Loading story…
Check Point researchers reported that the Pay2Key ransomware operation targeted Israeli organizations and showed multiple indicators of Iranian involvement, including overlaps with known Iranian threat activity and infrastructure. The malware was delivered through network intrusions and used to encrypt victim systems while demanding cryptocurrency payments, marking one of the clearer examples of ransomware being used against regional targets with suspected geopolitical intent rather than purely criminal motives.
Later reporting described the same Iranian ransomware ecosystem as increasingly blurring the line between financially motivated extortion and proxy cyber operations. The group associated with Pay2Key was portrayed as operating in a hybrid model, combining conventional ransomware tactics with state-aligned targeting and objectives, reinforcing assessments that Iranian operators have used ransomware both to generate revenue and to support broader strategic campaigns against adversaries.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Halcyon published reporting that an Iranian ransomware crew blurred the line between financially motivated ransomware and proxy-style state-aligned attacks. The report reflects a later attribution and framing of the threat as combining criminal and geopolitical objectives.
Check Point Research published analysis of the Pay2Key ransomware operation, describing it as an active threat and detailing its tactics and development. This establishes Pay2Key as a distinct ransomware campaign under public scrutiny.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
An Iran-linked **Pay2Key** ransomware operation targeted a U.S. healthcare organization after compromising an administrative account and remaining in the environment for several days before encrypting systems. Investigators from **Beazley Security** and **Halcyon** said the attackers also cleared activity and event logs in an apparent effort to erase evidence, and found no signs of data exfiltration despite earlier U.S. intelligence linking Pay2Key primarily to information theft. Researchers said the intrusion reflects a more destructive and covert use of Pay2Key amid heightened U.S.-Iran military tensions, with the group increasingly assessed as pursuing strategic disruption rather than purely financial gain. Halcyon warned that additional U.S. organizations may already have been affected by Iranian cyber activity, including ransomware, wiper-style attacks, and efforts to exploit unpatched vulnerabilities, while Pay2Key has also expanded as a ransomware-as-a-service operation with recruitment on Russian cybercrime forums, roughly 170 attributed victims, and about **$8 million** in ransom payments since summer 2025.
Jun 29, 2026
Intel-owned AI chip developer **Habana Labs** was breached by the **Pay2Key** ransomware operation, which stole data and began leaking it publicly after giving the company a reported 72-hour deadline to halt the release. Material described as exposed included **Windows domain account information**, **DNS zone data**, a file listing from Habana Labs' **Gerrit** code review system, business documents, and images related to source code. The intrusion was reported amid a broader run of attacks targeting Israeli organizations, and security researchers cited in reporting said **Pay2Key** appeared focused on disruption as much as financial extortion. Assessments referenced by incident responders and threat research linked the ransomware activity to actors potentially aligned with **Iranian interests**, underscoring concern that the operation blended data theft, public leaking, and ransomware pressure against Israeli-linked targets.
Aug 14, 2026
Leaked documents reviewed by Flashpoint indicate that Iranian contractor **Emen Net Pasargard (ENP)** ran a state-sponsored ransomware effort dubbed **Project Signal** on behalf of the **Islamic Revolutionary Guard Corps (IRGC)**. The material shows the operation progressing from reconnaissance by ENP’s Studies Center in mid-2020 to execution by its Cyber Directorate, with ransomware attacks beginning in late October 2020. The workflow included Bitcoin payment and decryption procedures, suggesting the campaign may have blended real extortion with an effort to disguise state activity as ordinary criminal ransomware; Flashpoint also noted similarities in timing and tradecraft to the Iran-linked **Pay2Key** campaign targeting Israeli organizations, while stopping short of confirming a direct connection. Separate reporting from Symantec described the sustained activity of **Elfin**/**APT33**, an Iran-linked espionage group that targeted at least 50 organizations across Saudi Arabia, the United States, and other countries in sectors including chemical, engineering, finance, telecoms, healthcare, and manufacturing. The group used spear-phishing, credential theft, commodity RATs, custom malware, and public tools, and in one case attempted to exploit **`CVE-2018-20250`** in WinRAR against a Saudi chemical-sector target. Together, the reports show Iranian operators using both long-term intrusion tradecraft for intelligence collection and ransomware-style operations that can support disruption, coercion, or plausible deniability.
Aug 15, 2026