Reported by 2 outlets
Galago Ransomware Operation Emerges With Links to Panzer Extortion Group
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 0.80 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.59 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Analysis
A new ransomware operation tracked as Galago has emerged with apparent links to the Panzer extortion group. Researchers began monitoring Galago's dark leak site on 15 September 2026 and found it inactive with no listed victims. The shared pnzr prefix in Tor addresses (Galago: pnzr4del, Panzer: pnzruro) supports a naming link but is not independent proof of shared operators, malware, or access. Panzer has a documented record: 32 victims between 5 August and 23 September 2026, described as a ransomware-as-a-service operation recruiting affiliates for double extortion, with advertised builds for Windows, Linux, ESXi, and FreeBSD. Galago's self-claimed operational partnership with Panzer remains unverified by independent intrusion evidence. Watch for Galago victims appearing on its leak site or corroboration of shared infrastructure.
Timeline
-
original reporting
Galago Ransomware Operation Emerges With Links to Panzer Extortion Group
gbhackers.com · 19d ago · September 24th, 2026
A newly identified ransomware operation tracked as Galago has emerged with apparent operational links to the Panzer ransomware group, raising concerns of an expanding double-extortion ecosystem targeting organizations worldwide. Researchers began directly monitoring Galago’s dark leak site (DLS) on 15 September 2026. At the time of observation, the group’s Tor-based leak portal was inactive and […] The post New Galago Ransomware Operation Emerges With Links to Panzer Extortion Group appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from cyberpress.org
Galago Ransomware Emerges With Shared Infrastructure Ties to Panzer
cyberpress.org · 19d ago · September 24th, 2026
A shared prefix in their Tor leak-site addresses supports a naming link, but does not by itself prove shared operators, malware, or access to the same systems. Researchers first flagged Galago on 9 September 2026 after an open-source alert alleged an attack on an Icelandic healthcare organization. As of the reported observation, Galago has not publicly substantiated an intrusion through its own leak site. Galago’s site description claims an operational partnership with Panzer. Its reported Tor address begins pnzr4del , while Panzer’s begins pnzruro . The shared pnzr prefix is consistent with a relationship, but a naming pattern and a self-reported claim are not independent proof of operational control. Galago Ransomware Linked to Panzer Panzer has a more visible record. Researchers tracking the groups report that Panzer published 32 victims between 5 August and 23 September 2026. An earlier CyberXTron profile described Panzer as a ransomware-as-a-service operation that recruits affiliates and uses double extortion, stealing data as well as encrypting files. Galago Ransomware Linked to Panzer (Source: cyberxtron) That profile also described advertised builds for Windows, Linux, ESXi, and FreeBSD. Those Panzer capabilities should not be attributed to Galago without evidence of shar