Loading story…
The recently emerged Panzer ransomware-as-a-service operation has claimed Italian kitchen manufacturer Doimo Cucine and telecommunications engineering firm NTE Italia among victims reportedly spanning 11 countries. Panzer says it pairs encryption with data theft, alleging it stole 30 GB from Doimo Cucine and 16 GB from NTE Italia; neither company had publicly confirmed an incident. The group advertises payloads for Windows, Linux, FreeBSD, and VMware ESXi, placing virtualized environments at risk of broad, simultaneous service disruption.
Researchers have not independently verified Panzer’s initial-access vector or analyzed its encryptor. Limited-confidence assessments associate the operation with credential attacks, remote-service abuse, security-tool tampering, data collection, and exfiltration through alternative protocols. Organizations should prioritize phishing-resistant MFA, patch exposed remote-access services, segment vCenter and ESXi management networks, monitor for pre-encryption activity, and maintain tested immutable or offline backups.
TTPs, infrastructure, and targeting history in one profile.
2 events from the most recent confirmed update back to the earliest known activity.
Panzer listed Italian kitchen manufacturer Doimo Cucine and telecommunications engineering firm NTE Italia on its victim site, claiming theft of 30 GB and 16 GB of data respectively. Neither organization had publicly confirmed a ransomware incident at the time of reporting.
The Panzer ransomware-as-a-service operation surfaced and began advertising tooling for Windows, Linux, FreeBSD, and VMware ESXi environments.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
cryptika.com
Open sourcecybersecuritynews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A newly identified ransomware operation known as **RedAlert**, also referenced internally as **N13V**, has been observed targeting corporate networks by encrypting both **Windows** systems and **Linux-based VMware ESXi** servers. The Linux variant is built specifically for ESXi environments and can forcibly shut down running virtual machines before encrypting VM-related files, while encrypted data is renamed with a `.crypt[number]` extension and accompanied by a `HOW_TO_RESTORE` ransom note containing a Tor payment link. Researchers reported that the malware uses the **NTRUEncrypt** public-key algorithm and already shows relatively mature cross-platform capabilities despite appearing to be a newer operation. RedAlert is also conducting **double-extortion** attacks, stealing data before encryption and threatening to publish it on a leak site if victims refuse to pay. Reporting on broader ransomware trends placed RedAlert alongside newer groups such as **0mega** and **Lilith**, underscoring a rise in emerging crews with increasingly capable tooling. In that wider landscape, RedAlert stood out for its focus on enterprise virtualization infrastructure, especially ESXi hosts, adding to concerns that ransomware operators are continuing to prioritize high-impact targets that can disrupt large numbers of systems at once.
Aug 15, 2026
Ransomware operators are exploiting **CVE-2026-59310**, a critical unauthenticated VMware vCenter Server flaw in the Syslog server, to compromise vCenter management infrastructure and encrypt managed ESXi virtual machines with Babuk-derived payloads. Broadcom patched the vulnerability on July 29, but successful exploitation was observed within five days; reported activity affected 361 victim IP addresses across 47 countries. No ransomware group has been publicly identified. Initial intrusions used reverse-SSH tunnels and cron-job persistence, activity assessed as likely associated with an advanced persistent threat actor before ransomware deployment emerged. CISA has added the 9.8-CVSS vulnerability to its Known Exploited Vulnerabilities catalog and warned of ransomware use. Organizations should urgently install VMware's latest cumulative updates, remove vCenter interfaces from direct internet exposure, limit administration to trusted networks and jump hosts, and investigate formerly exposed or unpatched vCenter instances for persistence and unauthorized access.
Sep 17, 2026
A large-scale **ESXiArgs** ransomware campaign hit internet-exposed VMware ESXi servers by exploiting a long-known vulnerability in the OpenSLP service, with incident responders and national authorities warning that many affected systems had not applied available patches. CERT-FR issued an alert on active exploitation affecting VMware ESXi, while broad reporting described widespread compromises across organizations globally as attackers encrypted virtual machine files and dropped ransom notes on hypervisors. VMware said the attacks did **not** stem from a newly discovered zero-day, but from exploitation of older, already patched weaknesses and insecurely exposed services on unsupported or unpatched ESXi versions. The incident renewed scrutiny of VMware security after earlier warnings that threat actors, including state-backed operators, had abused VMware flaws such as `CVE-2020-4006` for initial access, persistence, and privileged movement inside enterprise environments, underscoring the risk posed by internet-facing virtualization infrastructure that lags on patching and hardening.
Sep 3, 2026