Panzer Ransomware Targets Italian Manufacturers and Telecom Firms With ESXi-Ready RaaS
New Panzer ransomware-as-a-service operation lists Italian firms Doimo Cucine and NTE Italia as victims, offering encryptors for Windows, Linux, FreeBSD, and ESXi.
Panzer, a ransomware-as-a-service operation that surfaced August 5, listed a kitchen manufacturer in Treviso (Doimo Cucine) and a telecommunications engineering firm in Catanzaro (NTE Italia) among alleged victims, claiming 30 GB and 16 GB of stolen data respectively. The group advertises encryptors for Windows, Linux, FreeBSD, and VMware ESXi, a Tox-based affiliate recruitment process with screening, an affiliate dashboard, and an 80/20 revenue split. Neither victim had publicly confirmed the incidents when researcher Andrea Fortuna's report was published, and the group's first access method and payload have not been independently analyzed. Panzer posted victims across 11 countries as claimed Italian ransomware incidents reached 212 by September 6, already above 2025's full-year total of 169.
- RaaS operation live since August 5, with Tox-based affiliate recruitment, screening, dashboard, and an 80/20 payment split.
- Lists Doimo Cucine (30 GB claimed) and NTE Italia (16 GB) as victims; neither has confirmed the incidents.
- Offers encryptors for Windows, Linux, FreeBSD, and VMware ESXi, enabling hypervisor-wide encryption of virtualized workloads.
- Victims posted across 11 countries; claimed Italian ransomware incidents hit 212 by September 6, above 2025's 169.
- First access method unanalyzed; suspected entry via exposed VPN/RDP, phishing, and abused remote-management tools.
- Vendors
- VMware
- Products
- VMware ESXi
- Threat actors
- Panzer
- Malware
- Panzer ransomware
- Victims
- Doimo CucineNTE Italia
- Countries
- Italy
From the original article
3 min read at cybersecuritynews.com
Panzer ransomware has entered Italy amid a sharp rise in attacks. The ransomware-as-a-service, or RaaS, operation surfaced on August 5 and listed a kitchen manufacturer in Treviso and a telecommunications engineering firm in Catanzaro among its alleged victims. The group advertises tools for Windows, Linux, FreeBSD, and VMware ESXi systems.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.