New Galago Ransomware Operation Emerges With Links to Panzer Extortion Group
Galago ransomware, linked to Panzer, allegedly stole 105 GB from Icelandic healthcare firm Inter ehf; its leak site is inactive.
A new ransomware brand called Galago publicly claims a partnership with the Panzer extortion group. Its Tor leak site, monitored from 15 September 2026, was inactive and listed no victims, but the domain uses the same pnzr prefix as Panzer's site. Panzer published 32 alleged victims between 5 August and 23 September 2026. An unconfirmed 9 September report alleged Galago took about 105 GB from Icelandic healthcare organization Inter ehf, with a possible publication window around 28-29 September; no encryption or data publication has been independently verified.
- Galago's leak-site domain uses the same pnzr prefix as Panzer.
- Galago claims a Panzer partnership; its leak site was inactive with no listings.
- Panzer published 32 alleged victims from 5 August to 23 September 2026.
- Unconfirmed claim of about 105 GB taken from Icelandic healthcare firm Inter ehf.
- Victims
- Inter ehf
- Organizations
- Cyberxtron
- Countries
- Iceland
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | pnzr4delgur5dlhtqcy7qqm6m7dkivxwh742enezpks5kswfpx7qrsid.onion | warrant close monitoring. IOCs Type Value Galago DLS (Tor) pnzr4delgur5dlhtqcy7qqm6m7dkivxwh742enezpks5kswfpx7qrsid[.]onion — currently down/inactive Panzer DLS (Tor) pnzruro7syvwve |
| domain | pnzruro7syvwvefx5mpo2fhzi4jftgquynsqf3vy5x3no57yp2iz4nyd.onion | px7qrsid[.]onion — currently down/inactive Panzer DLS (Tor) pnzruro7syvwvefx5mpo2fhzi4jftgquynsqf3vy5x3no57yp2iz4nyd[.]onion Panzer Tox ID 8C3D96497A9438794F705C055FC2FD3059F6CF11FF5 |
From the original article
3 min read at gbhackers.com
A newly identified ransomware operation tracked as Galago has emerged with apparent operational links to the Panzer ransomware group, raising concerns of an expanding double-extortion ecosystem targeting organizations worldwide. Researchers began directly monitoring Galago’s dark leak site (DLS) on 15 September 2026. At the time of observation, the group’s Tor-based leak portal was inactive and […]
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.