PANZER Ransomware Gang: 5 Victims in 4 Days — Technology & Manufacturing Sector Surge, Perimeter CVE Exploitation & Detection Rules

Classification: TLP:AMBER — For internal security teams and trusted partners Publication Date: 2026-09-18 Source: ransomware.live aggregation of PANZER .onion leak site + CISA KEV correlation

Executive Summary

PANZER has posted 5 victims to its dark web leak site over the last 4 days, representing a notable escalation from its historically low-and-slow cadence. The current wave spans France, Paraguay, Germany, and Peru, with Technology firms leading the victimology. Posting timing correlates with the addition of five perimeter and supply-chain CVEs to the CISA Known Exploited Vulnerabilities catalog over the last four months — all confirmed ransomware-associated. Technology, Education, and Manufacturing organizations with internet-facing VMware vCenter, Cisco FMC, or Check Point gateways should treat this as an active-threat condition.

1. Threat Actor Profile — PANZER

Confidence note: PANZER is a lower-volume actor than brand-name crews. Its tooling overlaps with commodity loaders and Cobalt Strike, which means attribution-by-signature alone is unreliable — behavior-based detection is essential.

2. Current Campaign Analysis

Recent Victim Postings

Sector Targeting

• Technology (40%) — two of five victims. Software/IT services firms are attractive: rich intellectual property for extortion leverage, and downstream supply-chain pivot potential.
• Manufacturing (20%) — the Honda (Peru) posting is the highest-profile name in the wave; manufacturing remains a pressure-point target due to OT-adjacent downtime costs.
• Education (20%) — a German university posting fits the classic September academic-year exploitation window, when new enrollments strain IT and patching cycles stall.

Geographic Concentration

No single-country focus — victims span FR, PY, DE, PE. This is opportunity-driven targeting, not geographic intent: the pattern is consistent with mass scanning for vulnerable edge appliances and hitting whatever answers, rather than deliberate country selection. The LATAM presence (PY, PE) is notable; PANZER has historically under-indexed in that region, suggesting either new affiliate coverage or opportunistic exploitation of regionally exposed RDP/VPN estates.

Victim Profile

Victims skew small-to-mid-market (estimated 50–2,000 employees, revenue ~USD 10M–500M), with the Honda Peru franchise being the outlier. Mid-market organizations with limited SOC coverage and slower patch cycles remain PANZER's sweet spot — large enough to pay, small enough to lack 24/7 detection.

Posting Frequency / Escalation

5 postings in 4 days with two on a single day (2026-09-18) indicates a batch detonation wave — consistent with a shared initial access vector exploited at scale in late August / early September, with victims moving through the extortion pipeline on roughly parallel timelines. Expect additional postings from this wave over the next 7–10 days.

CVE Correlation (Initial Access Vector Assessment)

The campaign window aligns with ransomware-confirmed KEV entries:

• CVE-2026-59310 — VMware vCenter path traversal (KEV 2026-08-18): added exactly one month before this wave. vCenter compromise yields broad ESXi-level impact — the highest-probability vector for this campaign.
• CVE-2026-50751 — Check Point Security Gateway improper authentication in IKEv1 (KEV 2026-06-08): classic edge-VPN entry point.
• CVE-2026-20316 — Cisco Secure FMC hard-coded password (KEV 2026-07-29): management-plane takeover of the firewall itself.
• CVE-2026-48027 — Nx Console embedded malicious code (KEV 2026-05-27): developer-workstation supply-chain entry; plausible vector for the Technology-sector victims specifically.
• CVE-2024-1708 — ConnectWise ScreenConnect path traversal (KEV 2026-04-28): RMM abuse remains a reliable mid-market intrusion path.

Assessment (moderate confidence): PANZER's initial access in this wave is primarily unpatched perimeter appliances (vCenter, Check Point, Cisco FMC), with Nx Console as a candidate vector for the developer-heavy Technology victims.

3. Detection Engineering

Sigma Rules

---
title: PANZER - Shadow Copy Deletion Pre-Encryption Activity
id: 8f2a1c3d-pz01-4e5a-9b1c-panzer000001
status: experimental
description: Detects Volume Shadow Copy deletion and backup catalog tampering consistent with PANZER pre-encryption staging (vssadmin, wbadmin, bcdedit recovery suppression).
author: Security Arsenal Threat Intelligence
date: 2026/09/18
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wbadmin.exe'
      - '\bcdedit.exe'
      - '\wmic.exe'
  selection_cmd:
    CommandLine|contains:
      - 'delete shadows'
      - 'resize shadowstorage'
      - 'delete catalog'
      - 'recoveryenabled no'
      - 'shadowcopy delete'
  condition: selection_img and selection_cmd
falsepositives:
  - Legitimate backup maintenance scripts
  - System administrators reclaiming shadow storage
level: high
tags:
  - attack.impact
  - attack.t1490
---
title: PANZER - PsExec and WMI Remote Execution Lateral Movement
id: 8f2a1c3d-pz02-4e5a-9b1c-panzer000002
status: experimental
description: Detects PsExec-style service execution and WMI remote process creation used by PANZER affiliates for lateral movement during compressed dwell-time intrusions.
author: Security Arsenal Threat Intelligence
date: 2026/09/18
logsource:
  category: process_creation
  product: windows
detection:
  selection_psexec:
    Image|endswith:
      - '\PSEXESVC.exe'
      - '\psexec.exe'
      - '\paexec.exe'
  selection_wmi:
    ParentImage|endswith: '\WmiPrvSE.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\rundll32.exe'
  selection_svc:
    CommandLine|contains:
      - 'ADMIN$'
      - '\\127.0.0.1\'
  condition: selection_psexec or selection_wmi or selection_svc
falsepositives:
  - Legitimate administrative tooling (SCCM, PDQ Deploy)
level: high
tags:
  - attack.lateral_movement
  - attack.t1569.002
  - attack.t1047
---
title: PANZER - Data Staging and Cloud Exfiltration via Rclone or Archive Tools
id: 8f2a1c3d-pz03-4e5a-9b1c-panzer000003
status: experimental
description: Detects mass archive creation and rclone-based exfiltration to cloud storage, a hallmark of PANZER double-extortion staging before detonation.
author: Security Arsenal Threat Intelligence
date: 2026/09/18
logsource:
  category: process_creation
  product: windows
detection:
  selection_rclone:
    - Image|endswith: '\rclone.exe'
    - OriginalFileName: 'rclone.exe'
  selection_rclone_cmd:
    CommandLine|contains:
      - 'copy '
      - 'sync '
      - 'move '
      - '--config'
      - 'mega'
      - 'dropbox'
      - 's3'
  selection_archive:
    Image|endswith:
      - '\7z.exe'
      - '\7za.exe'
      - '\rar.exe'
      - '\winrar.exe'
  selection_archive_cmd:
    CommandLine|contains:
      - ' a '
      - '-p'
      - '-v'
  condition: (selection_rclone and selection_rclone_cmd) or (selection_archive and selection_archive_cmd)
falsepositives:
  - Legitimate cloud backup jobs (whitelist known backup service accounts and paths)
level: high
tags:
  - attack.exfiltration
  - attack.t1567.002
  - attack.collection
  - attack.t1560.001

Microsoft Sentinel KQL — Pre-Ransomware Staging Hunt

// PANZER pre-detonation hunt: lateral movement + staging + defensive evasion chain
// Lookback: 14 days (matches PANZER dwell-time profile of 5-12 days)
let Lookback = 14d;
let SuspiciousStaging = DeviceProcessEvents
| where Timestamp > ago(Lookback)
| where FileName in~ ("rclone.exe", "7z.exe", "7za.exe", "rar.exe", "winrar.exe")
   or ProcessCommandLine has_any ("--config", "mega", "delete shadows", "recoveryenabled no")
| project StagingTime=Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName;
let LateralMovement = DeviceNetworkEvents
| where Timestamp > ago(Lookback)
| where RemotePort in (445, 135, 3389, 5985)
| where InitiatingProcessFileName in~ ("psexec.exe", "psexesvc.exe", "wmiprvse.exe", "wmic.exe", "rclone.exe")
| project LateralTime=Timestamp, DeviceName, InitiatingProcessAccountName, RemoteIP, RemotePort;
let NewAccounts = DeviceEvents
| where Timestamp > ago(Lookback)
| where ActionType == "UserAccountCreated"
| project AccountTime=Timestamp, DeviceName;
SuspiciousStaging
| join kind=inner LateralMovement on DeviceName
| where StagingTime between (datetime_add('hour', -72, LateralTime) .. datetime_add('hour', 72, LateralTime))
| extend TimeDeltaHours = datetime_diff('hour', StagingTime, LateralTime)
| summarize FirstSeen=min(StagingTime), LastSeen=max(StagingTime),
    StagingTools=make_set(FileName), Commands=make_set(ProcessCommandLine, 5),
    RemoteTargets=make_set(RemoteIP, 10)
  by DeviceName, AccountName
| order by FirstSeen desc

