Panzer ransomware claims two Italian victims in first month

Panzer ransomware emerged in August as a ransomware-as-a-service operation and claimed victims in 11 countries within its first month, according to research by Andrea Fortuna. Two Italian organisations were listed: kitchen manufacturer Doimo Cucine, near Treviso, on August 17, and telecommunications engineering firm NTE Italia, based in Catanzaro, four days later. Neither company has publicly confirmed the claims.

The affiliate platform supports builds for Windows, Linux, VMware ESXi and FreeBSD, with tools for negotiation, payment processing and leak-site management. ESXi support is the most consequential detail for Italian enterprises, since compromising a hypervisor allows attackers to encrypt dozens of virtual machines in a single operation. The group has released no verified malware samples or network indicators.

The operation runs a semi-open model in which affiliates apply via Tox and are screened before receiving dashboard access, with an 80/20 revenue split and accounts inactive for more than seven days deactivated. Fortuna noted that Panzer arrived amid a broader Italian ransomware surge, with 212 claims against Italian organisations by September 6 compared with 169 for all of 2025.