Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
2 IOCs
Galago Ransomware Emerges With Shared Infrastructure Ties to Panzer
Excerpt
Galago, a newly observed ransomware operation, claims to work with the Panzer group. A shared prefix in their Tor leak-site addresses supports a naming link, but does not by itself prove shared operators, malware, or access to the same systems. Researchers first flagged Galago on 9 September 2026 after an open-source alert alleged an attack on an Icelandic healthcare organization. They began monitoring Galago’s dark leak site (DLS) on 15 September and found it inactive, with…
Read the original report →Diamond Model
Adversary
Infrastructure(2)
Capability
Victim
Indicators of Compromise
Open the mindmap →2 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | pnzruro7syvwvefx5mpo2fhzi4jftgquynsqf3vy5x3no57yp2iz4nyd.onion | High | Score 86/100 | First seen |
| Domain | pnzr4delgur5dlhtqcy7qqm6m7dkivxwh742enezpks5kswfpx7qrsid.onion | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…