Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Pay2Key, an Iranian-backed ransomware-as-a-service operation, has re-emerged as Pay2Key.I2P, targeting Western organizations. Linked to the Fox Kitten APT group and collaborating with Mimic ransomware, the campaign has collected over $4 million in ransom payments in four months. The group offers an 80% profit share to affiliates supporting Iran or attacking its enemies, blending financial motivations with geopolitical objectives. Pay2Key.I2P employs sophisticated evasion techniques, including anti-analysis checks and obfuscation methods. The operation's strategic marketing on darknet forums and social media platforms indicates a planned rollout, with the addition of Linux-targeted ransomware expanding their attack surface.

Pay2Key.I2P represents the resurgence of the Iranian-backed ransomware-as-a-service (RaaS) operation known as Pay2Key, which has been linked to the Fox Kitten advanced persistent threat (APT) group. This campaign targets Western organizations with a dual motivation: financial gain and geopolitical objectives aligned with Iranian interests. The operation has reportedly amassed over $4 million in ransom payments within a four-month period, demonstrating both its effectiveness and scale. Pay2Key.I2P distinguishes itself through sophisticated evasion techniques, including anti-analysis checks and code obfuscation, which complicate detection and forensic analysis. The group’s strategic marketing efforts on darknet forums and social media platforms indicate a well-planned and ongoing rollout. Notably, the ransomware has expanded its attack surface by incorporating Linux-targeted payloads, increasing the range of potential victims beyond traditional Windows environments. The collaboration with Mimic ransomware suggests a coordinated approach to maximize impact and ransom collection. The tactics, techniques, and procedures (TTPs) associated with this campaign include credential dumping, process injection, obfuscation, defense evasion, and ransomware deployment, as indicated by the referenced MITRE ATT&CK techniques (e.g., T1489, T1553.002, T1140, T1036, T1055, T1486). Although no specific affected software versions or patches are identified, the campaign’s operational sophistication and geopolitical backing make it a persistent threat to critical infrastructure and enterprises in the West.

Detailed information about Pay2Key's Resurgence: Iranian Cyber Warfare Targets the West. Get real-time updates, technical details, and mitigation strategies.

Pay2Key's Resurgence: Iranian Cyber Warfare Targets the West - Live Threat Intelligence - Threat Radar | OffSeq.com

Pay2Key's Resurgence: Iranian Cyber Warfare Targets the West

Threats Tagged 'fox kitten'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'fox kitten'

Lead Pen Test Professional