PANZER Ransomware Gang: 4 Victims Posted in 5 Days — European Campaign Targeting Manufacturing, Government & Finance with Edge-Device Exploitation

Classification: TLP:AMBER — For enterprise defenders Report Date: 2026-09-12 Source: Live monitoring of PANZER .onion leak site via ransomware.live + CISA KEV correlation Confidence Level: High (direct leak site observation), Moderate (attribution of initial access vectors)

Executive Summary

Security Arsenal's dark web monitoring has confirmed 4 new victim postings on PANZER's dedicated leak site within a 5-day window (2026-09-08 through 2026-09-11). The campaign shows a deliberate geographic pivot toward European targets — Bulgaria, Spain, and France — with cross-sector victimology spanning Manufacturing, Government & Defense, Agriculture/Food Production, and Financial Services.

The velocity of postings (4 victims in 5 days, versus PANZER's historical baseline of 2–3 per month) indicates either a newly operational affiliate cohort or successful exploitation of a scalable initial access vector. Correlation with CISA's Known Exploited Vulnerabilities catalog strongly suggests PANZER operators are weaponizing edge and management-plane appliances — VMware vCenter, Cisco Secure FMC, and Check Point gateways — all of which sit at the exact network boundary this campaign is breaching.

Organizations in EMEA with exposed vCenter, Cisco FMC, or Check Point management interfaces should treat this as an active, imminent threat.

Threat Actor Profile — PANZER

Key behavioral signature: PANZER intrusions characteristically establish persistence via newly created scheduled tasks and local administrator accounts, disable Volume Shadow Copies immediately before encryption (not during initial access — a detectable pre-detonation signal), and stage data into compressed archives in C:\ProgramData or C:\Users\Public.

Current Campaign Analysis

Victimology

Sector Targeting

The sector mix is economically deliberate, not opportunistic:

• Government & Defense (AEMET): A national meteorological agency is a critical infrastructure target. Disruption of weather forecasting has downstream aviation, maritime, and civil defense impact — maximizing pressure to pay. This mirrors the broader 2025–2026 ransomware trend of targeting public-sector services with low tolerance for downtime.
• Manufacturing (Konica Minolta Bulgaria): A subsidiary/regional office of a multinational — classic "soft underbelly" entry point into a larger corporate ecosystem. Regional offices typically have weaker segmentation from parent networks.
• Financial Services (Financière d'Uzès): A French asset management firm — direct access to sensitive client financial data, high reputational stakes, strong payment incentive.
• Agriculture & Food Production (Aqualogus): Food supply chain targeting aligns with the seasonal pre-harvest pressure window in the Northern Hemisphere.

Geographic Concentration

100% European victimology in this batch (BG, ES, FR + one unconfirmed). PANZER previously showed no strong regional preference; this clustering suggests either a European-based affiliate or deliberate avoidance of U.S. targets (consistent with RaaS groups minimizing law enforcement heat from the FBI/USSS).

Victim Profile

• Size range: Mid-market to enterprise subsidiary (est. 50–5,000 employees)
• Revenue estimates: €10M–€500M annual revenue band — the ransomware "sweet spot": large enough to pay seven figures, small enough to lack mature 24/7 SOC coverage
• Common weakness profile: Edge appliances with delayed patch cycles, RDP reachable from VPN concentrators, flat internal networks

Posting Frequency / Escalation

4 victims in 5 days represents a ~4x acceleration over PANZER's baseline cadence. The two consecutive postings on 2026-09-11 (Konica Minolta Bulgaria + AEMET) suggest batch disclosure — multiple simultaneous intrusions disclosed together to maximize media pressure. Expect continued elevated tempo through September.

Initial Access Vector Correlation (CISA KEV)

The CVE cluster added to CISA KEV in the weeks preceding this campaign maps directly onto the infrastructure of the victim types observed:

Assessment (moderate confidence): PANZER affiliates are likely chaining CVE-2026-50751 (Check Point IKEv1 auth bypass) or CVE-2026-20316 (Cisco FMC hard-coded credentials) for perimeter entry, then pivoting to CVE-2026-59310 (vCenter) to achieve domain-wide blast radius before encryption. Every organization running these products unpatched should assume exposure.

Detection Engineering

The following detection content targets PANZER's documented TTPs: edge exploitation → valid account use → WMI/PsExec lateral movement → shadow copy deletion + staging → encryption.

---
title: PANZER Ransomware - Volume Shadow Copy Deletion Pre-Encryption
id: 8f3a2b1c-pnz1-4e5d-9a01-panzervss001
status: production
description: Detects deletion of Volume Shadow Copies via vssadmin, wmic, or bcdedit — a high-fidelity pre-detonation signal observed in PANZER intrusions immediately before encryption
author: Security Arsenal Threat Intelligence
logsource:
    category: process_creation
    product: windows
level: critical
detection:
    selection_vssadmin:
        Image|endswith: '\vssadmin.exe'
        CommandLine|contains:
            - 'delete shadows'
            - 'Delete Shadows'
            - '/all'
    selection_wmic:
        Image|endswith: '\wmic.exe'
        CommandLine|contains:
            - 'shadowcopy delete'
            - 'shadowcopy'
    selection_bcdedit:
        Image|endswith: '\bcdedit.exe'
        CommandLine|contains:
            - 'recoveryenabled no'
            - 'bootstatuspolicy ignoreallfailures'
    condition: 1 of selection_*
falsepositives:
    - Legitimate backup maintenance scripts (rare outside admin windows)
references:
    - https://securityarsenal.com/darkside
fields:
    - CommandLine
    - ParentImage
    - User
---
title: PANZER Ransomware - WMI or PsExec Lateral Movement from Admin Context
id: 8f3a2b1c-pnz2-4e5d-9a02-panzerlat002
status: production
description: Detects remote process execution via WMI (WmiPrvSE spawning shells) or PsExec-style service execution consistent with PANZER lateral movement using harvested admin credentials
author: Security Arsenal Threat Intelligence
logsource:
    category: process_creation
    product: windows
level: high
detection:
    selection_wmi_child:
        ParentImage|endswith: '\WmiPrvSE.exe'
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\rclone.exe'
    selection_psexec:
        - Image|endswith:
              - '\PSEXESVC.exe'
              - '\psexec.exe'
        - Image|endswith: '\services.exe'
          CommandLine|contains: 'PSEXESVC'
    condition: selection_wmi_child or selection_psexec
falsepositives:
    - Legitimate administrative tooling (SCCM, PDQ Deploy) — tune by ParentCommandLine and source host
references:
    - https://attack.mitre.org/techniques/T1047/
    - https://attack.mitre.org/techniques/T1569/002/
fields:
    - ParentImage
    - Image
    - CommandLine
    - User
---
title: PANZER Ransomware - Data Staging and Exfiltration via Rclone or Archive Creation in Public Directories
id: 8f3a2b1c-pnz3-4e5d-9a03-panzerexf003
status: production
description: Detects archive creation or rclone execution in directories favored by PANZER for pre-encryption data staging (ProgramData, Users\Public), plus mass outbound transfer indicators
author: Security Arsenal Threat Intelligence
logsource:
    category: process_creation
    product: windows
level: high
detection:
    selection_rclone:
        Image|endswith: '\rclone.exe'
        CommandLine|contains:
            - 'copy'
            - 'sync'
            - 'move'
    selection_archive_staging:
        Image|endswith:
            - '\7z.exe'
            - '\7za.exe'
            - '\rar.exe'
            - '\winrar.exe'
        CommandLine|contains:
            - 'C:\ProgramData'
            - 'C:\Users\Public'
            - '-p'  # password-protected archive flag
    condition: 1 of selection_*
falsepositives:
    - Legitimate backup or file-sync operations — baseline rclone usage per host
references:
    - https://attack.mitre.org/techniques/T1560/001/
    - https://attack.mitre.org/techniques/T1567/002/
fields:
    - Image
    - CommandLine
    - User
    - Host

// PANZER Pre-Ransomware Staging & Lateral Movement Hunt — Microsoft Sentinel
// Hunts the 72-hour window of behavior typical of PANZER intrusions:
// new admin context -> WMI/PsExec spread -> staging -> shadow copy deletion
let lookback = 7d;
let suspiciousParents = dynamic(["WmiPrvSE.exe", "PSEXESVC.exe", "services.exe"]);
let stagingDirs = dynamic(["C:\\ProgramData", "C:\\Users\\Public", "C:\\Windows\\Temp"]);
let NewAdminActivity =
    DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where InitiatingProcessAccountName !in~ ("system", "network service", "local service")
    | where ProcessCommandLine has_any ("net localgroup administrators", "net user /add", "/domain")
    | project AdminTime=TimeGenerated, DeviceName, AdminAccount=InitiatingProcessAccountName, AdminCmd=ProcessCommandLine;
let LateralMovement =
    DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where InitiatingProcessFileName in~ (suspiciousParents)
    | where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "rclone.exe", "7z.exe", "rar.exe")
    | project LatTime=TimeGenerated, DeviceName, LatParent=InitiatingProcessFileName, LatChild=FileName, LatCmd=ProcessCommandLine;
let PreDetonation =
    DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where ProcessCommandLine has_any ("delete shadows", "shadowcopy delete", "recoveryenabled no", "ignoreallfailures")
    | project VssTime=TimeGenerated, DeviceName, VssAccount=InitiatingProcessAccountName, VssCmd=ProcessCommandLine;
let Staging =
    DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where FileName in~ ("rclone.exe", "7z.exe", "7za.exe", "rar.exe")
    | where ProcessCommandLine has_any (stagingDirs)
    | project StageTime=TimeGenerated, DeviceName, StageTool=FileName, StageCmd=ProcessCommandLine;
LateralMovement
| join kind=inner PreDetonation on DeviceName
| extend HoursBetweenVssAndLateral = datetime_diff("hour", VssTime, LatTime)
| where HoursBetweenVssAndLateral between (0 .. 72)
| join kind=leftouter Staging on DeviceName
| join kind=leftouter NewAdminActivity on DeviceName
| project DeviceName, LatParent, LatChild, LatCmd, StageTool, StageCmd, VssCmd, VssAccount, LatTime, VssTime
| order by VssTime desc;

# PANZER Rapid Triage & Hardening Script — Run on suspected exposed hosts and domain controllers
# Checks: exposed RDP, new scheduled tasks (7d), shadow copy integrity, new local admins
# Requires: Run as Administrator
$ErrorActionPreference = 'SilentlyContinue'
$report = "C:\PANZER_Triage_$(Get-Date -Format 'yyyyMMdd_HHmm').txt"
"=== PANZER RAPID TRIAGE — $(Get-Date) — $env:COMPUTERNAME ===" | Out-File $report

"`n[1] RDP EXPOSURE CHECK" | Out-File $report -Append
$rdpEnabled = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server').fDenyTSConnections
"RDP Enabled (0=Yes): $rdpEnabled" | Out-File $report -Append
Get-NetTCPConnection -LocalPort 3389 -State Listen | ForEach-Object {
    "  LISTENING: $($_.LocalAddress):$($_.LocalPort) OwningPID=$($_.OwningProcess)" | Out-File $report -Append
}
Get-NetTCPConnection -LocalPort 3389 -State Established | ForEach-Object {
    "  ACTIVE RDP SESSION from: $($_.RemoteAddress)" | Out-File $report -Append
}

"`n[2] SCHEDULED TASKS CREATED IN LAST 7 DAYS (persistence check)" | Out-File $report -Append
Get-ScheduledTask | Where-Object { $_.Date -and ([datetime]$_.Date) -gt (Get-Date).AddDays(-7) } |
    ForEach-Object { "  TASK: $($_.TaskName) | Created: $($_.Date) | Path: $($_.TaskPath)" | Out-File $report -Append }

"`n[3] VOLUME SHADOW COPY INTEGRITY" | Out-File $report -Append
$vss = vssadmin list shadows 2>&1
if ($vss -match "No items found") { "  *** ALERT: NO SHADOW COPIES — possible pre-encryption tampering ***" | Out-File $report -Append }
else { "  Shadow copies present: $(($vss | Select-String 'Shadow Copy ID').Count)" | Out-File $report -Append }
$recovery = bcdedit 2>&1 | Select-String "recoveryenabled"
"  BCD recovery setting: $recovery" | Out-File $report -Append

"`n[4] NEW LOCAL ADMINISTRATORS (valid-account abuse check)" | Out-File $report -Append
Get-LocalGroupMember -Group "Administrators" | ForEach-Object {
    "  ADMIN: $($_.Name) ($($_.ObjectClass))" | Out-File $report -Append }
Get-LocalUser | Where-Object { $_.Enabled -and $_.PasswordLastSet -gt (Get-Date).AddDays(-14) } |
    ForEach-Object { "  RECENTLY MODIFIED ACCOUNT: $($_.Name) — PasswordLastSet: $($_.PasswordLastSet)" | Out-File $report -Append }

"`n[5] SUSPICIOUS BINARIES IN STAGING DIRECTORIES" | Out-File $report -Append
@("C:\ProgramData", "C:\Users\Public") | ForEach-Object {
    Get-ChildItem $_ -Recurse -Include "rclone.exe","7z*.exe","*psexec*","*.ps1" -ErrorAction SilentlyContinue |
        Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-14) } |
        ForEach-Object { "  STAGED FILE: $($_.FullName) — Modified: $($_.LastWriteTime)" | Out-File $report -Append }
}

"`n=== TRIAGE COMPLETE — Review $report immediately ===" | Out-File $report -Append
Write-Host "Triage complete. Report: $report" -ForegroundColor Yellow

