Loading malware…
Pay2Key is a Windows ransomware family and associated extortion operation active since 2020. Its original C++ encryptor uses AES and RSA to encrypt victim data and demand payment for decryption. It communicates with command-and-control infrastructure over TCP, transmits its public key, and uses RSA-encrypted communications. It can identify the compromised host’s IP and MAC addresses and delete its own logs to hinder investigation.
Pay2Key operations have combined encryption of servers and workstations with data theft and publication of stolen information to pressure victims. Early campaigns primarily targeted Israeli organizations across industrial, insurance, logistics, and technology sectors, with additional activity in Europe. The operation has historical links to Iranian actors, including Fox Kitten. Intrusions have involved exploitation of exposed enterprise applications and VPN appliances, RDP exploitation and brute forcing, and supply-chain access through previously compromised companies. Operators have used reverse-proxy tools for network access and created local administrator accounts for persistence.
Later activity includes an attack against a U.S. healthcare provider in 2026 and deployment by Fluffy Wolf against Russian organizations. Fluffy Wolf delivered a Mimic-based payload bearing the Pay2Key name through phishing emails containing malicious archives or links to externally hosted archives, using PowerLoader and PureCrypter in the delivery chain. Observed anti-forensic behavior includes overwriting the ransomware executable with zeros before deleting it. The historical Iran-linked operation and later use of the Pay2Key name by other actors should not be treated as evidence of common operational control.
3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
3 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
When deploying the Pay2Key ransomware, the attackers employ heavy anti-forensic techniques to cover their tracks.
Early May 2021 saw another set of disruptive ransomware attacks attributed to Iran targeting Israel from the n3tw0rm ransomware group, a newly-identified threat actor with links to the 2020 Pay2Key attacks.
28 distinct techniques documented for this family, organized by ATT&CK tactic.
Halcyon and Beazley Security published a joint report detailing the attack chain: compromised admin credentials, a week of dormancy, TeamViewer for access...
“pivoting to exploit zero-day vulnerabilities in industrial time-management software…” and “identify and exploit public-facing applications at scale.”
Security researchers have uncovered a series of highly sophisticated Fluffy Wolf phishing attacks targeting Russian organizations across various critical sectors.
К посланиям прилагались «акты сверки», «претензии» и другие документы, которые на деле оказывались архивами с малварью. Иногда вложение прикреплялось напрямую...
...а в других случаях жертве предоставляли ссылку на GitHub-репозиторий, откуда загружался RAR-архив. По словам исследователей, Fluffy Wolf активно использует GitHub, потому что такие ссылки выглядят легитимно и помогают обходить почтовые фильтры...
Halcyon and Beazley Security published a joint report detailing the attack chain: compromised admin credentials, a week of dormancy, TeamViewer for access...
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AllowMultipleTSSessions Registry Terminal Server persistence HKLM\system\CurrentControlSet\Control\Terminal Server\fSingleSessionPerUser Registry Terminal Server persistence
To remain hidden, the threat actors inject these payloads into trusted Windows processes such as RegAsm.exe, InstallUtil.exe, and MSBuild.exe.
Halcyon and Beazley Security published a joint report detailing the attack chain: compromised admin credentials, a week of dormancy, TeamViewer for access...
To remain hidden, the threat actors inject these payloads into trusted Windows processes such as RegAsm.exe, InstallUtil.exe, and MSBuild.exe.
The content repeatedly describes malware and threat actors deleting files, directories, droppers, logs, scripts, temporary files, exfiltrated archives, and uninstalling themselves to cover tracks or reduce forensic artifacts.
Halcyon and Beazley Security published a joint report detailing the attack chain: compromised admin credentials, a week of dormancy, TeamViewer for access...
Defense evasion has remained a critical phase, where threat actors employ multiple obfuscation techniques (T1140)
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AllowMultipleTSSessions Registry Terminal Server persistence HKLM\system\CurrentControlSet\Control\Terminal Server\fSingleSessionPerUser Registry Terminal Server persistence
This is an older build from the same RaaS platform, sharing the same toolchain, SFX delivery structure, and NoDefender AV evasion kit documented in the Halcyon report.
...TeamViewer for access, credential harvesting with Mimikatz and LaZagne...
The lineage is visible in the service and process kill lists. The encryptor terminates 60+ services and 40+ processes before encryption...
AdFind can extract subnet information from Active Directory; actors used ipconfig /all after exploiting a machine; numerous malware and groups used ipconfig, ifconfig, arp, route, netsh, nbtstat, NBTscan, and related APIs to gather IP, MAC, DNS, DHCP, gateway, proxy, domain, ARP cache, routing, and adapter details.
The lineage is visible in the service and process kill lists. The encryptor terminates 60+ services and 40+ processes before encryption...
The content repeatedly describes malware and threat actors collecting host details such as hostname, OS version, architecture, CPU, memory, BIOS, language, and other machine characteristics; e.g., "Action RAT has the ability to collect the hostname, OS version, and OS architecture of an infected host."
The encryptor builds on Mimic ransomware, a Conti derivative that uses voidtools Everything for filesystem enumeration.
This data includes Windows domain account information, DNS zone information for the domain, and a file listing from its Gerrit development code review system.
...and a self-extracting 7z archive that deployed the encryptor.
Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Once PowerLoader infiltrates a target host, it spawns hidden PowerShell instances to retrieve additional malicious scripts directly from the command-and-control (C2) server. These scripts systematically deploy the final payloads...
Halcyon and Beazley Security published a joint report detailing the attack chain: compromised admin credentials, a week of dormancy, TeamViewer for access...
The content repeatedly describes malware and threat actors using SSL, TLS, HTTPS, RSA, AES, Blowfish, RC4, ECIES, Diffie-Hellman, OpenSSL, WolfSSL, and mutual TLS to protect command and control traffic.
Multiple malware families and intrusion sets are described as encrypting C2 traffic using SSL/TLS/HTTPS (e.g., "used HTTPS for command and control", "encrypts C2 communications with TLS", "uses SSL for encrypting C2 communications", "TLS-encrypted WebSocket Protocol (WSS) for C2"). | Examples include: "encrypts some C2 with RSA", "RSA encryption for C2 communications", "hard-coded RSA public key", "RSA-2048", "RSA-4096", and "REvil has encrypted C2 communications with the ECIES algorithm".
"...it achieved some notoriety for hack-and-leak attacks on Israeli organizations."
Today, the Pay2Key ransomware operation leaked data allegedly stolen from Habana Labs during a cyberattack.
The encryptor terminates 60+ services and 40+ processes before encryption, including: Services: AcronisAgent, BackupExecJobEngine, CAARCUpdateSvc... | The encryptor terminates 60+ services and 40+ processes before encryption, including... Processes: sqlservr, sqlagent, msaccess, mysqld, oracle, python, node, java, Raccine, Sysmon...
In a threat posted to Pay2Key's data leak site, the threat actors have stated that Habana Labs has "72hrs to stop leaking process..."
33 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
40 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.