Galago Ransomware Emerges with Alleged Ties to Panzer Group A newly identified ransomware operation, Galago, has surfaced with claims of collaboration with the Panzer ransomware group, though evidence remains circumstantial. Researchers first detected Galago on 9 September 2026 following an open-source alert alleging an attack on an Icelandic healthcare organization, Inter ehf, with a reported theft of 105 GB of data. The group’s dark leak site (DLS), monitored from 15 September, was inactive at the time of observation, with no confirmed victims listed. Galago’s Tor leak-site address (pnzr4delgur5dlhtqcy7qqm6m7dkivxwh742enezpks5kswfpx7qrsid[.]onion) shares a pnzr prefix with Panzer’s (pnzruro7syvwvefx5mpo2fhzi4jftgquynsqf3vy5x3no57yp2iz4nyd[.]onion), suggesting a potential naming link. However, this alone does not confirm shared operators, malware, or infrastructure. Galago’s self-reported partnership with Panzer remains unverified, and no independent evidence supports the alleged Icelandic breach. Panzer, in contrast, has a more established track record, with 32 victims published between 5 August and 23 September 2026. Described as a ransomware-as-a-service (RaaS) operation, Panzer recruits affiliates and employs double extortion, encrypting files while exfiltrating data. Its advertised capabilities include builds for Windows, Linux, ESXi, and FreeBSD, though these should not be attributed to Galago without further proof. The 9 September report claiming Galago’s compromise of Inter ehf included a threat to publish stolen data by 28–29 September, but this remains unsubstantiated. Neither Galago’s leak site nor independent verification has confirmed the breach. Defenders are advised to monitor the provided Tox contact ID (8C3D96497A7A9438794F705C055FC2FD3059F6CF11FF51060EE55ED7F0679CFC7218825BD56CB1) and Tor addresses for further activity, though these identifiers alone do not prove network compromise. As of now, Galago’s operational status and its alleged connection to Panzer remain unconfirmed, with no independently verified malware samples or attack infrastructure linked to either group.

Panzer Ransomware Emerges as New RaaS Threat, Targeting 16 Victims Across 11 Countries A newly identified Ransomware-as-a-Service (RaaS) operation, Panzer ransomware, has surfaced, claiming 16 victims across 11 countries since its leak site became active on August 5, 2026. Documented by CyberXtron, the group employs a double-extortion model, combining data theft with file encryption to pressure victims into paying ransoms. ### Victim Distribution & Targeted Sectors Panzer’s attacks span technology, manufacturing, government, agriculture, energy, education, and retail, with technology (4 victims) and manufacturing (3 victims) being the most affected sectors. The group’s geographic reach includes: - Thailand (3 victims) - Italy, Indonesia, Serbia (2 victims each) - Curaçao, South Korea, Spain, Czech Republic, Germany, Nigeria, Switzerland (1 victim each) The broad targeting suggests an opportunistic approach rather than a focused campaign on specific industries or regions. ### Operational Model & Affiliate Program Panzer operates a semi-open affiliate program, recruiting partners via a Tox-based application process with a screening requirement before granting dashboard access. The group offers an 80/20 revenue split, with affiliates keeping 80% of ransom payments while Panzer takes a 20% platform fee. Key features of the operation include: - Cross-platform ransomware builds (Windows, Linux, VMware ESXi, FreeBSD), increasing risk to enterprise environments, particularly those with mixed server fleets and virtualized infrastructure. - ESXi hypervisor targeting, which could encrypt multiple virtual machines and critical business services in a single attack. - Affiliate dashboard with tools for balance tracking, build management, support tickets, team sub-accounts, and leak-publication workflows (requiring approval before posting victim data). - Monitoring of new affiliates for the first month to detect researcher or law enforcement activity, with inactive accounts deactivated after one week to ensure only active operators remain. ### Attack Techniques & Security Implications While no verified initial-access method has been confirmed, associated activities (assessed with medium-to-low confidence) include: - OS credential dumping - Brute-force attacks - Network service discovery - Use of valid accounts - Remote service lateral movement - Attempts to impair security tools Panzer follows a double-extortion model, exfiltrating sensitive data before encryption and using leak site countdowns to pressure victims. However, no confirmed malware hashes, IP addresses, domains, or samples have been publicly disclosed.