Pay2Key Ransomware Attack: Companies in Europe and Israel at Risk

Pay2Key is a custom ransomware strain that targeted companies in both Europe and Israel in late October 2020. Attackers broke into networks through internet-exposed services, spread the ransomware across entire organizations using standard IT tools, and demanded Bitcoin payments to restore access. Swascan's security team was among the first to respond to incidents and document the malware, while Check Point Research simultaneously covered attacks on Israeli companies. The campaign represents an early example of rapid, targeted ransomware operations against specific geographic regions.

The attacker's identity remains unconfirmed, though several indicators point toward an Iranian-linked actor. The ransomware's internal code contains non-native English strings, the Pay2Key Keybase account was created months before the attacks began, and MITRE ATT&CK links this activity to Fox Kitten (G0117), an Iranian state-aligned group with a history of targeting Israeli organizations. The campaign appears financially motivated, though its tight focus on Israel and Europe may also serve geopolitical objectives.

Pay2Key is a financially motivated ransomware operation. After encrypting victims' files, attackers demanded between $100,000 and $200,000 in Bitcoin — scaled to the company's size and the number of devices compromised. Each victim received a customized ransom note with their organization's name. While the ransom notes mentioned data theft, Swascan and Check Point found no concrete evidence that data was actually exfiltrated.

The campaign hit companies across Europe and Israel simultaneously, with Swascan responding to European incidents and Check Point covering Israeli targets. Multiple large corporations were affected within days of each other. The attacker's infrastructure suggests pre-operational access dating to October 20, 2020 — a week before the first publicly reported attacks. The speed of the campaign was notable: full-network encryption completed in roughly three hours after the ransomware was deployed.

Confirmed victims were private sector companies across Europe and Israel. Neither Swascan nor Check Point identify specific industries, describing targets broadly as companies and corporations. The common factor appears to be internet-facing infrastructure with exposed RDP or vulnerable services, rather than any particular sector or size threshold — though the ransom scaling by company size and device count suggests the attacker sought out larger organizations.

Attackers first accessed a victim's network via an exposed internet-facing service, then used RDP to connect directly to machines. They deployed ConnectPC.exe as an internal proxy to route all ransomware communications through a single compromised host, hiding the true C2 server. PsExec spread Cobalt.Client.exe across the network. Swascan's forensic investigation also found Ngrok hidden as dllhost.exe — likely installed as a persistent backdoor for ongoing access independent of the ransomware. Once the ransomware ran, it contacted the C2 for an RSA key, encrypted files using AES+RSA, and removed itself after completion. Full-network encryption finished in approximately three hours.

European and Israeli companies with internet-exposed infrastructure are attractive targets for financially motivated attackers seeking large ransom payouts. The attacker scaled demands by company size, suggesting deliberate targeting of organizations large enough to pay six-figure ransoms quickly to restore operations. For an Iranian-linked actor like Fox Kitten, Israeli targets may also carry geopolitical value beyond the financial return.