Pay2Key's Resurgence: Iranian Cyber Warfare Targets the West
Essential information
- Published
- 10/07/2025 18:31
- Modified
- 13/07/2025 12:04
- Tags
- 2025-07-10 cyber warfare evasion techniques fox kitten mimic pay2key raas ransomware
- Related entities
- 25 observables, 1 intrusion sets (apt), 7 techniques (mitre)
Description
Pay2Key, an Iranian-backed ransomware-as-a-service operation, has re-emerged as Pay2Key.I2P, targeting Western organizations. Linked to the Fox Kitten APT group and collaborating with Mimic ransomware, the campaign has collected over $4 million in ransom payments in four months. The group offers an 80% profit share to affiliates supporting Iran or attacking its enemies, blending financial motivations with geopolitical objectives. Pay2Key.I2P employs sophisticated evasion techniques, including anti-analysis checks and obfuscation methods. The operation's strategic marketing on darknet forums and social media platforms indicates a planned rollout, with the addition of Linux-targeted ransomware expanding their attack surface.