PowerShell Rapid-Response Script — Exposed RDP + Recent Persistence Enumeration

<#
.SYNOPSIS
  PANZER rapid triage: checks RDP exposure, new local admins, scheduled tasks
  and services created in the last 7 days, and Volume Shadow Copy health.
  Run elevated. Safe to run on endpoints and servers; read-only.
#>

$days = 7
$cutoff = (Get-Date).AddDays(-$days)
Write-Host "=== PANZER Rapid Triage — $env:COMPUTERNAME ===" -ForegroundColor Cyan

# 1. RDP exposure check
Write-Host "`n[1] RDP Configuration" -ForegroundColor Yellow
$rdp = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -ErrorAction SilentlyContinue
$nla = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication -ErrorAction SilentlyContinue
Write-Host ("  RDP Enabled: {0} | NLA Enabled: {1}" -f ($rdp.fDenyTSConnections -eq 0), ($nla.UserAuthentication -eq 1))
if ($rdp.fDenyTSConnections -eq 0 -and $nla.UserAuthentication -ne 1) {
    Write-Host "  [!!] RISK: RDP enabled without NLA — common PANZER entry point" -ForegroundColor Red
}

# 2. Local admin group changes (new members)
Write-Host "`n[2] Local Administrators" -ForegroundColor Yellow
Get-LocalGroupMember -Group 'Administrators' -ErrorAction SilentlyContinue |
  ForEach-Object { Write-Host "  $($_.Name) ($($_.ObjectClass))" }

# 3. Scheduled tasks created in last 7 days
Write-Host "`n[3] Scheduled Tasks Created Since $cutoff" -ForegroundColor Yellow
Get-ScheduledTask | Where-Object { $_.Date -gt $cutoff -and $_.TaskPath -notlike '\Microsoft*' } |
  ForEach-Object {
    Write-Host "  [TASK] $($_.TaskName) | $($_.TaskPath) | Created: $($_.Date)" -ForegroundColor Red
  }

# 4. Services created in last 7 days (PsExec-style persistence)
Write-Host "`n[4] Services Installed Since $cutoff" -ForegroundColor Yellow
Get-WinEvent -FilterHashtable @{LogName='System'; Id=7045; StartTime=$cutoff} -ErrorAction SilentlyContinue |
  ForEach-Object {
    Write-Host "  [SVC] $($_.TimeCreated) :: $($_.Message.Split("`n")[0])" -ForegroundColor Red
  }

# 5. Volume Shadow Copy status
Write-Host "`n[5] Volume Shadow Copies" -ForegroundColor Yellow
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
if ($shadows) {
  $shadows | ForEach-Object { Write-Host "  VSS: $($_.DeviceObject) — $($_.InstallDate)" }
} else {
  Write-Host "  [!!] NO shadow copies present — either disabled or DELETED (pre-encryption indicator)" -ForegroundColor Red
}

# 6. Suspicious staging tools on disk
Write-Host "`n[6] Staging Tool Sweep (rclone/7z in unusual paths)" -ForegroundColor Yellow
$paths = @('C:\Users\Public','C:\ProgramData','C:\Windows\Temp')
foreach ($p in $paths) {
  Get-ChildItem $p -Recurse -Include 'rclone.exe','7z.exe','7za.exe','rar.exe' -ErrorAction SilentlyContinue |
    ForEach-Object { Write-Host "  [FOUND] $($_.FullName) — modified $($_.LastWriteTime)" -ForegroundColor Red }
}
Write-Host "`n=== Triage Complete ===" -ForegroundColor Cyan

4. Incident Response Priorities (PANZER Playbook-Specific)

T-Minus Detection Checklist (Before Encryption Fires)

PANZER's compressed 5–12 day dwell time means the staging window is short. Hunt for this sequence:

1. Edge device anomalies — unexpected admin logins on vCenter, Check Point, or Cisco FMC management interfaces outside change windows.
2. Recon bursts — nltest, net group "Domain Admins", AdFind/BloodHound collection within 24–48h of entry.
3. Backup targeting — access to Veeam/backup repositories, shadow copy deletion, bcdedit recovery suppression. This is typically 24–72h before detonation — your last actionable window.
4. Archive staging — large .7z/.rar creation in C:\ProgramData or user profiles; rclone configs with Mega/Dropbox/S3 remotes.
5. SMB fan-out — one host suddenly initiating 445 connections to dozens of servers (encryption push via PsExec/GPO).

Critical Assets Historically Prioritized for Exfiltration

• Finance/HR data (payroll, tax records) — highest extortion leverage
• Customer databases and contracts
• Source code repositories (Technology-sector victims — consistent with the current wave)
• Legal and M&A documents
• Email archives of executive leadership

Containment Actions — Ordered by Urgency

1. Isolate affected segments immediately — PANZER moves fast; do not wait for full scoping before isolating hosts showing staging indicators.
2. Block egress to known exfil destinations (Mega, unapproved S3/Dropbox) at the proxy/firewall.
3. Disable compromised accounts and revoke sessions — including service accounts observed in lateral movement.
4. Snapshot/backup critical servers offline NOW if shadow copies are already deleted — assume detonation is imminent.
5. Patch edge devices in-place or take management interfaces off the internet — do not leave the entry vector open for re-entry during response.
6. Preserve memory and $MFT artifacts on patient-zero host before remediation — compressed dwell time means evidence expires fast.

5. Hardening Recommendations

Immediate (24 Hours)

• Patch or isolate the KEV perimeter stack: VMware vCenter (CVE-2026-59310), Check Point gateways (CVE-2026-50751), Cisco FMC (CVE-2026-20316), ConnectWise ScreenConnect (CVE-2024-1708). If patching isn't possible today, remove management interfaces from internet exposure.
• Audit developer workstations for Nx Console (CVE-2026-48027) — particularly critical for Technology-sector organizations given PANZER's current victimology.
• Enforce NLA + MFA on all RDP; ideally move RDP behind VPN/ZTNA entirely.
• Block rclone and unsigned archive utilities via AppLocker/WDAC unless explicitly approved.
• Enable tamper protection on EDR and verify Volume Shadow Copies exist and are monitored for deletion (alert on Event ID 7036 VSS stop + vssadmin execution).
• Egress filtering: block outbound to consumer cloud storage not in the corporate allowlist.

Short-Term (2 Weeks)

• Segment backup infrastructure onto a separate network with dedicated credentials; immutable/offline backup copies (3-2-1 with at least one air-gapped or immutable tier).
• Deploy decoy/canary file shares on file servers — ransomware touching them gives you a pre-detonation tripwire.
• Lateral movement friction: disable SMBv1, restrict workstation-to-workstation SMB/WinRM, tier admin model so domain admin creds never touch endpoints.
• Centralize edge-device logs (vCenter, Check Point, FMC) into the SIEM — PANZER's entry is invisible if appliance logs stay on the appliance.
• Detection-as-code deployment of the Sigma rules above into your SIEM pipeline with a 7-day baseline tuning window.

Analyst's Note

PANZER's victim volume remains modest compared to top-tier crews, but the cadence spike, cross-continent spread, and tight correlation with fresh KEV perimeter CVEs make this wave worth active hunting rather than passive monitoring. The two-victim single-day posting on 2026-09-18 strongly suggests additional detonations from the same intrusion batch are in the pipeline. Technology and manufacturing organizations with unpatched edge appliances should assume they are already scanned and possibly already breached.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub