Ransomware Group intelligence
Panzer
ActiveTrack Panzer with 43 published victims and 6 known leak locations in a single intelligence view.
Overview
Panzer is tracked by Breach House as a ransomware group with 43 published victims.
Germany is currently the most targeted country in this dataset.
6 known leak locations are currently associated with this group.
Leak Status Distribution
- Leaked 5 11.6%
- Pending 37 86.0%
- Deleted 1 2.3%
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (6)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 6 | Onion service | Up checked 2h ago | uchhaxue34fz6r2nyrvatxynponoe7wy6ffhwwigpfbz5zgz24w5b6id.onion |
| Leak location 4 | Onion service | Up checked 2h ago | qxstd6r6zkzgoolpdqsdxf4lq6rhukgpngwrgbejyyioqy2kwbkxpiyd.onion |
| Leak location 2 | Onion service | Up checked 2h ago | 34enzhp4pkfrj5bnmede23wk2io2a44nj23ldwvv3stkaewurup7svad.onion |
| Leak location 3 | Onion service | Up checked 2h ago | ixxrzs3zo57qhbscszen2nvx6hgav5zrx6tjs7lq6unsphwcadeadlid.onion |
| Leak location 5 | Onion service | Down checked 2h ago | tvhm7xw756yscfixmoyr2aymgu4oan66ospp44vcykvgxmgyq3ua2vyd.onion |
| Leak location 1 | Onion service | Down checked 2h ago | pnzruro7syvwvefx5mpo2fhzi4jftgquynsqf3vy5x3no57yp2iz4nyd.onion |
Top Activity Sectors (14)
Typical Attacks (10)
▼MITRE ATT&CK does not currently catalogue Panzer, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v20.0. Confidence: medium. Treat it as orientation, not attribution.
-
T1059.001 PowerShell Execution
What they do: Panzer executes payloads through PowerShell scripts to automate discovery, privilege escalation, and lateral movement.
What that means: Adversaries may abuse PowerShell commands and scripts for execution.
-
T1569.002 Service Execution Execution
What they do: Panzer executes encryption routines through Windows Service contexts to maintain persistence and evade user interaction alerts.
What that means: Adversaries may abuse the Windows service control manager to execute malicious commands or payloads.
-
T1685 Disable or Modify Tools Defense Impairment
What they do: Panzer disables security tools by modifying Windows Defender and AV service configurations to evade detection.
What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
-
T1027.013 Encrypted/Encoded File Stealth
What they do: Panzer encodes victim data and ransom notes using custom symmetric encryption before exfiltration to command-and-control servers.
What that means: Adversaries may encrypt or encode files to obfuscate strings, bytes, and other specific patterns to impede detection.
-
T1070.004 File Deletion Stealth
What they do: Panzer deletes Volume Shadow Copies and backup directories via vssadmin and built-in file deletion routines to prevent recovery.
What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
-
T1564.003 Hidden Window Stealth
What they do: Panzer hides malicious processes and command execution behind hidden windows to avoid user and endpoint detection visibility.
What that means: Adversaries may use hidden windows to conceal malicious activity from the plain sight of users.
-
T1083 File and Directory Discovery Discovery
What they do: Panzer uses file and directory discovery via PowerShell to enumerate critical system and victim data paths before encryption.
What that means: Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.
-
T1021.002 SMB/Windows Admin Shares Lateral Movement
What they do: Panzer moves laterally across networks by exploiting SMB/Windows Admin Shares to access additional victim machines.
What that means: Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
-
T1486 Data Encrypted for Impact Impact
What they do: Panzer encrypts victim files using custom ransomware binaries targeting business documents and engineering assets.
What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
-
T1490 Inhibit System Recovery Impact
What they do: Panzer inhibits system recovery by corrupting restore points and disabling backup restoration mechanisms post-encryption.
What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.
Victims (43)
Search, filter and paginate the victim timeline for Panzer. Showing 1–43 of 43.
| Type | Target | Discovered | Country | Business Category | Intel Link | Leak status |
|---|---|---|---|---|---|---|
| Ransomware | Valode & Pistre id33799 View details | France | — | pending | ||
|
Valode & Pistre is today one of France’s premier architecture and engineering firms. Based in Paris with a branch operating for over ten years in Beijing, the firm works on projects both in France and across the globe in Europe, Asia, the Middle East, North and Sub-Saharan Africa, Russia and Central America. Valode & Pistre’s practice focuses on very diverse scales, from developing comprehensive plans for brand new cities to designing furniture. It also includes very diverse briefs. |
||||||
| Ransomware | Zenidoc id33800 View details | — | — | pending | ||
|
a French healthcare software company that helps hospitals and medical professionals automate documentation, transcribe medical dictation, manage patient records, and streamline workflows using AI and voice-recognition technology. Data Content : - 605k Patient Data, Names, Phone, SSN and more. - Zenidoc Cloud Dev, Data, Prod, Support Chats, Source Codes and more. |
||||||
| Ransomware | Supreme Energy id33659 View details | Indonesia | — | pending | ||
|
Supreme Energy is an Indonesian renewable-energy company that develops geothermal power projects to generate clean electricity. |
||||||
| Ransomware | solutend id33660 View details | — | — | pending | ||
|
Bolivian technology company that provides audiovisual systems, digital signage, interactive displays, and business computing solutions. |
||||||
| Ransomware | University of Rostock id33541 View details | Germany | Education | pending | ||
|
The University of Rostock, founded in 1419, is the oldest university in the Baltic Sea region, offering over 140 diverse study programs across various fields. It focuses on innovative research and interdisciplinary collaboration to address contemporary societal challenges. The university welcomes students and staff from around the world, promoting a family-friendly and inclusive environment. It also emphasizes democratic values and the importance of free academic exchange. |
||||||
| Ransomware | EDFelectronics id33524 View details | — | Manufacturing / Engineering | pending | ||
|
EDFelectronics.com is a Polish engineering company that develops specialized electronics and plasma technology for industrial and research applications. |
||||||
| Ransomware | SweetRush id33519 View details | United States | Hospitality / Food & Beverage / Tourism | pending | ||
|
Dream for a moment that you have the expertise and tools to positively impact the lives of others. You can affect mindsets and behavior. You can help an organization grow, change, prosper, and thrive. The passionate pursuit of this expertise and the development of these tools have been at the heart of the success SweetRush has experienced collaborating with clients who share the same dream. SweetRush's focus on team culture and mastery of performance improvement is reflected in loyal clients, a near-zero turnover of teammates, an 18-year track record of success, and a remarkable portfolio. Our work with clients has earned us gold awards from our peers and high ranking on the top training industry lists. Every solution we deliver is infused with creativity. Instructional creativity allows us to discover effective and unique solutions to our clients' challenges. Artistic creativity spurs us to create visually exciting, engaging user experiences. Technical creativity allows us to embrace. |
||||||
| Ransomware | Paessolucoes id33414 View details | Brazil | Retail / E-commerce | pending | ||
|
paessolucoes.com.br is the website of Paes Soluções, a Brazilian IT company offering business software, hosting, cloud backup, VPS, and technical support, based in Campo Mourão, Paraná. |
||||||
| Ransomware | SMCare id33223 View details | — | null | pending | ||
|
Scenario Management is a specialist support provider based in Lancashire, serving areas including Blackpool, Wyre, Fylde, and Preston. The company offers 24-hour supported living and residential services, as well as short stay respite care for individuals with learning disabilities, complex needs, autism, and associated mental health issues. Their services are designed for those who may challenge services or have forensic backgrounds. Scenario Management aims to provide comprehensive support tailored to the needs of their clients. |
||||||
| Ransomware | Asesoría FAR id33219 View details | — | — | pending | ||
|
Asesoría FAR is a Barcelona-based firm providing property management, accounting, tax, and business advisory services. |
||||||
| Ransomware | Ressources Si id33220 View details | France | — | pending | ||
|
Ressources Si is a company that operates in the Movie Theaters industry. It employs 10to19 people and has 1Mto5M of revenue. |
||||||
| Ransomware | K3G Solutions Brazil id32988 View details | Brazil | IT | pending | ||
|
K3G Solutions is a Brazilian telecom/IT consulting company based in Manaus, providing network engineering, ISP support, monitoring, call-center, CDN, and colocation services. |
||||||
| Ransomware | Universitt Hamburg id32947 View details | Germany | Education | pending | ||
|
Universität Hamburg is the largest research and educational institution in Northern Germany, with over 42,000 students. It offers a wide range of academic programs and is recognized for its excellence in research and teaching. The university serves diverse target groups including prospective students, current students, researchers, and alumni. It collaborates with various societal and economic partners to address contemporary challenges and contribute to future solutions. |
||||||
| Ransomware | Inovapy id32948 View details | Paraguay | IT | pending | ||
|
INOVAPY is a technology company specializing in software development and digital transformation solutions for small and medium-sized businesses, offering reliable and scalable technological services across Latin America and beyond. |
||||||
| Ransomware | Stim id32949 View details | France | Healthcare / Pharma | leaked | ||
|
Stim France specializes in video surveillance solutions within the security industry. The company offers a range of video recorders, video receivers, storage expansion, and integration services for surveillance cameras, as well as software for video surveillance management. |
||||||
| Ransomware | Nielsen Design id32895 View details | — | Services | pending | ||
|
Helmar Nielsen dreamed of a frame that was accessible, precise, and above all, industrially reproducible, without sacrificing elegance. This was the birth of a concept that, a few years later, would forever change the perception of framing. |
||||||
| Ransomware | Honda (Peru) id32826 View details | Peru | Manufacturing / Engineering | pending | ||
|
Honda is a global automotive and motorcycle manufacturer founded in 1948 by Soichiro Honda and Takeo Fujisawa. The company offers a wide range of products including automobiles, motorcycles, and power products, catering to clients across various regions including Japan, North America, Europe, and Asia. Honda is committed to social responsibility and environmental conservation, reflecting its philosophy of coexistence with the products it creates. The company's leadership and innovative spirit have been key to its success and expansion in the global market. |
||||||
| Ransomware | Cerámicas Kantu id32801 View details | Brazil | Manufacturing / Engineering | leaked | ||
|
Cerámicas Kantu S.A.C. is a Peruvian company specializing in the manufacturing of decorative tiles and accessories made from ceramic, porcelain, and glass. With over 40 years of experience in the ceramic industry and more than 15 years in producing construction finishes, they offer high-quality products with innovative designs. Their intended clients include distributors and individuals looking to enhance their spaces with unique decorative elements. The company emphasizes customer service and provides assistance through their sales advisors. |
||||||
| Ransomware | Konica Minolta Bulgaria id32755 View details | Bulgaria | Manufacturing / Engineering | leaked | ||
|
Konica Minolta Bulgaria is a company with its own sales, marketing, and technical structure, and is part of the global brand specializing in innovative business and IT solutions. The company established its presence in Bulgaria in 2005 and has experienced continuous growth ever since. |
||||||
| Ransomware | Agencia Estatal de Meteorología id32753 View details | Spain | Public Sector | leaked | ||
|
Agencia Estatal de Meteorología - AEMET is a governmental agency of Spain that provides comprehensive meteorological services, including weather observation, predictions, and climate analytics. It serves various sectors such as agriculture, aviation, maritime activities, and emergency services. AEMET aims to support public safety and management through accurate weather forecasts, climate data, and educational resources. The agency also engages in research and international collaboration to enhance meteorological science and technology. |
||||||
| Ransomware | Aqualogus id32721 View details | — | null | pending | ||
|
Aqualogus is a private engineering consulting firm that helps communities and businesses solve water-related challenges. They work closely with clients to design smart solutions for hydraulic projects, water resources management, and environmental protection. With years of hands-on experience, their team of skilled engineers creates practical plans that make a real difference in how water systems work and how we care for our environment. |
||||||
| Ransomware | Financière d'Uzès id32687 View details | France | Finance / Legal / Insurance | pending | ||
|
Financière d'Uzès offers a range of financial services tailored for individuals, entrepreneurs, and professionals, focusing on wealth management, investment strategies, and fiscal optimization. Their services include asset management, financial analysis, and dedicated funds, catering to clients looking to enhance their income, organize their assets, and manage their taxes. With over 35 years of experience and a commitment to independence, they have supported 2000 families and manage 1.5 billion euros in assets. The company operates six offices across France, providing personalized service through a single point of contact. |
||||||
| Ransomware | KHALED ALFAGIH ENGINEERING CONSULTANCY id32615 View details | Saudi Arabia | Manufacturing / Engineering | leaked | ||
|
Khaled Alfagih Engineering Consultancy Company is one of the most specialized engineering consultancy firms in healthcare design and planning in KSA with more than 25 years of experience. KFO providing the quality in the field of architecture and engineering design, execution supervision and projects management. KFO focused on teamwork, client relationship and knowledge transfer. |
||||||
| Ransomware | Edacentrum id32613 View details | Germany | IT | pending | ||
|
The edacentrum is the network for electronics, design and applications in business and science. As an independent authority, the edacentrum designs research & development for a consistent design methodology along the entire value chain. In this role, the edacentrum is a recognized innovation accelerator for the microelectronics industry and its user industries |
||||||
| Ransomware | Hochschule Heilbronn Bildungscampus id32562 View details | Germany | Education | pending | ||
|
AStA Hochschule Heilbronn is the general students' committee that represents student interests both within and outside the university in Heilbronn. The organization serves as a spokesperson for the student body and provides a variety of support services, including legal and tax counseling, a grievance box, and laptop rentals. Additionally, the committee organizes numerous events and manages the university sports program. It operates as a central point of contact for students facing problems and coordinates with various student parliaments and faculty representatives. |
||||||
| Ransomware | Dinas Komunikasi dan Informatika id32447 View details | Indonesia | Telecommunications | pending | ||
|
The Central Java Province Communication and Informatics Service was formed based on Central Java Provincial Regulation Number 9 of 2016 concerning the Formation and Composition of Central Java Province Regional Apparatuses and Central Java Governor Regulation Number 70 of 2016 concerning the Organization and Work Procedure of the Central Java Province Communication and Informatics Office. As for the duties of the Central Java Province Communication and Informatics Office, it is to assist the Governor in carrying out government affairs in the communications and informatics sector, the coding sector, and the statistics sector which are the authority of the Regions and the assistance tasks assigned to the Regions. |
||||||
| Ransomware | Directorate-General for Education id32226 View details | Portugal | Education | pending | ||
|
The Direção-Geral de Estatísticas da Educação e Ciência (DGEEC) is a Portuguese government agency responsible for collecting, analyzing, and publishing official statistics on education, science, and technology. |
||||||
| Ransomware | Government of Vojvodina id32077 View details | Serbia | Public Sector | pending | ||
|
The Provincial Government of Vojvodina is focused on enhancing economic and academic cooperation within the region and internationally. SENVIBE project is to improve and build national educational capacities, cooperation and competences in dealing with environmental and occupational noise and vibration (No&Vib) engineering issues in accordance with ongoing EU integration strategies and the needs identified in Serbia. |
||||||
| Ransomware | Senvibe id32066 View details | United States | IT | pending | ||
|
SENVIBE project is to improve and build national educational capacities, cooperation and competences in dealing with environmental and occupational noise and vibration (No&Vib) engineering issues in accordance with ongoing EU integration strategies and the needs identified in Serbia. |
||||||
| Ransomware | Nteitalia id31961 View details | Italy | — | pending | ||
|
NTE Italia, an engineering and telecommunications service provider based in Catanzaro, Italy. Sensitive thousands of documents are compromised. |
||||||
| Ransomware | Frisian Flag Indonesia id31838 View details | Indonesia | — | pending | ||
|
Frisian Flag Indonesia specializes in high-quality dairy products, including sweetened condensed milk, UHT milk, powdered milk for families, and cheese. The company aims to provide nutritious options that support the health and well-being of families, offering products enriched with vitamins and minerals. Their target clients include families, pregnant women, and children, focusing on delivering nutritional benefits through their diverse product range. Established in 1871, Frisian Flag is committed to building strong families by promoting healthy dietary habits. |
||||||
| Ransomware | DL E&C id31796 View details | Korea, Republic of | — | deleted | ||
|
DL E&C Co., Ltd. is a major South Korean construction and engineering company, founded in 1939, specializing in building, infrastructure, housing, and industrial/energy plant projects worldwide. |
||||||
| Ransomware | Castilla La Mancha id31788 View details | Spain | — | pending | ||
|
The Government of Castilla-La Mancha provides a wide range of services and information related to public administration, economy, education, health, and social services. It aims to support various sectors including agriculture, tourism, and employment, while also addressing issues like sustainability and equality. The intended clients include residents of Castilla-La Mancha, businesses, and individuals seeking assistance in various life situations. The government also promotes transparency and participation through its digital platforms. |
||||||
| Ransomware | Doimo Cucine id31787 View details | Italy | — | pending | ||
|
Doimo Cucine specializes in modern, customizable designer kitchens that blend beauty and harmony. The company emphasizes a holistic approach to kitchen design, offering a versatile system called All-arounD for creating personalized spaces. With a commitment to quality and innovation, all production is carried out in Italy, ensuring high standards and craftsmanship. Their target clients are those seeking stylish and functional kitchen solutions that nourish the soul. |
||||||
| Ransomware | SAGASTA sro id31776 View details | Czechia | Other | pending | ||
|
SAGASTA is a design and engineering company specializing in modern construction, offering comprehensive design, engineering, and consulting services in the fields of railway, road, bridge, and water management construction. |
||||||
| Ransomware | Infosat id31751 View details | — | Telecommunications | pending | ||
|
A company focused on new technologies serving information, communications and security systems.It was created at the dawn of the third millennium, with the primary mission of serving its clients and committing to its partners for overall and sustainable performance. |
||||||
| Ransomware | Alpine Electronics Europe id31723 View details | Germany | Manufacturing / Engineering | pending | ||
|
Alpine Electronics Europe specializes in the distribution of automotive electronics and audio products. The company offers a range of products and support services tailored for various European markets. Their intended clients include automotive manufacturers and consumers seeking high-quality audio solutions. Alpine is committed to providing innovative technology and exceptional customer service across multiple countries in Europe. |
||||||
| Ransomware | Xpress Tech id31573 View details | — | IT | pending | ||
|
Xpress Tech is a leading B2B iGaming aggregation platform established in 2015 under Softquo Holding. It provides a comprehensive one-stop technical solution connecting operators with over 120 gaming providers and a portfolio of more than 30,000 games via a single Remote API integration. The platform also features integrated payment solutions and back-office data management |
||||||
| Ransomware | The Minor Food Group id31529 View details | Thailand | Hospitality / Food & Beverage / Tourism | pending | ||
|
Founded in 1980, Minor Food is the culinary pillar of Minor International (MINT) and one of the largest food and beverage companies in the Asia-Pacific region. With a footprint spanning over 2,600 outlets across 24 countries, Minor Food operates a dynamic dual-engine strategy combining globally renowned franchises—such as Burger King, Dairy Queen, Swensen's, and Bonchon—with a powerful roster of wholly-owned homegrown brands like The Pizza Company, The Coffee Club, and GAGA. Committed to delivering exceptional dining experiences, Minor Food continues to drive the industry forward through digitized kitchen ecosystems, end-to-end supply chain mastery, and consumer-centric innovation. |
||||||
| Ransomware | Siam Oil Product id31484 View details | Thailand | Energy | pending | ||
|
Siam Oil Product Co., Ltd. is a Thailand-based petroleum and industrial-products distributor, operating for 20+ years with registered capital of THB 200 million and 700+ employees; it supplies fuel oil, diesel, asphalt, base oils, automotive/industrial lubricants, petrochemicals such as HDPE/LDPE/LLDPE, plastic additives, and industrial products, and also operates a coffee-shop franchise business. Its headquarters is at RS Tower, Ratchadaphisek Road, Din Daeng, Bangkok, Thailand. |
||||||
| Ransomware | Daily Trust id31483 View details | Nigeria | Communication / Marketing | pending | ||
|
Daily Trust is a Nigerian news organization that provides breaking news, investigative stories, and various features across multiple sectors including business, politics, sports, and entertainment. The company offers content through print, online platforms, and media outlets like Trust TV and Trust Radio. Its services cater primarily to the Nigerian public, with a focus on providing comprehensive coverage of local and international news. Daily Trust aims to inform and engage its audience through a diverse range of storytelling and analysis. |
||||||
| Ransomware | Surakarta University id31348 View details | Indonesia | Education | pending | ||
|
Universitas Surakarta (UNSA) is a technology-based university committed to excellence in education, business, and entrepreneurship, responsive to industry and community needs. It offers a range of programs including undergraduate, professional conversion, and postgraduate studies, aimed at developing competent and character-driven graduates. UNSA provides a flexible and collaborative learning environment, supported by experienced faculty and modern infrastructure. The university invites prospective students, partners, and the community to join in building a brighter and more meaningful future together. |
||||||
| Ransomware | Festina Group id31349 View details | Switzerland | Manufacturing / Engineering | pending | ||
|
Festina Group is a major watch and jewelry company that owns six different brands: Festina, Lotus, Lotus Style, Calypso, Candino, and Jaguar. They blend Swiss watchmaking traditions with modern design, creating timepieces that mix classic craftsmanship with contemporary style. Each brand offers something unique, from sporty watches to elegant jewelry, giving customers plenty of choices for different tastes and occasions. |
||||||