Pay2Key
Pay2Key is an Iran-linked ransomware family and ransomware-as-a-service operation first observed in 2020 and repeatedly described as aligned with Iranian state interests, with reported ties to Fox Kitten/Pioneer Kitten and links to disruptive campaigns against Israeli, U.S., and other regional targets. Reporting in the provided content associates it with attacks on organizations in Israel, the United States, Azerbaijan, the United Arab Emirates, and Russia, including a late-February 2026 intrusion against a U.S. healthcare organization. It has also been described as targeting organizational servers, virtualization hosts, and cloud workloads via a Linux variant.
Its core capability is file encryption for extortion using strong cryptography. The content states Pay2Key can encrypt victim data using RSA and AES, while more recent technical analysis of a 2026 build describes a Mimic-based encryptor using per-file ChaCha20 keys protected with Curve25519/X25519 key exchange. The malware has been reported as based on Mimic, itself derived from the leaked Conti builder. In one observed incident it appended the .ywgulm_p2k extension and dropped ransom notes in Russian, English, and Spanish. A January 2026 sample used the internal name "payfast," while a February 2026 healthcare variant reportedly used the internal name "Cobalt."
The malware and its operators show significant emphasis on evasion, anti-forensics, and operational resilience. Multiple reports state Pay2Key has enhanced evasion, execution, and anti-forensics capabilities. Observed behavior includes clearing activity and event logs, self-deletion, and overwriting its own executable with zeros via fsutil before deleting it. In the February 2026 healthcare intrusion, operators reportedly disabled Microsoft Defender by falsely indicating a third-party antivirus product was active, inhibited recovery, and removed tooling after use. Technical analysis also notes use of the Windows Restart Manager API to unlock files, termination of numerous services and processes before encryption, and packaging in self-extracting 7z archives consistent with prior campaigns.
The content describes several intrusion and deployment patterns. In the 2026 healthcare case, attackers reportedly compromised an administrative account, remained in the environment for days, used TeamViewer for interactive access, harvested credentials with Mimikatz, LaZagne, and ExtPassword, enumerated hosts with Advanced IP Scanner and NetScan, interacted with Active Directory via dsa.msc, and then deployed the ransomware through a self-extracting archive named abc.exe. Separate reporting on Fluffy Wolf campaigns in Russia states Pay2Key was delivered through phishing emails themed as debts, reconciliation statements, or legal claims, using malicious RAR archives or GitHub-hosted downloads, alongside loaders such as PowerLoader and PureCrypter.
Pay2Key also includes command-and-control and pivoting functionality in the provided content. It has used RSA-encrypted communications with C2, sent its public key to the C2 server over TCP, and designated compromised machines as reverse-proxy pivot points to channel communications with C2.
A Linux variant, Pay2Key.I2, was first detected in the wild in late August 2025. It targets Linux infrastructure including servers, virtualization hosts, and cloud workloads; requires root privileges; disables SELinux and AppArmor; kills services and processes; enumerates mounted filesystems via /proc/mounts; persists via a cron entry to resume after reboot; and uses ChaCha20 encryption with obfuscated per-file metadata. The content also notes a hardcoded string, "DontDecompileMePlease," used in metadata handling.
Known high-confidence artifacts and indicators mentioned in the content include the ransom note path C:\temp\Decrypt_files.txt, the session key file C:\temp\session.tmp, the contact address ueli.maurer@onionmail.org, and hashes associated with a January 2026 build and its components: encryptor SHA256 2ae80e5bff8fc9055ce7dc60e59447cba6e6c3a215eea1b6de7d9cb5ae26f9e8, SFX loader SHA256 5e1ba287113770184fb51f0faed1a851d5066fa263a67a463da17601de82cb5a, encrypted payload SHA256 c45b87fff769379ebb9f4708438e208ee134692a2392a987205bfe900cceacb1, DC.exe SHA256 c576f7f55c4c0304b290b15e70a638b037df15c69577cd6263329c73416e490e, and xdel.exe SHA256 e8eaa39e2adfd49ab69d7bb8504ccb82a902c8b48fbc256472f36f41775e594c.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
When deploying the Pay2Key ransomware, the attackers employ heavy anti-forensic techniques to cover their tracks.
Early May 2021 saw another set of disruptive ransomware attacks attributed to Iran targeting Israel from the n3tw0rm ransomware group, a newly-identified threat actor with links to the 2020 Pay2Key attacks.
The disclosure comes as a U.S. healthcare organization was targeted in late February 2026 by Pay2Key, an Iranian ransomware gang with ties to the country's government. The ransomware-as-a-service (RaaS) operation, which has ties to the Fox Kitten group, first emerged in 2020.
Techniques & procedures
25 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
4 techniques
Initial Access
Halcyon and Beazley Security published a joint report detailing the attack chain: compromised admin credentials, a week of dormancy, TeamViewer for access...
Security researchers have uncovered a series of highly sophisticated Fluffy Wolf phishing attacks targeting Russian organizations across various critical sectors.
Persistence
2 techniques
Persistence
Privilege Escalation
2 techniques
Privilege Escalation
Stealth
4 techniques
Stealth
To remain hidden, the threat actors inject these payloads into trusted Windows processes such as RegAsm.exe, InstallUtil.exe, and MSBuild.exe.
For example, the ransomware uses the Windows fsutil command to overwrite its own executable file with zeros before completely deleting it.
Defense Impairment
1 technique
Defense Impairment
Credential Access
1 technique
Credential Access
Discovery
5 techniques
Discovery
The lineage is visible in the service and process kill lists. The encryptor terminates 60+ services and 40+ processes before encryption...
The content repeatedly describes malware and threat actors using commands and APIs such as ipconfig /all, ifconfig, arp -a, route print, nbtstat, netsh, GetAdaptersInfo, and GetIpNetTable to gather IP addresses, MAC addresses, DNS, DHCP, gateways, routing tables, ARP cache, proxy settings, domains, and network adapter/interface details.
The lineage is visible in the service and process kill lists. The encryptor terminates 60+ services and 40+ processes before encryption...
The content repeatedly describes malware and threat actors collecting host details such as OS version, hostname, architecture, CPU, memory, BIOS, domain, language, and other configuration data; e.g., "APT41 uses multiple built-in commands such as systeminfo and net config Workstation to enumerate victim system basic configuration information."
Collection
1 technique
Collection
Command and Control
6 techniques
Command and Control
Once PowerLoader infiltrates a target host, it spawns hidden PowerShell instances to retrieve additional malicious scripts directly from the command-and-control (C2) server. These scripts systematically deploy the final payloads...
Halcyon and Beazley Security published a joint report detailing the attack chain: compromised admin credentials, a week of dormancy, TeamViewer for access...
The content repeatedly describes malware and threat actors using SSL, TLS, HTTPS, RSA, AES, Blowfish, RC4, ECIES, Diffie-Hellman, OpenSSL, WolfSSL, and mutual TLS to protect command and control traffic.
Multiple malware families and intrusion sets are described as encrypting C2 traffic using SSL/TLS/HTTPS (e.g., "used HTTPS for command and control", "encrypts C2 communications with TLS", "uses SSL for encrypting C2 communications", "TLS-encrypted WebSocket Protocol (WSS) for C2"). | Examples include: "encrypts some C2 with RSA", "RSA encryption for C2 communications", "hard-coded RSA public key", "RSA-2048", "RSA-4096", and "REvil has encrypted C2 communications with the ECIES algorithm".
Exfiltration
1 technique
Exfiltration
Impact
2 techniques
Impact
В одном из изученных инцидентов атакующие также развернули в системе жертвы шифровальщик Pay2Key, основанный на вымогателе Mimic. Вредонос шифровал файлы, добавляя к ним расширение .ywgulm_p2k...
The encryptor terminates 60+ services and 40+ processes before encryption, including: Services: AcronisAgent, BackupExecJobEngine, CAARCUpdateSvc... | The encryptor terminates 60+ services and 40+ processes before encryption, including... Processes: sqlservr, sqlagent, msaccess, mysqld, oracle, python, node, java, Raccine, Sysmon...
IOCs tracked for this family
14 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
27 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware used by Fluffy Wolf for financial extortion; it uses anti-forensic behavior including overwriting its own executable with zeros via fsutil before deleting it.
Шифровальщик, развернутый в системе жертвы; шифрует файлы, добавляя расширение .ywgulm_p2k, и оставляет записку с требованием выкупа на русском, английском и испанском языках.
Iran-linked ransomware used against a U.S. healthcare organization.
Iran-linked ransomware used for disruptive and strategic operations, including against a US healthcare provider.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.