Loading story…
A newly identified ransomware operation calling itself Galago has claimed a partnership with the Panzer ransomware group and alleged theft of 105 GB of data from Icelandic healthcare organization Inter ehf. CyberXTron identified the group in September 2026 and began monitoring its Tor leak site, which was inactive and contained no published victim listings.
Neither the alleged Inter ehf intrusion and data theft nor any operational disruption has been independently verified. Researchers have not observed a Galago payload, initial-access method, confirmed victim disclosure, or technical evidence tying the group to an affected environment; the asserted Panzer connection rests on self-description and similar leak-site naming conventions, not verified shared operators or tooling. Healthcare organizations, particularly in the Nordic region, should reinforce phishing-resistant MFA, remote-access controls, tested backups, monitoring for unusually large outbound transfers, and data-breach response plans.
TTPs, infrastructure, and targeting history in one profile.
3 events from the most recent confirmed update back to the earliest known activity.
CyberXTron began monitoring Galago's Tor leak site on September 15 and found it inactive with no victims published. The site claimed a partnership with Panzer, but similar leak-site naming prefixes and the self-described relationship did not verify shared operators, tooling, or victim access.
On September 9, CyberXTron identified the emerging Galago ransomware operation following an open-source alert alleging an attack on Icelandic healthcare organization Inter ehf. Galago allegedly claimed it stole 105 GB of Inter ehf data, but the intrusion, theft, and any resulting disruption were not independently verified.
CyberXTron recorded 32 victim postings on Panzer's leak site between August 5 and September 23, characterizing Panzer's visible activity as double extortion. These postings do not independently verify the alleged compromises or establish a connection to Galago.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
cyberaccord.com
Open sourcecybersecuritynews.com
Open sourcecyberxtron.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **Panzer** ransomware operation has been linked to a reported attack on **The Minor Food Group**, a Thailand-based food and beverage company with thousands of outlets across the Asia-Pacific region. Reporting says the incident was identified on Aug. 10 and framed as a data breach affecting an organization in the **agriculture and food production** sector, marking one of the first publicly noted victim claims associated with the group. Separate threat intelligence reporting describes Panzer as an emerging **ransomware-as-a-service (RaaS)** operation recruiting affiliates on a Russian-speaking cybercrime forum. The group reportedly advertises an **80/20 revenue split**, automated affiliate management, negotiation portals, and leak-site support, and claims ransomware builds for **Windows, Linux, ESXi, and FreeBSD**. Researchers said no public malware sample was available and some capabilities remain unverified, but the Minor Food Group incident suggests Panzer may be moving from recruitment and promotion into active victim operations.
Aug 13, 2026
Ransomware reporting in early February highlighted both broad **January 2026** activity and specific new developments. BlackFog tracked **91 publicly disclosed ransomware attacks** to open 2026, with **healthcare** the most targeted sector (27 incidents) and nearly **half (49%)** of recorded attacks not publicly claimed by a known group; among claimed activity, **Qilin** led with eight incidents and the **U.S.** accounted for 58% of disclosed attacks. Separately, CYFIRMA reported identifying a ransomware strain dubbed **Milkyway**, which encrypts files and appends the `.milkyway` extension, presents a full-screen ransom message, and uses typical extortion pressure (including threats to leak stolen data), with recovery generally dependent on offline/secure backups absent cryptographic flaws. A healthcare-specific incident in Ontario was also disclosed: **Lakelands Public Health** reported a cybersecurity intrusion discovered **Jan 29** and reported **Feb 3**, which disrupted internal systems and some public services during containment while stating infectious disease and clinical appointment systems were not impacted. The **Lynx** ransomware group publicly claimed responsibility by listing the organization on a leak site and implying data theft; Lakelands Public Health engaged a specialized cybersecurity firm and worked with law enforcement and forensics to validate the claim and determine scope. UpGuard characterized Lynx as a **RaaS** operation and an alleged successor to the **INC** ransomware group, consistent with double-extortion tactics (encryption plus threatened data exposure).
Jun 29, 2026
**LockerGoga** hit large organizations across the United States and Europe, including reported victims such as Norsk Hydro, Altran, Hexion, and MPM Holdings, while the FBI later warned that the threat overlapped with **MegaCortex** in targeting enterprise networks. Investigators said the operators typically gained initial access through exploits, phishing, SQL injection, and stolen credentials, then spent weeks or months moving laterally with tools such as **Cobalt Strike** before encrypting systems. The malware appended the `.LOCKED` extension, dropped ransom notes such as `README_LOCKED.txt`, and in some cases was signed with a revoked **Sectigo** certificate issued to **ALISA LTD**, likely to reduce detection. Researchers said LockerGoga blurred the line between ransomware and a wiper because later variants forcibly logged users off Windows systems, blocked them from logging back in, disabled network interfaces, changed local passwords, and could even clear Windows Event Logs and encrypt files in the Recycle Bin. Reporting indicated the malware did not appear to self-propagate, but once attackers had domain access they could disable security tools and deploy it broadly across compromised environments. The FBI urged organizations to maintain offline backups, patch exposed systems, enforce strong passwords and **MFA**, disable `SMBv1`, audit remote access and account creation, monitor **Active Directory** changes, and enable **PowerShell** logging to detect similar intrusions earlier.
Aug 15, 2026