Loading story…
An Iran-linked Pay2Key ransomware operation targeted a U.S. healthcare organization after compromising an administrative account and remaining in the environment for several days before encrypting systems. Investigators from Beazley Security and Halcyon said the attackers also cleared activity and event logs in an apparent effort to erase evidence, and found no signs of data exfiltration despite earlier U.S. intelligence linking Pay2Key primarily to information theft.
Researchers said the intrusion reflects a more destructive and covert use of Pay2Key amid heightened U.S.-Iran military tensions, with the group increasingly assessed as pursuing strategic disruption rather than purely financial gain. Halcyon warned that additional U.S. organizations may already have been affected by Iranian cyber activity, including ransomware, wiper-style attacks, and efforts to exploit unpatched vulnerabilities, while Pay2Key has also expanded as a ransomware-as-a-service operation with recruitment on Russian cybercrime forums, roughly 170 attributed victims, and about $8 million in ransom payments since summer 2025.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Beazley Security and the Halcyon Ransomware Research Center disclosed their investigation linking the late-February attack on a U.S. healthcare organization to an Iranian ransomware gang tied to Pay2Key, and highlighted the group's more covert and destructive tradecraft.
Days after the initial compromise, the attackers encrypted the healthcare organization's environment with Pay2Key ransomware and attempted to erase evidence by deleting activity and event logs. Investigators found no evidence of data exfiltration in this incident.
In late February 2026, attackers linked to the Iran-associated Pay2Key operation gained access to a U.S. healthcare organization by compromising an administrative account and remained in the environment for several days.
Researchers assessed that Pay2Key activity increased following the U.S.-Iran military conflict, suggesting a shift toward more strategic and destructive operations beyond typical profit-driven ransomware.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
go.theregister.com
Open sourcescworld.com
Open sourcetherecord.media
Open sourcelabs.beazley.security
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Check Point researchers reported that the **Pay2Key** ransomware operation targeted Israeli organizations and showed multiple indicators of Iranian involvement, including overlaps with known Iranian threat activity and infrastructure. The malware was delivered through network intrusions and used to encrypt victim systems while demanding cryptocurrency payments, marking one of the clearer examples of ransomware being used against regional targets with suspected geopolitical intent rather than purely criminal motives. Later reporting described the same Iranian ransomware ecosystem as increasingly blurring the line between financially motivated extortion and proxy cyber operations. The group associated with **Pay2Key** was portrayed as operating in a hybrid model, combining conventional ransomware tactics with state-aligned targeting and objectives, reinforcing assessments that Iranian operators have used ransomware both to generate revenue and to support broader strategic campaigns against adversaries.
Jul 12, 2026
Intel-owned AI chip developer **Habana Labs** was breached by the **Pay2Key** ransomware operation, which stole data and began leaking it publicly after giving the company a reported 72-hour deadline to halt the release. Material described as exposed included **Windows domain account information**, **DNS zone data**, a file listing from Habana Labs' **Gerrit** code review system, business documents, and images related to source code. The intrusion was reported amid a broader run of attacks targeting Israeli organizations, and security researchers cited in reporting said **Pay2Key** appeared focused on disruption as much as financial extortion. Assessments referenced by incident responders and threat research linked the ransomware activity to actors potentially aligned with **Iranian interests**, underscoring concern that the operation blended data theft, public leaking, and ransomware pressure against Israeli-linked targets.
Aug 14, 2026
Leaked documents reviewed by Flashpoint indicate that Iranian contractor **Emen Net Pasargard (ENP)** ran a state-sponsored ransomware effort dubbed **Project Signal** on behalf of the **Islamic Revolutionary Guard Corps (IRGC)**. The material shows the operation progressing from reconnaissance by ENP’s Studies Center in mid-2020 to execution by its Cyber Directorate, with ransomware attacks beginning in late October 2020. The workflow included Bitcoin payment and decryption procedures, suggesting the campaign may have blended real extortion with an effort to disguise state activity as ordinary criminal ransomware; Flashpoint also noted similarities in timing and tradecraft to the Iran-linked **Pay2Key** campaign targeting Israeli organizations, while stopping short of confirming a direct connection. Separate reporting from Symantec described the sustained activity of **Elfin**/**APT33**, an Iran-linked espionage group that targeted at least 50 organizations across Saudi Arabia, the United States, and other countries in sectors including chemical, engineering, finance, telecoms, healthcare, and manufacturing. The group used spear-phishing, credential theft, commodity RATs, custom malware, and public tools, and in one case attempted to exploit **`CVE-2018-20250`** in WinRAR against a Saudi chemical-sector target. Together, the reports show Iranian operators using both long-term intrusion tradecraft for intelligence collection and ransomware-style operations that can support disruption, coercion, or plausible deniability.
Aug 15, 2026