Threat Actors panzer

panzer

TLP:CLEAR

Active

Kill Chain Analysis Generate Graph Hunt Package

Also known as: tracked as, the Neubaufahrzeug, Snowstorm, the Goliath Demolition Vehicle, was a small, services, other system resources, public key cryptography, one private, the file association, header, metamorphic, Sandworm Team, Operation Cleaver, Shell Crew, WebMasters, KungFu Kittens, PinkPanther, a separate entity, APT28, VOLTZITE, for follow-on operations, Volt Typhoon, coordinat, handler, Netshell, magic bytes, the IconEnvironmentDataBlock, mutating code, BlackCat, JokerDPR

Description

Known victims: 2

Goals & Targeting

Objectives

Ransomware

Financial Gain

Targeted Sectors

Defense

Government

Financial services

Telecommunications

Healthcare

Manufacturing

Critical infrastructure

Media

Aerospace

Education

Energy

Non profit

Information technology

Pharmaceutical

Aviation

Hospitality

Retail

Transportation

Chemical

Think tank

Legal services

Mining

Gaming

Nuclear

Oil gas

Maritime

Utilities

Entertainment

Construction

Targeted Countries / Regions

AI Analysis

No AI analysis yet.

ATT&CK Techniques

Collection

5 techniques

Clipboard Data

Automated Collection

Audio Capture

Browser Session Hijacking

T1560

Archive Collected Data

Command & Control

2 techniques

T1071

Application Layer Protocol

T1092

Communication Through Removable Media

Credential Access

3 techniques

T1110

Brute Force

T1555

Credentials from Password Stores

T1557

Adversary-in-the-Middle

Discovery

8 techniques

T1010

Application Window Discovery

T1087

Account Discovery

T1217

Browser Information Discovery

T1526

Cloud Service Discovery

T1538

Cloud Service Dashboard

T1580

Cloud Infrastructure Discovery

T1613

Container and Resource Discovery

T1619

Cloud Storage Object Discovery

Execution

3 techniques

T1059

Command and Scripting Interpreter

T1609

Container Administration Command

T1651

Cloud Administration Command

Exfiltration

1 technique

T1020

Automated Exfiltration

Impact

1 technique

T1531

Account Access Removal

Initial Access

1 technique

T1659

Content Injection

Persistence

7 techniques

T1037

Boot or Logon Initialization Scripts

T1098

Account Manipulation

T1136

Create Account

T1543

Create or Modify System Process

T1547

Boot or Logon Autostart Execution

T1554

Compromise Host Software Binary

T1671

Cloud Application Integration

Privilege Escalation

1 technique

T1548

Abuse Elevation Control Mechanism

Reconnaissance

1 technique

T1595

Active Scanning

Resource Development

4 techniques

T1583

Acquire Infrastructure

T1584

Compromise Infrastructure

T1586

Compromise Accounts

T1650

Acquire Access

Stealth

3 techniques

T1134

Access Token Manipulation

T1197

BITS Jobs

T1612

Build Image on Host

Software / Tooling

APT38

Akira

Alphv

AppleJeus

BITS

Backdoors

BlackByte

BlackCat

BridgeHead

Carbanak

Cobalt

Custom malware

Dark

GitHub

Global

Group Policy

Handala

Hook

Interception

Kimsuky

Leverage

LockBit

MuddyWater

Naikon

Nexus

OilRig

PLAY

Payload

Payload

Phishing emails

PowerShell

Remote access tools

Royal

UNC1549

Void

Windows Command Shell

Winnti

inter

netsh

phishing

Family

osx.systemd

systemd

Family

Campaigns / Victims

All campaigns →

Inactive

Panzer: The Minor Food Group

Ransomware attack attributed to Panzer. | Country: TH | Sector: Agriculture and Food Production | Founded in 1980, Minor Food is the culinary pillar of Minor International (MINT) and one of the largest food and beverage companies in the Asia-Pacific region. With a footprint spanning over 2,600 outlets across 24 countries, Minor Food operates a dynamic dual-engine strategy combining globally renowned franchises—such as Burger King, Dairy Queen, Swensen's, and Bonchon—with a powerful roster of wholly-owned homegrown brands like The Pizza Company, The Coffee Club, and GAGA. Committed to delivering exceptional dining experiences, Minor Food continues to drive the industry forward through digitized kitchen ecosystems, end-to-end supply chain mastery, and consumer-centric innovation. | Source: https://www.ransomware.live/id/VGhlIE1pbm9yIEZvb2QgR3JvdXBAUGFuemVy

Aug 10, 2026

TLP:CLEAR

Inactive

Panzer: Siam Oil Product

Ransomware attack attributed to Panzer. | Country: TH | Sector: Energy & Utilities | Siam Oil Product Co., Ltd. is a Thailand-based petroleum and industrial-products distributor, operating for 20+ years with registered capital of THB 200 million and 700+ employees; it supplies fuel oil, diesel, asphalt, base oils, automotive/industrial lubricants, petrochemicals such as HDPE/LDPE/LLDPE, plastic additives, and industrial products, and also operates a coffee-shop franchise business. Its headquarters is at RS Tower, Ratchadaphisek Road, Din Daeng, Bangkok, Thailand. | Source: https://www.ransomware.live/id/U2lhbSBPaWwgUHJvZHVjdEBQYW56ZXI=

Aug 9, 2026

TLP:CLEAR

Inactive

Panzer: Daily Trust

Ransomware attack attributed to Panzer. | Country: NG | Sector: Other | Daily Trust is a Nigerian news organization that provides breaking news, investigative stories, and various features across multiple sectors including business, politics, sports, and entertainment. The company offers content through print, online platforms, and media outlets like Trust TV and Trust Radio. Its services cater primarily to the Nigerian public, with a focus on providing comprehensive coverage of local and international news. Daily Trust aims to inform and engage its audience through a diverse range of storytelling and analysis. | Source: https://www.ransomware.live/id/RGFpbHkgVHJ1c3RAUGFuemVy

Aug 8, 2026

TLP:CLEAR

Inactive

Panzer: Surakarta University

Ransomware attack attributed to Panzer. | Country: ID | Sector: Education | Website: ums.ac.id | Infostealer data confirmed. | Universitas Surakarta (UNSA) is a technology-based university committed to excellence in education, business, and entrepreneurship, responsive to industry and community needs. It offers a range of programs including undergraduate, professional conversion, and postgraduate studies, aimed at developing competent and character-driven graduates. UNSA provides a flexible and collaborative learning environment, supported by experienced faculty and modern infrastructure. The university invites prospective students, partners, and the community to join in building a brighter and more meaningful future together. | Source: https://www.ransomware.live/id/U3VyYWthcnRhIFVuaXZlcnNpdHlAUGFuemVy

Aug 5, 2026

TLP:CLEAR

Inactive

Panzer: Festina Group

Ransomware attack attributed to Panzer. | Country: CH | Sector: Retail & E-Commerce | Website: festinagroup.com | Infostealer data confirmed. | Festina Group is a major watch and jewelry company that owns six different brands: Festina, Lotus, Lotus Style, Calypso, Candino, and Jaguar. They blend Swiss watchmaking traditions with modern design, creating timepieces that mix classic craftsmanship with contemporary style. Each brand offers something unique, from sporty watches to elegant jewelry, giving customers plenty of choices for different tastes and occasions. | Source: https://www.ransomware.live/id/RmVzdGluYSBHcm91cEBQYW56ZXI=

Aug 5, 2026

TLP:CLEAR