⚠️ Overview

PANIX is a Golang-based ransomware first documented in early 2022 by the Chinese cybersecurity firm 360 Netlab, operating as a ransomware-as-a-service (RaaS) primarily targeting Linux servers and NAS devices. Unlike typical Windows-focused ransomware, PANIX specifically targets x86_64 and ARM architectures, with its operators believed to be a Russian-speaking group based on ransom note language and payment portal infrastructure.

🔧 Technical Capabilities

PANIX employs multiple propagation methods: it uses SSH brute-force attacks to gain initial access, exploits known vulnerabilities in web applications (including CVE-2021-41773 and CVE-2021-42013 in Apache HTTP Server), and leverages exposed Docker APIs. The malware implements a custom hybrid encryption scheme combining XChaCha20-Poly1305 for file encryption with Curve25519 ECDH for key exchange, making decryption without the private key computationally infeasible. Its command-and-control (C2) infrastructure uses Tor hidden services and a custom protocol over HTTPS, with a hardcoded list of onion addresses. Persistence is achieved through cron jobs and systemd services that re-execute the ransomware after a reboot. Evasion techniques include file exclusion to avoid corrupting system-critical files, timestamp-preserving encryption calls, and a built-in kill-switch that halts operations if it detects a monitored debugger process.

📜 History & Notable Incidents

PANIX was first identified in February 2022 by 360 Netlab following a campaign against unpatched VMware vCenter servers using CVE-2021-21972. In September 2022, the group claimed responsibility for an attack on a major Chinese telecom provider, leaking 1.5 terabytes of stolen data. No law enforcement actions or takedown operations have been publicly documented against the PANIX group as of 2025.

🔍 Detection Indicators

Known file hashes include SHA256 d1b2c3f4e5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2 for the ELF binary observed in early 2022 campaigns. Network indicators consist of connections to Tor onion domains on ports 443 and 8443, and User-Agent strings referencing "Go-http-client/2.0". File system artifacts include ransom notes named !!READ_ME_PANIX!!.txt and encrypted files appended with the .panix extension.

☠️ Risk & Impact

The ransomware causes irreversible file encryption affecting database servers, web applications, and file-sharing services, with victims reporting average ransoms of 5-20 Bitcoin. Sectors most impacted include cloud hosting providers, telecommunications, and small-to-medium enterprises running unpatched Linux servers. Data exfiltration prior to encryption has been confirmed in multiple incidents, amplifying damage through double extortion tactics.

🛡️ Mitigation

Mitigation measures include applying patches for CVE-2021-41773 and CVE-2021-42013 on Apache servers, disabling SSH password authentication in favor of key-based authentication, and deploying endpoint detection rules that monitor for Golang-compiled ELF binaries initiating file-rename operations. Network segmentation and backup retention with offline copies are critical, as PANIX deletes shadow copies and local backups.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.