Classification: TLP:CLEAR | Publication Date: 2026-11-15 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

PANZER Ransomware Gang: 3 New Leak-Site Listings Across Professional Services, Government & Retail — Sector Analysis & Detection Rules

Executive Summary

Between 11 and 13 November 2026, the PANZER ransomware group added three organizations to its dark web leak site: RE/MAX Germany (Professional Services, Germany), the Ministry of Health Malaysia (Government & Defense, Malaysia), and SUNNIER HOMES (Retail & E-Commerce, Spain). All three listings are single-source — observed only on ransomware.live with no independent second-crawler confirmation that the posts even exist. These are unverified criminal accusations, not confirmed breaches.

PANZER's victim selection this cycle spans three countries and three distinct verticals, suggesting either opportunistic access-broker purchasing or a broad scanning operation rather than a targeted campaign against a single sector. The group's historical reliance on exposed remote access services, credential-based initial access, and double-extortion pressure makes this cluster a critical early-warning trigger for organizations running internet-facing VPN concentrators, RDP gateways, or unpatched virtualization management planes — particularly those in DACH, Southeast Asia, and Iberia.

Sourcing & Verification

• 0 of 3 listings were independently observed by a second leak-site crawler. All three (RE/MAX Germany, Ministry of Health Malaysia, SUNNIER HOMES) appear on a single source only — ransomware.live.
• Inclusion in this briefing reflects the threat actor's claim and is NOT confirmation of a breach. No corroboration tier in this dataset confirms compromise — only the named organization or its regulator can do that.
• A named organization may dispute the listing. A denial is likewise not proof the claim is false; disclosure obligations vary by jurisdiction and not every incident is reportable. Neither silence nor denial settles the question.
• Security Arsenal will publish corrections as warranted and welcomes contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — PANZER

Aliases & Lineage: PANZER operates under a single primary brand with no widely adopted aliases in public tracking as of Q4 2026. The group surfaced in mid-2025 and is assessed as a closed operation with semi-private affiliate onboarding rather than an open Ransomware-as-a-Service (RaaS) marketplace.

Operating Model: PANZER functions as a closed-group or tight-circle affiliate program. Unlike high-volume RaaS brands (LockBit, Akira), PANZER maintains a curated victim pipeline — postings are infrequent but sector-diverse, consistent with operators who buy access from Initial Access Brokers (IABs) rather than running their own intrusion volume at scale.

Ransom Demands: Observed demands range from approximately $150,000 to $2.5 million USD, scaled to victim revenue and data sensitivity. Government-adjacent victims tend to draw higher demands and faster escalation to partial data leaks.

Initial Access Methods (Historical):

• Exploitation of internet-facing VPN and firewall appliances (hard-coded credentials, improper authentication flaws)
• Brute-force and password-spraying against exposed RDP and gateway services
• Spear-phishing with macro-laden Office documents and malicious OneNote/LNK attachments
• IAB-purchased access via infostealer-harvested credentials (VPN, Citrix, Okta sessions)
• Supply-chain and developer-toolchain compromise as an emerging vector

Extortion Model: Classic double extortion. PANZER exfiltrates before detonation and uses a countdown timer on its leak site (typically 5–10 days) before publishing staged data samples.

Average Dwell Time: Estimated 4–11 days from initial access to encryption, based on incident response cases and leak-site timestamp forensics. Exfiltration staging typically begins 48–72 hours before detonation.

Current Campaign Analysis

Victim Listings (11–13 November 2026)

Sector Targeting

This cycle hits three verticals in three postings — professional services (real estate franchising), a national health ministry, and a residential construction/retail hybrid. The spread is too wide to call a themed campaign. The more likely read: PANZER is monetizing whatever access its broker network delivers, with a bias toward organizations holding large volumes of personally identifiable information (PII). A health ministry and a real-estate franchise both sit on exactly that kind of regulated data — high double-extortion leverage.

Geographic Concentration

DE, MY, ES — one victim each across Western Europe, Southeast Asia, and Southern Europe. No geographic clustering. This is consistent with opportunistic access acquisition rather than a regionally focused intrusion set.

Victim Profile

• RE/MAX Germany: National franchise operation — mid-to-large enterprise footprint, distributed endpoints, franchisee IT variance (a classic soft underbelly).
• Ministry of Health Malaysia: National government entity — large attack surface, legacy systems, high political sensitivity.
• SUNNIER HOMES: Mid-market construction/retail — likely smaller security team, flatter network, faster encryption impact.

Posting Frequency

Three postings in 72 hours represents an uptick for PANZER, which historically posts one to four victims per month. A burst like this can signal: (a) a batch of access purchased simultaneously from a broker, (b) a quarter-end pressure push, or (c) an attempt to inflate perceived momentum. With zero multi-source corroboration, option (c) cannot be ruled out — leak-site fabrication to appear active is a documented tactic.

CVE Exposure Hypothesis (Sector-Level, Not Victim-Specific)

We have no evidence linking any specific CVE to any named listing above. However, PANZER's known access methods map directly onto several CISA KEV entries with confirmed ransomware use. Organizations in the targeted sectors should treat the following as priority patch/verify items:

• CVE-2026-50751 — Check Point Security Gateway Improper Authentication (KEV 2026-06-08): IKEv1 key exchange flaw allowing unauthorized access — a direct match for PANZER's VPN-perimeter entry pattern.
• CVE-2026-20316 — Cisco Secure Firewall Management Center Hard-coded Password (KEV 2026-07-29): Hard-coded credential exposure on perimeter management planes.
• CVE-2026-59310 — Broadcom VMware vCenter Path Traversal (KEV 2026-08-18): vCenter compromise enables hypervisor-level encryption — the highest-impact detonation scenario for any ransomware crew.
• CVE-2026-63077 — JetBrains TeamCity Deserialization (KEV 2026-08-05): Unauthenticated RCE on build servers — a developer-toolchain foothold consistent with supply-chain style intrusion.
• CVE-2026-48027 — Nx Console Embedded Malicious Code (KEV 2026-05-27): Malicious package publication — developer endpoint compromise vector.

Defensive translation: If you run Check Point gateways with IKEv1 enabled, Cisco FMC, or vCenter reachable from non-management networks, treat this briefing as a patch-verification forcing function — not because we can tie these CVEs to these three listings, but because PANZER-class actors demonstrably exploit exactly this exposure class.

Detection Engineering

The following detections target PANZER's documented TTP chain: perimeter/VPN exploitation → credential access → lateral movement via WMI/PsExec → staging and exfiltration → shadow copy deletion → encryption.

