PANZER Ransomware Gang: 2 New Victims Posted — Energy & Media Targeting Analysis, Detection Rules & IR Playbook

Security Arsenal's dark web collection infrastructure has confirmed 2 new victim postings on the PANZER ransomware gang's .onion leak site within a 48-hour window (2026-08-08 through 2026-08-09). The campaign shows a deliberate cross-regional spread: Siam Oil Product (Energy & Utilities, Thailand) and Daily Trust (media, Nigeria). While the victim count is modest, the sector selection — critical energy infrastructure paired with a national media outlet — is consistent with PANZER's established pattern of targeting high-leverage organizations where operational disruption pressure maximizes ransom payment probability.

Of particular concern: multiple CVEs added to the CISA Known Exploited Vulnerabilities catalog in recent months — notably CVE-2026-50751 (Check Point Security Gateway improper authentication) and CVE-2026-20131 (Cisco FMC deserialization) — align directly with PANZER's documented initial access tradecraft of edge/VPN appliance exploitation. Organizations running unpatched Check Point, Cisco FMC, ConnectWise ScreenConnect, or Microsoft Exchange instances should treat themselves as actively targeted.

Threat Actor Profile — PANZER

Current Campaign Analysis

Sector Targeting

• Energy & Utilities — Siam Oil Product (TH). Fuel distribution and downstream energy firms are high-pressure targets: operational downtime directly impacts regional supply chains, and OT adjacency amplifies board-level urgency to pay.
• Media / Other — Daily Trust (NG). Media organizations are targeted for dual impact: operational disruption plus the reputational leverage of leaking internal communications and source data.

Geographic Concentration

Southeast Asia (Thailand) and West Africa (Nigeria). This pairing suggests PANZER affiliates are scanning globally for vulnerable edge appliances rather than regionally focusing — victims emerge wherever an unpatched Check Point or Cisco FMC instance sits behind a soft identity perimeter. Emerging-market enterprises with weaker patch cadence and limited SOC coverage are bearing the brunt.

Victim Profile

Mid-to-large enterprises. Siam Oil Product operates in Thailand's downstream petroleum sector (estimated revenue in the hundreds of millions USD); Daily Trust is one of Nigeria's largest-circulation media groups. PANZER deliberately selects organizations large enough to pay seven-figure demands but typically below the threshold of mature, 24x7 security operations.

Posting Frequency & Escalation

2 postings in the last 100 leak site entries, clustered within 24 hours of each other. Clustered posting of this kind typically indicates a batch of intrusions executed in the same wave — meaning additional victims from the same exploitation round are likely already compromised and not yet posted. Expect 2–4 further postings from this wave over the next 7–14 days as negotiations fail.

CVE Initial Access Correlation

The following actively exploited CVEs map to PANZER's known access vectors:

Analytic judgment (moderate confidence): The Siam Oil Product intrusion most plausibly originated via Check Point gateway exploitation (CVE-2026-50751), given the gang's historical preference for VPN appliances at industrial/energy victims where remote access concentration is high.

Detection Engineering

The following Sigma rules target PANZER's documented TTPs: VPN/edge exploitation follow-on behavior, shadow copy deletion, RMM-based staging, and pre-encryption exfiltration staging.

---
title: PANZER Ransomware - Volume Shadow Copy Deletion Pre-Encryption
id: 7a3f1c92-panz-4001-8001-000000000001
status: production
description: Detects vssadmin, wmic, or bcdedit execution consistent with PANZER's pre-encryption shadow copy deletion and boot recovery tampering.
author: Security Arsenal Threat Intelligence
date: 2026/08/09
references:
  - https://securityarsenal.com/darkside
logsource:
  category: process_creation
  product: windows
  level: high
detection:
  selection_img:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
      - '\bcdedit.exe'
      - '\diskshadow.exe'
  selection_cmd:
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
      - 'delete Shadows'
      - 'recoveryenabled no'
      - 'bootstatuspolicy ignoreallfailures'
      - 'resize shadowstorage'
  condition: selection_img and selection_cmd
falsepositives:
  - Legitimate backup administration (rare on endpoints; correlate with change windows)
  - System administrators resizing shadow storage
---
title: PANZER Ransomware - Suspicious RMM Execution and Data Staging
id: 7a3f1c92-panz-4002-8002-000000000002
status: production
description: Detects execution of remote access tooling and archive utilities commonly abused by PANZER affiliates for staging and exfiltration prior to encryption, including ScreenConnect-style RMM and rclone/7z staging.
author: Security Arsenal Threat Intelligence
date: 2026/08/09
logsource:
  category: process_creation
  product: windows
  level: high
detection:
  selection_rmm:
    Image|endswith:
      - '\ScreenConnect.ClientService.exe'
      - '\rclone.exe'
      - '\psexec.exe'
      - '\psexesvc.exe'
  selection_args:
    CommandLine|contains:
      - ' copy '
      - ' sync '
      - '--transfers'
      - '\\'
      - 'accept eula'
  selection_archive:
    Image|endswith:
      - '\7z.exe'
      - '\rar.exe'
      - '\winrar.exe'
    CommandLine|contains:
      - ' a '
      - '-p'
      - '.7z'
      - '.rar'
  condition: (selection_rmm and selection_args) or selection_archive
falsepositives:
  - Legitimate IT remote administration — baseline approved RMM paths and alert on deviations
  - Scheduled backup compression jobs
---
title: PANZER Ransomware - Check Point / VPN Appliance Follow-On Authentication Anomaly
id: 7a3f1c92-panz-4003-8003-000000000003
status: experimental
description: Detects VPN authentication from unusual source geographies or service accounts shortly followed by privileged internal logons — consistent with PANZER edge-appliance exploitation (CVE-2026-50751) pivoting to internal access.
author: Security Arsenal Threat Intelligence
date: 2026/08/09
logsource:
  category: authentication
  product: windows
  level: critical
detection:
  selection_logon:
    EventID:
      - 4624
    LogonType:
      - 3
      - 10
  selection_suspicious:
    IpAddress|contains:
      - '185.'
      - '193.'
      - '45.'
      - '91.'
  filter_known_vpn_ranges:
    IpAddress|startswith:
      - '10.'
      - '192.168.'
      - '172.16.'
  condition: selection_logon and selection_suspicious and not filter_known_vpn_ranges
falsepositives:
  - Legitimate remote workforce — tune IpAddress ranges to your approved egress/VPN infrastructure
  - Partner/vendor access; maintain an allowlist of known federated IP space

The following Sentinel hunt query identifies pre-ransomware staging behavior associated with PANZER's toolset: RMM execution, mass archive creation, and admin share propagation within a compressed window.

// PANZER pre-ransomware staging hunt — 14 day window
// Looks for: RMM/tool execution + archive staging + admin$ propagation on the same host
let Lookback = 14d;
let SuspiciousTools = dynamic(["rclone.exe", "psexec.exe", "psexesvc.exe", "ScreenConnect.ClientService.exe", "7z.exe", "rar.exe", "vssadmin.exe", "wmic.exe", "bcdedit.exe"]);
let ToolExec = DeviceProcessEvents
| where Timestamp > ago(Lookback)
| where FileName in~ (SuspiciousTools)
| project DeviceName, ToolTime=Timestamp, FileName, ProcessCommandLine, InitiatingProcessAccountName;
let AdminShareAccess = DeviceNetworkEvents
| where Timestamp > ago(Lookback)
| where RemotePort == 445
| summarize ShareConnections=count(), SourceIPs=make_set(RemoteIP) by DeviceName;
let NewTasks = DeviceEvents
| where Timestamp > ago(Lookback)
| where ActionType == "ScheduledTaskCreated" or AdditionalFields has "TaskName"
| project DeviceName, TaskTime=Timestamp, AdditionalFields;
ToolExec
| join kind=inner AdminShareAccess on DeviceName
| join kind=leftouter NewTasks on DeviceName
| summarize ToolExecutions=make_set(FileName), Commands=make_set(ProcessCommandLine), FirstSeen=min(ToolTime), LastSeen=max(ToolTime), ShareConnections=max(ShareConnections), Accounts=make_set(InitiatingProcessAccountName) by DeviceName
| where array_length(ToolExecutions) >= 2
| order by FirstSeen desc;

The following PowerShell script is a rapid-response sweep for the three highest-signal PANZER pre-detonation artifacts: shadow copy tampering, recently created scheduled tasks (persistence), and suspicious listening RDP exposure.

# Security Arsenal - PANZER Rapid Response Sweep
# Run as Administrator on suspected hosts or via your EDR remote shell
# Checks: VSS tampering, scheduled tasks (last 7 days), RDP exposure, recent RMM artifacts

Write-Host "=== PANZER Rapid Response Sweep === $(Get-Date)" -ForegroundColor Cyan

# 1. Volume Shadow Copy status
Write-Host "`n[1] Volume Shadow Copies" -ForegroundColor Yellow
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
if (-not $shadows) { Write-Host "  [!] NO shadow copies present - possible pre-encryption deletion" -ForegroundColor Red }
else { $shadows | Select-Object DeviceObject, InstallDate | Format-Table }

# 2. Scheduled tasks created in last 7 days
Write-Host "`n[2] Scheduled Tasks Created/Modified (Last 7 Days)" -ForegroundColor Yellow
Get-ScheduledTask | Where-Object {
    $_.Date -and ([datetime]$_.Date) -gt (Get-Date).AddDays(-7)
} | Select-Object TaskName, TaskPath, Date, @{N='Author';E={$_.Author}} | Format-Table -AutoSize

# 3. RDP exposure check
Write-Host "`n[3] RDP Exposure" -ForegroundColor Yellow
$rdpEnabled = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server').fDenyTSConnections -eq 0
$nla = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -ErrorAction SilentlyContinue).UserAuthentication
if ($rdpEnabled) {
    Write-Host "  [!] RDP ENABLED. NLA Required: $($nla -eq 1)" -ForegroundColor Red
    Get-NetTCPConnection -LocalPort 3389 -State Listen -ErrorAction SilentlyContinue | Format-Table LocalAddress, LocalPort, State
} else { Write-Host "  [OK] RDP disabled" -ForegroundColor Green }

# 4. Recent suspicious binary drops in staging locations
Write-Host "`n[4] Suspicious Artifacts in Staging Directories (Last 7 Days)" -ForegroundColor Yellow
$paths = @("$env:TEMP", "C:\ProgramData", "C:\Users\Public", "$env:APPDATA")
$patterns = @('rclone*', 'psexec*', '*screenconnect*', '7z.exe', 'rar.exe', '*.7z', '*.rar')
foreach ($p in $paths) {
    foreach ($pat in $patterns) {
        Get-ChildItem -Path $p -Filter $pat -Recurse -ErrorAction SilentlyContinue |
            Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-7) } |
            Select-Object FullName, LastWriteTime, Length
    }
}

# 5. Recent logon failures (brute force indicator)
Write-Host "`n[5] Failed Logon Events 4625 (Last 24h, Top Source Accounts)" -ForegroundColor Yellow
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddDays(-1)} -ErrorAction SilentlyContinue |
    Group-Object { $_.Properties[13].Value } | Sort-Object Count -Descending |
    Select-Object -First 10 Count, Name | Format-Table

Write-Host "`n=== Sweep Complete ===" -ForegroundColor Cyan

Incident Response Priorities

T-Minus Detection Checklist (Pre-Encryption Window)

PANZER's 48–72 hour staging window before detonation is your last opportunity to interdict. Alert immediately on:

• vssadmin delete shadows or bcdedit recoveryenabled no execution on any server
• New scheduled tasks created by non-admin service accounts, especially with encoded PowerShell payloads
• Rclone, MEGA, or anonymous file-transfer process execution on servers (not workstations)
• Large 7z/RAR archives appearing in C:\ProgramData, C:\Users\Public, or staging directories
• VPN appliance logins from IP ranges outside approved egress space, followed by internal SMB/RDP connections within hours
• EDR/AV tampering events — service stop attempts on Sentinel, Defender, CrowdStrike agents
• Unusual LDAP/AD enumeration (BloodHound-style queries, net group "Domain Admins" /domain from unexpected hosts)

Critical Assets PANZER Prioritizes for Exfiltration

1. Finance/ERP exports and payroll databases (maximum embarrassment + identity data value)
2. Executive mailbox archives (negotiation leverage and internal comms leakage)
3. Legal/contracts repositories — for energy victims: supply agreements, offtake contracts, regulatory filings
4. Engineering/operational data — SCADA-adjacent documentation, network diagrams, OT asset inventories (for energy victims, this raises the stakes beyond data loss)
5. HR records and customer PII for regulatory pressure (PDPA in Thailand, NDPR in Nigeria)

Containment Actions — Ordered by Urgency

1. Isolate the suspected staging host at the network layer (EDR network isolation) — do NOT power off; preserve memory for forensics
2. Disable the compromised identity chain — reset credentials for any account observed in staging activity; revoke active VPN/SSO sessions globally
3. Block egress for exfil tooling — emergency deny rules for rclone/MEGA/megasync endpoints and unclassified cloud storage at the proxy/firewall
4. Snapshot and verify backups — confirm backup infrastructure is segmented and immutable BEFORE attackers detonate; PANZER affiliates actively hunt backup consoles
5. Sweep for persistence fleet-wide — push the scheduled-task and staging-directory checks above to all servers via GPO/EDR within 4 hours
6. Assume edge appliance compromise — if Check Point/Cisco FMC is in scope, pull VPN auth logs immediately and review all authenticated sessions for the past 30 days

Hardening Recommendations

Immediate (24 Hours)

• Patch or mitigate CVE-2026-50751 (Check Point) and CVE-2026-20131 (Cisco FMC) — these are confirmed ransomware-exploited; if patching is impossible within 24h, restrict management plane access to a dedicated jump host VLAN and disable IKEv1 where feasible
• Enforce MFA on all VPN/remote access — PANZER's edge exploitation yields far less when post-exploitation credential use hits MFA on internal resources
• Block macro execution from Office documents originating outside the organization (Mark-of-the-Web enforcement via Group Policy)
• Deploy application control rules blocking rclone.exe, unsigned archive utilities, and unauthorized RMM binaries on servers
• Alert on shadow copy deletion — the Sigma rule above should be live in your SIEM today; this is the single highest-fidelity pre-detonation signal
• Audit scheduled tasks fleet-wide using the PowerShell sweep; investigate anything created in the last 14 days by non-standard accounts

Short-Term (2 Weeks)

• Segment backup infrastructure onto an isolated network with separate credentials and immutable/object-lock storage — PANZER affiliates specifically enumerate and destroy backup consoles before detonation
• Implement egress filtering with TLS inspection on server VLANs; servers should have no direct path to consumer cloud storage or anonymous file-sharing services
• Deploy deception canaries — decoy file shares and credentials in likely staging paths provide near-zero-false-positive early warning of recon and staging
• Baseline and allowlist RMM tooling — any remote access binary outside the approved list (ScreenConnect, AnyDesk, TeamViewer variants are the top-abused set) should generate a critical alert
• Review edge appliance logging pipeline — VPN and firewall auth logs must flow to your SIEM in near-real-time; PANZER's dwell window is short enough that weekly log review is operationally useless
• Tabletop the energy-sector scenario — if you operate in energy/utilities, rehearse OT-adjacent ransomware response; PANZER's targeting of this vertical in this wave is not coincidental

Assessment

PANZER's current wave is low-volume but high-leverage: energy infrastructure in Southeast Asia and national media in West Africa within 24 hours signals a mature affiliate pipeline exploiting freshly weaponized edge-device CVEs at global scale. The clustering pattern indicates more victims from this exploitation round are pending publication. Enterprises running Check Point gateways, Cisco FMC, ConnectWise ScreenConnect, or on-premises Exchange should operate under the assumption that they are being scanned and probed right now, and should prioritize the pre-detonation detection content in this briefing over post-incident controls.

Security Arsenal will continue monitoring PANZER's leak site infrastructure and will publish updates as additional victims are posted.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub