Reported by 2 outlets
Panzer Ransomware Emerges With Windows, Linux, ESXi and FreeBSD Attack Support
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 0.80 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.57 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
Panzer Ransomware Emerges With Windows, Linux, ESXi and FreeBSD Attack Support
gbhackers.com · 35d ago · September 8th, 2026
A newly identified ransomware-as-a-service operation, Panzer, has surfaced with advertised payload support for Windows, Linux, VMware ESXi and FreeBSD, positioning it as a cross-platform threat to enterprise and virtualized environments. The group’s rapid victim posting cadence, affiliate-focused infrastructure, and double-extortion model make it a ransomware operation security teams should begin tracking despite the current absence […] The post Panzer Ransomware Emerges With Windows, Linux, ESXi and FreeBSD Attack Support appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from cyberpress.org
Panzer Ransomware Uses Double Extortion and Cross-Platform Builds to Target Enterprises
cyberpress.org · 35d ago · September 8th, 2026
Italian ransomware activity is accelerating, and a new ransomware-as-a-service (RaaS) group called Panzer has quickly entered the spotlight. Ransomfeed reported 212 claimed attacks against Italian organizations by early September 2026, already higher than the 169 claims recorded during all of 2025. Within its first month, the group claimed between 16 and 19 victims across 11 countries. Two alleged victims were Italian organizations: Treviso-based kitchen manufacturer Doimo Cucine and telecommunications engineering company NTE Italia in Catanzaro. Doimo Cucine was listed on Panzer’s leak site on August 17, with attackers claiming to have stolen 30 GB of data. NTE Italia was posted four days later, with a claimed 16 GB of sensitive documents. Neither company has publicly confirmed the incidents. Leak-site posts remain attacker claims and should not be treated as verified evidence of compromise. Panzer Ransomware Hits Enterprises Panzer stands out because of its reportedly mature affiliate platform, despite having no publicly analyzed ransomware sample. The group is believed to use a semi-open RaaS model in which affiliates apply through Tox messaging and undergo screening before gaining access. The platform reportedly gives affiliates an 80 percent share of ransom payments, while Panzer operators receive 20 percent. It also includes automated Bitcoin invoice generation, revenue tracking, vict