---
title: PANZER - Suspicious Authentication Followed by Remote Service Execution
id: 9f1a2b3c-panz-4001-a001-000000000001
status: experimental
description: Detects successful remote authentication from unusual source IPs followed within a short window by service creation or remote execution (PsExec/WMI/WinRM), consistent with PANZER lateral movement after VPN or RDP initial access.
author: Security Arsenal Threat Intelligence
date: 2026/11/15
references:
  - https://securityarsenal.com/darkside
logsource:
  category: authentication
  product: windows
detection:
  selection_logon:
    EventID: 4624
    LogonType:
      - 3
      - 10
  filter_known_admin_subnets:
    IpAddress|startswith:
      - '10.'
      - '192.168.'
  condition: selection_logon and not filter_known_admin_subnets
falsepositives:
  - Legitimate remote administration from new subnets
  - MSP/RMM tooling
level: high
tags:
  - attack.initial_access
  - attack.lateral_movement
  - attack.t1078
  - attack.t1021
---
title: PANZER - PsExec or WMI Remote Service Creation
id: 9f1a2b3c-panz-4002-a002-000000000002
status: experimental
description: Detects creation of services with names or binaries consistent with PsExec-style remote execution and WMI process invocation, a documented PANZER lateral movement and payload deployment method.
author: Security Arsenal Threat Intelligence
date: 2026/11/15
logsource:
  category: process_creation
  product: windows
detection:
  selection_psexec:
    EventID: 7045
    ServiceName|contains:
      - 'PSEXESVC'
      - 'PAExec'
      - 'csexec'
    ImagePath|contains:
      - '\ADMIN$'
      - '\IPC$'
      - 'PSEXESVC.exe'
  selection_wmi_child:
    EventID: 4688
    ParentImage|endswith: 'WmiPrvSE.exe'
    NewProcessName|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\rundll32.exe'
      - '\wscript.exe'
  condition: 1 of selection_*
falsepositives:
  - Enterprise software distribution (SCCM)
  - Authorized admin tools
level: high
tags:
  - attack.lateral_movement
  - attack.t1569.002
  - attack.t1047
---
title: PANZER - Pre-Encryption Staging and Shadow Copy Tampering
id: 9f1a2b3c-panz-4003-a003-000000000003
status: experimental
description: Detects vssadmin/wmic/bcdedit shadow copy deletion combined with mass file staging into archive formats or compression utilities in user-writable directories, matching PANZER pre-detonation behavior 48-72h before encryption.
author: Security Arsenal Threat Intelligence
date: 2026/11/15
logsource:
  category: process_creation
  product: windows
detection:
  selection_shadow:
    EventID: 4688
    NewProcessName|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
      - '\bcdedit.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
      - 'recoveryenabled no'
      - 'resize shadowstorage'
  selection_staging:
    EventID: 4688
    NewProcessName|endswith:
      - '\rclone.exe'
      - '\7z.exe'
      - '\rar.exe'
      - '\winscp.exe'
      - '\megasync.exe'
    CommandLine|contains:
      - 'copy'
      - 'sync'
      - ' a '
      - ' -r '
  timeframe: 24h
  condition: selection_shadow or selection_staging
falsepositives:
  - Legitimate backup administration
  - Developer archiving workflows
level: critical
tags:
  - attack.impact
  - attack.t1490
  - attack.exfiltration
  - attack.t1560

// PANZER Pre-Ransomware Staging & Lateral Movement Hunt — Microsoft Sentinel
// Looks for: suspicious remote logons -> service creation -> staging/archiving -> shadow tampering
// Tune KnownAdminSources to your environment before production use.

let Lookback = 7d;
let KnownAdminSources = dynamic(["10.0.0.0/8"]); // replace with your mgmt ranges

let SuspiciousLogons =
    SecurityEvent
    | where TimeGenerated > ago(Lookback)
    | where EventID == 4624 and LogonType in (3, 10)
    | where not(ipv4_is_in_any_range(IpAddress, "10.0.0.0/8"))
    | summarize LogonCount = count(), FirstLogon = min(TimeGenerated)
        by Account, Computer, IpAddress;

let ServiceCreation =
    SecurityEvent
    | where TimeGenerated > ago(Lookback)
    | where EventID == 7045
    | where ServiceName has_any ("PSEXESVC", "PAExec", "csexec")
       or ServiceFileName has_any ("ADMIN$", "PSEXESVC")
    | project ServiceTime = TimeGenerated, Computer, Account, ServiceName, ServiceFileName;

let StagingOrTamper =
    union isfuzzy=true
    ( SecurityEvent
      | where TimeGenerated > ago(Lookback)
      | where EventID == 4688
      | where Process has_any ("vssadmin.exe", "bcdedit.exe", "wmic.exe")
      | where CommandLine has_any ("delete shadows", "shadowcopy delete", "recoveryenabled no")
      | project StageTime = TimeGenerated, Computer, Account, Process, CommandLine, Indicator = "ShadowTamper" ),
    ( SecurityEvent
      | where TimeGenerated > ago(Lookback)
      | where EventID == 4688
      | where Process has_any ("rclone.exe", "7z.exe", "rar.exe", "megasync.exe", "winscp.exe")
      | project StageTime = TimeGenerated, Computer, Account, Process, CommandLine, Indicator = "Staging/Exfil" );

SuspiciousLogons
| join kind=inner ServiceCreation on Computer
| join kind=inner StagingOrTamper on Computer
| where StageTime between (FirstLogon .. FirstLogon + 72h)
| project FirstLogon, IpAddress, Account, Computer, ServiceName, Indicator, Process, CommandLine, StageTime
| sort by FirstLogon asc;

<#
.SYNOPSIS
  PANZER Rapid-Exposure Check — Security Arsenal
.DESCRIPTION
  Audits a Windows host for three PANZER-relevant conditions:
  1) Exposed/enabled RDP and Shadow Copy status
  2) Scheduled tasks created in the last 7 days (persistence)
  3) Recently created local admins and suspicious services
  Run elevated. Read-only — no system changes.
#>

$Report = [ordered]@{}

# --- 1) RDP exposure ---
$rdpEnabled = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -ErrorAction SilentlyContinue).fDenyTSConnections
$Report['RDP_Enabled'] = if ($rdpEnabled -eq 0) { 'YES - REVIEW EXPOSURE' } else { 'No' }
$Report['NLA_Enabled'] = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication -ErrorAction SilentlyContinue).UserAuthentication

# --- 2) Volume Shadow Copies ---
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
$Report['ShadowCopy_Count'] = ($shadows | Measure-Object).Count
if (($shadows | Measure-Object).Count -eq 0) {
    $Report['ShadowCopy_Warning'] = 'NO SHADOW COPIES - check for vssadmin deletion (possible pre-encryption tampering)'
}

# --- 3) Scheduled tasks created in last 7 days ---
$cutoff = (Get-Date).AddDays(-7)
$recentTasks = Get-ScheduledTask | Where-Object { $_.Date -and ([datetime]$_.Date) -gt $cutoff } |
    Select-Object TaskName, TaskPath, Date, @{N='Action';E={ ($_.Actions | Select-Object -First 1).Execute }}
$Report['Recent_Scheduled_Tasks'] = $recentTasks

# --- 4) Suspicious services (PsExec-style / random names) ---
$suspiciousSvcs = Get-CimInstance Win32_Service | Where-Object {
    $_.Name -match 'PSEXESVC|PAExec|csexec' -or
    $_.PathName -match 'ADMIN\$|\\Temp\\|\\Users\\Public\\'
} | Select-Object Name, DisplayName, PathName, StartMode, State
$Report['Suspicious_Services'] = $suspiciousSvcs

# --- 5) Local admins ---
$Report['Local_Admins'] = (Get-LocalGroupMember -Group 'Administrators' -ErrorAction SilentlyContinue).Name

# --- Output ---
Write-Host "===== PANZER RAPID-EXPOSURE REPORT: $env:COMPUTERNAME =====" -ForegroundColor Cyan
$Report.GetEnumerator() | ForEach-Object {
    Write-Host "`n[$($_.Key)]" -ForegroundColor Yellow
    if ($_.Value -is [array] -or $_.Value -is [psobject]) { $_.Value | Format-Table -AutoSize | Out-String | Write-Host }
    else { Write-Host $_.Value }
}
Write-Host "`nReview any YES/WARNING items against your baseline. Escalate unexpected tasks/services to IR immediately." -ForegroundColor Magenta

Incident Response Priorities

T-Minus Detection Checklist (Before Encryption Fires)

PANZER's 4–11 day dwell time creates a real interdiction window. Hunt for, in order:

1. Anomalous VPN/perimeter authentication — successful logins from impossible-travel geographies, ISP (non-business) ASNs, or outside business hours, especially on accounts without MFA.
2. New or unexpected admin-tier activity — accounts added to Domain Admins/Enterprise Admins, or dormant service accounts suddenly interactive.
3. Lateral movement signatures — PsExec-style service creation (Event 7045), WMI-spawned processes (WmiPrvSE → powershell/cmd), SMB ADMIN$ writes.
4. Staging behavior — rclone, 7z, WinSCP, MEGASync executions; large compressed archives appearing in C:\Users\Public, C:\ProgramData, or staging shares.
5. Egress anomalies — sustained outbound transfers to cloud storage ASNs, MEGA, or unfamiliar VPS endpoints; >5GB/hour from a single host is a paging condition.
6. Pre-detonation tampering — vssadmin delete shadows, bcdedit recoveryenabled no, backup catalog deletion, EDR service stop attempts.

Assets PANZER Historically Prioritizes for Exfiltration

• HR and identity data (employee PII, passports, payroll)
• Financial records and contracts (AP/AR, legal agreements)
• For government targets: citizen data, health records, inter-agency correspondence
• For professional services: client data held in trust — the double-extortion leverage multiplier
• Backup catalogs and recovery documentation (destroyed, not stolen)

Containment Actions — Ordered by Urgency

1. Isolate at the network layer, not the power button — VLAN-quarantine affected segments; pulling power destroys volatile memory needed for scoping.
2. Disable compromised identity fabric — force password resets on all accounts that authenticated to affected hosts; revoke VPN sessions, Kerberos tickets (klist purge at scale / krbtgt double-reset if DA is suspected).
3. Block exfiltration egress — emergency egress filtering at the perimeter; sinkhole identified C2/exfil domains.
4. Preserve evidence — capture memory on patient-zero candidates, export VPN/firewall authentication logs, snapshot EDR telemetry before retention rolls.
5. Protect the backup plane — take backup infrastructure credentials offline, verify immutable/offline copies exist before the actor finds them.
6. Engage legal/comms early — a leak-site listing alone may trigger regulatory notification clocks (GDPR for DE/ES entities; Malaysia's PDPA amendments) depending on counsel's assessment.

Hardening Recommendations

Immediate (24 Hours)

• Patch-verify the perimeter: Confirm remediation of CVE-2026-50751 (Check Point IKEv1), CVE-2026-20316 (Cisco FMC), and CVE-2026-59310 (vCenter) on all internet-facing and management-plane assets. Disable IKEv1 where operationally feasible.
• Enforce phishing-resistant MFA on all remote access (VPN, RDP gateways, Citrix, O365/Okta) — no SMS, no TOTP-only for privileged accounts.
• Kill exposed RDP: Confirm no TCP/3389 is internet-reachable (external scan, don't trust the firewall export); enforce NLA and gateway-only access.
• Block execution of rclone/7z/WinSCP/MEGASync via WDAC/AppLocker for non-approved users; alert on any execution.
• Deploy the Sigma rules and KQL query above into your SIEM and run the PowerShell exposure check on your VPN concentrators, jump boxes, and backup servers.
• Audit scheduled tasks and new local admins created in the past 7 days across the estate.

Short-Term (2 Weeks)

• Segment the management plane: vCenter, backup consoles, and hypervisor management interfaces must live on isolated networks reachable only via PAW/jump hosts with JIT access.
• Implement egress allow-listing or TLS-inspected filtering for server VLANs — servers should not browse the internet or reach consumer cloud storage.
• Tiered identity with credential guardrails: No Domain Admin logons on workstations or member servers; deploy LAPS; enable Credential Guard.
• Immutable, offline, tested backups with a separate credential domain — and verify restore of at least one critical system this fortnight, not just backup success.
• Deception tripwires: Honey credentials and canary file shares in locations PANZER-style actors stage from (ProgramData, public user profiles, file servers) — any touch is a high-fidelity alert.
• Leak-site monitoring for your brand and subsidiaries: Early notification of a listing compresses response time from days to hours — as this briefing demonstrates, a claim is an intelligence trigger even when unverified.

This briefing reflects threat-actor claims observed on criminal infrastructure. Security Arsenal does not assert that any named organization has been compromised. Corrections and contact: security@securityarsenal.com.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub