers a range of financial services tailored for in… |
| 2026-09-14 | Aqualogus | Aqualogus is a private engineering consulting firm that helps communit… |
| 2026-09-14 | Konica Minolta Bulgaria | Konica Minolta Bulgaria is a company with its own sales, marketing, an… |
| 2026-09-14 | Agencia Estatal de Meteorología | Agencia Estatal de Meteorología - AEMET is a governmental agency of Sp… |
| 2026-09-14 | Cerámicas Kantu | Cerámicas Kantu S.A.C. is a Peruvian company specializing in the manuf… |
| 2026-09-07 | KHALED ALFAGIH ENGINEERING CONSULTANCY | Khaled Alfagih Engineering Consultancy Company is one of the most spec… |
| 2026-09-05 | Hochschule Heilbronn Bildungscampus | AStA Hochschule Heilbronn is the general students' committee that repr… |
| 2026-09-03 | Dinas Komunikasi dan Informatika | The Central Java Province Communication and Informatics Service was fo… |
| 2026-08-30 | Directorate-General for Education | The Direção-Geral de Estatísticas da Educação e Ciência (DGEEC) is a P… |
| 2026-08-24 | Government of Vojvodina | The Provincial Government of Vojvodina is focused on enhancing economi… |
| 2026-08-21 | Nteitalia | NTE Italia, an engineering and telecommunications service provider bas… |
| 2026-08-20 | Frisian Flag Indonesia | Frisian Flag Indonesia specializes in high-quality dairy products, inc… |
| 2026-08-17 | DL E&C | DL E&C Co., Ltd. is a major South Korean construction and engineering … |
| 2026-08-17 | SAGASTA sro | SAGASTA is a design and engineering company specializing in modern con… |
| 2026-08-17 | Castilla La Mancha | The Government of Castilla-La Mancha provides a wide range of services… |
| 2026-08-17 | Doimo Cucine | Doimo Cucine specializes in modern, customizable designer kitchens tha… |
| 2026-08-15 | Alpine Electronics Europe | Alpine Electronics Europe specializes in the distribution of automotiv… |
| 2026-08-12 | Xpress Tech | Xpress Tech is a leading B2B iGaming aggregation platform established … |
| 2026-08-10 | The Minor Food Group | Founded in 1980, Minor Food is the culinary pillar of Minor Internatio… |
| 2026-08-09 | Siam Oil Product | Siam Oil Product Co., Ltd. is a Thailand-based petroleum and industria… |
| 2026-08-08 | Daily Trust | Daily Trust is a Nigerian news organization that provides breaking new… |
| 2026-08-05 | Festina Group | Festina Group is a major watch and jewelry company that owns six diffe… |
| 2026-08-05 | Surakarta University | Universitas Surakarta (UNSA) is a technology-based university committe… |
CONFIRMED ATTACKS
Panzer confirmed attacks: 1 verified incident
Ransomnews has verified 1 Panzer incident against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. All of them fall in August 2026. Spain accounts for 1 of them (100%). The most affected sector is government, at 1 confirmed victim.
Confirmed victims by year
Most affected sectors
Most affected countries
Verified Panzer incidents
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| August 2026 | Gobierno de Castilla-La Mancha | Government | Castilla-La Mancha, Spain | — | Unknown | Source |
Claimed vs confirmed. The figures above the fold on this page come from Panzer's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design: most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.