Pay2Key

Pay2Key is an Iran-linked ransomware family and ransomware-as-a-service operation first observed in 2020 and repeatedly described as aligned with Iranian state interests, with reported ties to Fox Kitten/Pioneer Kitten and links to disruptive campaigns against Israeli, U.S., and other regional targets. Reporting in the provided content associates it with attacks on organizations in Israel, the United States, Azerbaijan, the United Arab Emirates, and Russia, including a late-February 2026 intrusion against a U.S. healthcare organization. It has also been described as targeting organizational servers, virtualization hosts, and cloud workloads via a Linux variant.

Its core capability is file encryption for extortion using strong cryptography. The content states Pay2Key can encrypt victim data using RSA and AES, while more recent technical analysis of a 2026 build describes a Mimic-based encryptor using per-file ChaCha20 keys protected with Curve25519/X25519 key exchange. The malware has been reported as based on Mimic, itself derived from the leaked Conti builder. In one observed incident it appended the .ywgulm_p2k extension and dropped ransom notes in Russian, English, and Spanish. A January 2026 sample used the internal name "payfast," while a February 2026 healthcare variant reportedly used the internal name "Cobalt."

The malware and its operators show significant emphasis on evasion, anti-forensics, and operational resilience. Multiple reports state Pay2Key has enhanced evasion, execution, and anti-forensics capabilities. Observed behavior includes clearing activity and event logs, self-deletion, and overwriting its own executable with zeros via fsutil before deleting it. In the February 2026 healthcare intrusion, operators reportedly disabled Microsoft Defender by falsely indicating a third-party antivirus product was active, inhibited recovery, and removed tooling after use. Technical analysis also notes use of the Windows Restart Manager API to unlock files, termination of numerous services and processes before encryption, and packaging in self-extracting 7z archives consistent with prior campaigns.

The content describes several intrusion and deployment patterns. In the 2026 healthcare case, attackers reportedly compromised an administrative account, remained in the environment for days, used TeamViewer for interactive access, harvested credentials with Mimikatz, LaZagne, and ExtPassword, enumerated hosts with Advanced IP Scanner and NetScan, interacted with Active Directory via dsa.msc, and then deployed the ransomware through a self-extracting archive named abc.exe. Separate reporting on Fluffy Wolf campaigns in Russia states Pay2Key was delivered through phishing emails themed as debts, reconciliation statements, or legal claims, using malicious RAR archives or GitHub-hosted downloads, alongside loaders such as PowerLoader and PureCrypter.

Pay2Key also includes command-and-control and pivoting functionality in the provided content. It has used RSA-encrypted communications with C2, sent its public key to the C2 server over TCP, and designated compromised machines as reverse-proxy pivot points to channel communications with C2.

A Linux variant, Pay2Key.I2, was first detected in the wild in late August 2025. It targets Linux infrastructure including servers, virtualization hosts, and cloud workloads; requires root privileges; disables SELinux and AppArmor; kills services and processes; enumerates mounted filesystems via /proc/mounts; persists via a cron entry to resume after reboot; and uses ChaCha20 encryption with obfuscated per-file metadata. The content also notes a hardcoded string, "DontDecompileMePlease," used in metadata handling.

Known high-confidence artifacts and indicators mentioned in the content include the ransom note path C:\temp\Decrypt_files.txt, the session key file C:\temp\session.tmp, the contact address ueli.maurer@onionmail.org, and hashes associated with a January 2026 build and its components: encryptor SHA256 2ae80e5bff8fc9055ce7dc60e59447cba6e6c3a215eea1b6de7d9cb5ae26f9e8, SFX loader SHA256 5e1ba287113770184fb51f0faed1a851d5066fa263a67a463da17601de82cb5a, encrypted payload SHA256 c45b87fff769379ebb9f4708438e208ee134692a2392a987205bfe900cceacb1, DC.exe SHA256 c576f7f55c4c0304b290b15e70a638b037df15c69577cd6263329c73416e490e, and xdel.exe SHA256 e8eaa39e2adfd49ab69d7bb8504ccb82a902c8b48fbc256472f36f41775e594c.