Panzer Ransomware Spreads Itself Across Network Shares, Then Deletes the Evidence

November 11, 2026by: CyOps

This blog is part of an ongoing series examining the findings in Cynet’s October 2026 Cyber Threat Intelligence Report from CyOps. Read the full report here.

Panzer is a ransomware-as-a-service operation first observed in August 2026. In roughly two months, it has claimed 46 victims across various industries in 20 countries, with most of its targets in the European Union.

Like most of today’s ransomware groups, Panzer runs a double-extortion model: steal sensitive data, encrypt the environment, then threaten to publish. What sets this payload apart is how much of the attack it handles on its own. One execution enumerates the network, copies itself to every reachable share, detonates on remote hosts through scheduled tasks, encrypts the local machine, and then removes itself.

*Panzer’s data leak site on the Tor network.*

What Static Analysis Revealed

The CyOps team found that Panzer is written in Rust and built with Microsoft Visual Studio 2026. Its strings showed the full playbook before the sample ever ran:

Evasion: References to SleepEx, which can delay execution past sandbox timeouts, and IsDebuggerPresent, which lets the malware change behavior when it detects analysis
File operations: Functions to enumerate the file system and read, write, copy, and delete files
Encryption: BCryptGenRandom and SystemFunction036 for generating keys
An exclusion list: Windows, Program Files, ProgramData, the recycle bin, and other system folders are skipped so the host stays bootable and the victim can read the ransom note
Propagation commands: “net view,” a scheduled task named PanzerUpdateTask, and schtasks /CREATE and /RUN templates targeting remote servers
Cleanup: A batch script that loops until the executable is gone, then deletes itself

How Panzer Moves Through a Network

Enumeration

On execution, Panzer launches cmd.exe to run “net view,” listing hosts in the current domain. For every host it finds, it runs “net view” again against that machine to list its shared folders.

Propagation

Panzer copies itself as panzer.exe into each enumerated shared folder. It then creates a scheduled task called PanzerUpdateTask on each remote host, configured to run the copied file once, and immediately triggers it with schtasks /RUN.

*Panzer creates the PanzerUpdateTask scheduled task on a remote host to run its copied executable.*

There’s no separate lateral movement toolkit here. Built-in Windows commands do all the work, which means the activity blends in with ordinary administration unless someone is watching for the pattern.

Ransom note

Once propagation finishes, Panzer turns to the local host and drops Recovery.md in its execution folder. The note claims data has been stolen, offers a “product pack” with a decryptor, data deletion, and a security report on how the attackers got in, and provides a Tor-hosted negotiation chat and a TOX ID.

The threats go further than most. Panzer warns it will file complaints with data protection authorities and law enforcement under GDPR to trigger regulatory investigations and fines, and that victims’ customers will face blackmail with their own personal data. The note also tells victims not to negotiate the price down by more than 30%.

Encryption and defacement

Panzer encrypts files and appends the .LOCKED extension. When encryption completes, it writes Panzer.jpg to the user’s Temp folder and sets it as the desktop wallpaper through the HKCU\Control Panel\Desktop\Wallpaper registry value.

Cleanup

Finally, Panzer creates and runs panzer.bat. The script deletes the Panzer executable, checks once per second until the file is gone, and then deletes itself, leaving responders with less to analyze.

MITRE ATT&CK Mapping

Execution: Command and Scripting Interpreter, Native API, Scheduled Task/Job
Stealth: Debugger Evasion, Indicator Removal, Virtualization/Sandbox Evasion
Discovery: Debugger Evasion, File and Directory Discovery, Remote System Discovery, Virtualization/Sandbox Evasion
Impact: Data Encrypted for Impact, Defacement

How Cynet Detects Panzer

During testing, Cynet’s unified cybersecurity platform ran in detection mode, without prevention, so Panzer could execute its full flow and each step could be logged. Cynet can detect and prevent this malware with multiple mechanisms:

File Dumped on the Disk: Cynet’s AV engine detects the malicious file when it lands on disk or attempts to run.
Threat Intelligence Detection: Third-party threat intelligence data flags the binary as malicious.
Unauthorized File Operation Attempt: Cynet’s ransomware decoy files catch encryption attempts, including attempts that arrive over the network from another infected host.

What Defenders Should Watch For

Bursts of “net view” commands from a single workstation, especially against many hosts in quick succession
Remote scheduled task creation (schtasks /CREATE /S) from endpoints that don’t normally administer other machines
New executables written to network shares, followed by scheduled tasks pointing to them
Batch files that delete an executable in a loop, then delete themselves
Writable shares accessible to standard user accounts, which give self-propagating ransomware its runway

Get the Full Report

The October 2026 CTI Report includes the full Panzer analysis with the complete process tree, plus in-depth breakdowns of Penumbra Stealer and BlackLocks ransomware.

Download the October 2026 Cyber Threat Intelligence Report