Galago, a newly observed ransomware operation, claims to work with the Panzer group. A shared prefix in their Tor leak-site addresses supports a naming link, but does not by itself prove shared operators, malware, or access to the same systems.
Researchers first flagged Galago on 9 September 2026 after an open-source alert alleged an attack on an Icelandic healthcare organization.
They began monitoring Galago’s dark leak site (DLS) on 15 September and found it inactive, with no victims listed. As of the reported observation, Galago has not publicly substantiated an intrusion through its own leak site.
Galago’s site description claims an operational partnership with Panzer. Its reported Tor address begins pnzr4del, while Panzer’s begins pnzruro.
The shared pnzr prefix is consistent with a relationship, but a naming pattern and a self-reported claim are not independent proof of operational control.
Galago Ransomware Linked to Panzer
Panzer has a more visible record. Researchers tracking the groups report that Panzer published 32 victims between 5 August and 23 September 2026.
An earlier CyberXTron profile described Panzer as a ransomware-as-a-service operation that recruits affiliates and uses double extortion, stealing data as well as encrypting files.
That profile also described advertised builds for Windows, Linux, ESXi, and FreeBSD. Those Panzer capabilities should not be attributed to Galago without evidence of shared tooling or attacks.
One public report dated 9 September alleged that Galago compromised Inter ehf in Iceland and took 105 GB of data. It suggested the data could be published 19 to 20 days later, around 28–29 September.
The claim remains unverified, Galago’s leak site had no published victim listing when researchers checked it, and the supplied findings do not establish that the reported data theft occurred. A deadline stated in an extortion claim is not evidence that a leak will happen.
The reported Galago DLS address is pnzr4delgur5dlhtqcy7qqm6m7dkivxwh742enezpks5kswfpx7qrsid[.]onion; the reported Panzer address is pnzruro7syvwvefx5mpo2fhzi4jftgquynsqf3vy5x3no57yp2iz4nyd[.]onion.
The supplied Panzer Tox contact ID is 8C3D96497A9438794F705C055FC2FD3059F6CF11FF51060EE55ED7F0679CFC7218825BD56CB1. These are leak-site and contact identifiers for monitoring, not proof that a particular network was compromised.
The earlier Panzer profile lists its Tor address and Tox ID but says it had no independently confirmed malware hashes, IP addresses, or intrusion domains at publication, CyberXTron said.
Defenders should patch exposed systems, require phishing-resistant multifactor authentication for remote and privileged access, and watch for unusual access, security-tool tampering, and large outbound transfers.
Segment backup and virtualization management systems, keep protected offline or immutable backups, and test restoration. Incident plans should cover possible data exposure as well as file recovery.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team
