Emerging Threat Actor Targets Israeli Private Sector with Pay2Key Ransomware

A series of targeted ransomware attacks hit multiple Israeli corporations in late October and early November 2020, using a previously unknown strain called Pay2Key. Attackers broke in via RDP, spread the ransomware across entire networks within about an hour, and demanded Bitcoin payments to restore access. Check Point Research identified Pay2Key as a new, custom-built ransomware under active development, and linked the campaign to what MITRE ATT&CK tracks as the Fox Kitten threat group.

The attacker behind Pay2Key remains unidentified by name, but several clues point to an Iranian-linked actor. The ransomware code contains non-native English strings, the attacker created a KeyBase account months before the first attack, and MITRE ATT&CK attributes this activity to Fox Kitten (G0117), an Iranian state-aligned group known for targeting Israeli and other regional organizations. The campaign appears financially motivated, though the relatively modest ransom demands and tight geographic focus on Israel are consistent with a politically oriented operator supplementing state activity.

Pay2Key is a financially motivated ransomware operation. After encrypting a victim's entire network, attackers dropped a customized ransom note demanding 7 to 9 Bitcoin — roughly $110,000 to $140,000 at the time — in exchange for the decryption key. Each note was tailored with the victim organization's name, including custom ASCII art. While the ransom notes mentioned data theft in the style of double-extortion ransomware, Check Point found no evidence that data was actually exfiltrated.

At the time of Check Point's report, multiple large Israeli corporations had been hit within the span of just a few days. The attacks were narrowly focused on the Israeli private sector, though Check Point noted the attacker's TTPs showed no technical barrier to targeting organizations outside Israel. The campaign was notable for its speed — attackers were able to encrypt an entire corporate network within approximately one hour of gaining initial access.

All confirmed victims were Israeli private sector companies across various industries. The source does not identify specific sectors, but describes the targets as "large corporations." The shared characteristic is their Israeli identity and internet-exposed RDP infrastructure, rather than any particular industry vertical.

Attackers connected to a target network via RDP, then deployed ConnectPC.exe on the entry machine to act as an internal proxy — routing all ransomware communications through that single host rather than directly to the attacker's server. This kept outbound network traffic low and hid the true C2 address. PsExec was then used to push the Pay2Key ransomware binary (Cobalt.Client.exe) and a configuration file to every machine in the network. Once running, Pay2Key contacted the C2 server to receive an RSA public key, then encrypted files using a hybrid AES+RSA scheme. After encryption completed, a self-cleanup mechanism removed attacker artifacts and rebooted the machine, leaving a customized ransom note on each system.

Israeli private sector companies represent attractive targets for both financial and geopolitical reasons. From a financial angle, large corporations with operational dependencies are more likely to pay ransoms quickly to restore services. From a geopolitical angle, the attacker's tight focus on Israel — combined with the Fox Kitten attribution — suggests the campaign may serve dual purposes: generating revenue while simultaneously disrupting Israeli business operations as a secondary objective.