Loading story…
Intel-owned AI chip developer Habana Labs was breached by the Pay2Key ransomware operation, which stole data and began leaking it publicly after giving the company a reported 72-hour deadline to halt the release. Material described as exposed included Windows domain account information, DNS zone data, a file listing from Habana Labs' Gerrit code review system, business documents, and images related to source code.
The intrusion was reported amid a broader run of attacks targeting Israeli organizations, and security researchers cited in reporting said Pay2Key appeared focused on disruption as much as financial extortion. Assessments referenced by incident responders and threat research linked the ransomware activity to actors potentially aligned with Iranian interests, underscoring concern that the operation blended data theft, public leaking, and ransomware pressure against Israeli-linked targets.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
Pay2Key was linked to a series of attacks against Israeli businesses, according to reporting cited in the source. Check Point and Profero reported on this wave, and Profero assessed that Iranian threat actors were behind the operation.
Intel acquired Israeli AI processor developer Habana Labs for approximately $2 billion. This acquisition established Habana Labs as an Intel-owned company before the later ransomware incident.
After leaking Habana Labs data, Pay2Key posted a threat stating that the company had 72 hours to stop the leaking process. The source noted that any ransom demand made to Habana Labs was unknown.
Intel-owned Habana Labs suffered a cyberattack in which data was stolen and later leaked by the Pay2Key ransomware operation. The exposed material allegedly included Windows domain account information, DNS zone information, Gerrit file listings, business documents, and source code images.
A separate threat actor, BlackShadow, carried out a cyberattack against Israeli insurance company Shirbit. In that incident, data was stolen and leaked, though the source said it was unknown whether it was linked to Pay2Key.
Israeli media reported that threat actors breached shipping and cargo software company Amital. The breach reportedly enabled a supply-chain attack affecting forty of Amital's clients, and Profero and Security Joes linked related indicators to previous Pay2Key attacks.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Check Point researchers reported that the **Pay2Key** ransomware operation targeted Israeli organizations and showed multiple indicators of Iranian involvement, including overlaps with known Iranian threat activity and infrastructure. The malware was delivered through network intrusions and used to encrypt victim systems while demanding cryptocurrency payments, marking one of the clearer examples of ransomware being used against regional targets with suspected geopolitical intent rather than purely criminal motives. Later reporting described the same Iranian ransomware ecosystem as increasingly blurring the line between financially motivated extortion and proxy cyber operations. The group associated with **Pay2Key** was portrayed as operating in a hybrid model, combining conventional ransomware tactics with state-aligned targeting and objectives, reinforcing assessments that Iranian operators have used ransomware both to generate revenue and to support broader strategic campaigns against adversaries.
Jul 12, 2026
An Iran-linked **Pay2Key** ransomware operation targeted a U.S. healthcare organization after compromising an administrative account and remaining in the environment for several days before encrypting systems. Investigators from **Beazley Security** and **Halcyon** said the attackers also cleared activity and event logs in an apparent effort to erase evidence, and found no signs of data exfiltration despite earlier U.S. intelligence linking Pay2Key primarily to information theft. Researchers said the intrusion reflects a more destructive and covert use of Pay2Key amid heightened U.S.-Iran military tensions, with the group increasingly assessed as pursuing strategic disruption rather than purely financial gain. Halcyon warned that additional U.S. organizations may already have been affected by Iranian cyber activity, including ransomware, wiper-style attacks, and efforts to exploit unpatched vulnerabilities, while Pay2Key has also expanded as a ransomware-as-a-service operation with recruitment on Russian cybercrime forums, roughly 170 attributed victims, and about **$8 million** in ransom payments since summer 2025.
Jun 29, 2026
Leaked documents reviewed by Flashpoint indicate that Iranian contractor **Emen Net Pasargard (ENP)** ran a state-sponsored ransomware effort dubbed **Project Signal** on behalf of the **Islamic Revolutionary Guard Corps (IRGC)**. The material shows the operation progressing from reconnaissance by ENP’s Studies Center in mid-2020 to execution by its Cyber Directorate, with ransomware attacks beginning in late October 2020. The workflow included Bitcoin payment and decryption procedures, suggesting the campaign may have blended real extortion with an effort to disguise state activity as ordinary criminal ransomware; Flashpoint also noted similarities in timing and tradecraft to the Iran-linked **Pay2Key** campaign targeting Israeli organizations, while stopping short of confirming a direct connection. Separate reporting from Symantec described the sustained activity of **Elfin**/**APT33**, an Iran-linked espionage group that targeted at least 50 organizations across Saudi Arabia, the United States, and other countries in sectors including chemical, engineering, finance, telecoms, healthcare, and manufacturing. The group used spear-phishing, credential theft, commodity RATs, custom malware, and public tools, and in one case attempted to exploit **`CVE-2018-20250`** in WinRAR against a Saudi chemical-sector target. Together, the reports show Iranian operators using both long-term intrusion tradecraft for intelligence collection and ransomware-style operations that can support disruption, coercion, or plausible deniability.
Aug 15, 2026