Panzer Ransomware Targets 16 Organizations Across 11 Countries in Double-Extortion Attacks
Brief
A newly identified ransomware operation known as Panzer has allegedly listed 16 victims across 11 countries, signaling the arrival of another ransomware-as-a-service (RaaS) platform built to support affiliate-driven double-extortion campaigns.
Documented by CyberXtron, Panzer’s dedicated leak portal was first observed active on August 5, 2026. The group has since named organizations spanning technology, manufacturing, government, agriculture, energy, education, retail, and other commercial sectors.
The alleged victim list includes organizations in Thailand, Italy, Indonesia, Serbia, Curaçao, South Korea, Spain, the Czech Republic, Germany, Nigeria, and Switzerland.
Thailand accounts for three reported victims, while Italy, Indonesia, and Serbia each account for two.