Incident Response Priorities

T-Minus Detection Checklist (Before Encryption Fires)

PANZER's dwell time of 5–12 days gives defenders a real detection window. In priority order:

1. Shadow copy deletion or BCD tampering — the single highest-fidelity pre-detonation signal; PANZER does this within hours of encryption, not days. Page the on-call IR lead.
2. WmiPrvSE.exe spawning cmd/powershell on multiple hosts within a short window — lateral spread in progress.
3. New scheduled tasks with SYSTEM privileges on servers, especially tasks invoking encoded PowerShell or binaries in ProgramData/Users\Public.
4. New local admin accounts or unexpected additions to Domain Admins / Administrators groups.
5. Archive tools (7z, rar) or rclone executing against large directory trees — exfiltration is active; you are already inside the extortion window.
6. Anomalous egress volume to consumer cloud storage (MEGA, Dropbox) or unfamiliar SFTP endpoints — PANZER exfils before encrypting.

Critical Assets PANZER Historically Prioritizes for Exfiltration

• Financial records and client PII (especially from the Financière d'Uzès-style financial victims — KYC documents, portfolio data)
• HR files — payroll, ID scans, contracts (maximizes regulatory/GDPR pressure on EU victims)
• Email archives of C-suite and legal — negotiation leverage
• Backup catalogs and credentials stores — to destroy recovery options
• Operational/telemetry data from government and manufacturing victims (e.g., meteorological datasets, SCADA-adjacent file shares)

Containment Actions — Ordered by Urgency

1. Isolate the identity plane first: Disable the suspected compromised accounts; force password resets for all admin-tier accounts; revoke active VPN sessions. PANZER moves on valid credentials — network isolation alone won't stop them.
2. Block egress to known exfil destinations at the proxy/firewall (MEGA, rclone default remotes) and alert on large outbound transfers.
3. Quarantine edge appliances: Take vCenter, Cisco FMC, and Check Point management interfaces off the general network — management VLAN only, jump-host access only.
4. Snapshot/immutable-backup verification: Confirm offline or immutable backups are intact and unreachable from the production domain BEFORE the encryptor fires.
5. Disable PsExec/WMI lateral paths temporarily via GPO if active spread is observed (accept the operational disruption — it's cheaper than reimaging 400 VMs).
6. Preserve volatile evidence: Memory capture on patient-zero host, VPN/firewall logs, and authentication logs before any remediation wipes them.

Hardening Recommendations

Immediate (24 hours)

• Patch or isolate the KEV-listed edge products NOW: CVE-2026-59310 (vCenter), CVE-2026-20316 (Cisco FMC), CVE-2026-50751 (Check Point IKEv1 — disable IKEv1 if unpatched), CVE-2024-1708 (ScreenConnect). If patching is impossible within 24h, remove management interfaces from any untrusted network reachability.
• Audit internet-facing surfaces for vCenter, FMC, Check Point, and RDP exposure (Shodan/your own ASM tooling). There is no legitimate reason for vCenter to be internet-reachable.
• Deploy the Sigma rules above and enable the KQL hunt as a scheduled Sentinel analytic rule with 4-hour frequency.
• Enforce phishing-resistant MFA (FIDO2) on all VPN and remote access; PANZER's valid-account abuse defeats push-based MFA via fatigue and token theft.
• Verify shadow copies exist on file servers and alert on vssadmin delete — this is your last alarm before detonation.

Short-Term (2 weeks)

• Segment the management plane: vCenter, firewall managers, backup infrastructure, and hypervisor consoles on a dedicated, ACL'd management network with jump-host-only access and no route to user VLANs.
• Implement application control (WDAC/AppLocker) blocking execution from C:\ProgramData and C:\Users\Public — kills PANZER's staging and tooling execution path.
• Deploy immutable/offline backups with a tested restore runbook; ransomware crews specifically hunt backup catalogs and credentials during exfil.
• Tiered admin model: Eliminate standing Domain Admin logons on workstations and member servers; use gMSA/PAM for service accounts.
• Egress filtering and DLP alerting on outbound volume anomalies — exfiltration is where you can still win after initial compromise.
• Run a tabletop exercise against this exact scenario: edge appliance compromise → 5-day dwell → mass VM encryption. The AEMET posting proves government and critical-infrastructure operators are in scope.

Security Arsenal continues to monitor PANZER's leak site and affiliated infrastructure. This bulletin will be updated as new victims or TTP shifts are observed. Organizations matching the victim profile above (EU mid-market, exposed edge appliances) should assume targeting and validate controls immediately.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub