Reddit NetSec

AlienVault OTX General

CVE Database V5

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Pay2Key, an Iranian-backed ransomware-as-a-service operation, has re-emerged as Pay2Key.I2P, targeting Western organizations. Linked to the Fox Kitten APT group and collaborating with Mimic ransomware, the campaign has collected over $4 million in ransom payments in four months. The group offers an 80% profit share to affiliates supporting Iran or attacking its enemies, blending financial motivations with geopolitical objectives. Pay2Key.I2P employs sophisticated evasion techniques, including anti-analysis checks and obfuscation methods. The operation's strategic marketing on darknet forums and social media platforms indicates a planned rollout, with the addition of Linux-targeted ransomware expanding their attack surface.

Pay2Key.I2P represents the resurgence of the Iranian-backed ransomware-as-a-service (RaaS) operation known as Pay2Key, which has been linked to the Fox Kitten advanced persistent threat (APT) group. This campaign targets Western organizations with a dual motivation: financial gain and geopolitical objectives aligned with Iranian interests. The operation has reportedly amassed over $4 million in ransom payments within a four-month period, demonstrating both its effectiveness and scale. Pay2Key.I2P distinguishes itself through sophisticated evasion techniques, including anti-analysis checks and code obfuscation, which complicate detection and forensic analysis. The group’s strategic marketing efforts on darknet forums and social media platforms indicate a well-planned and ongoing rollout. Notably, the ransomware has expanded its attack surface by incorporating Linux-targeted payloads, increasing the range of potential victims beyond traditional Windows environments. The collaboration with Mimic ransomware suggests a coordinated approach to maximize impact and ransom collection. The tactics, techniques, and procedures (TTPs) associated with this campaign include credential dumping, process injection, obfuscation, defense evasion, and ransomware deployment, as indicated by the referenced MITRE ATT&CK techniques (e.g., T1489, T1553.002, T1140, T1036, T1055, T1486). Although no specific affected software versions or patches are identified, the campaign’s operational sophistication and geopolitical backing make it a persistent threat to critical infrastructure and enterprises in the West.

Detailed information about Pay2Key's Resurgence: Iranian Cyber Warfare Targets the West. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'fox kitten'

Filter Threats

Threats Tagged 'fox kitten'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility