Pay2Key

Description

Pay2Key is a C++ ransomware family that the Fox Kitten threat actor has used since at least July 2020, including campaigns against Israeli companies. Its operations pair encryption with a leak site that displays stolen sensitive information to pressure victims into paying.

Stats

First seen: May 2022
Last seen: October 2026

Also known as

Pay2key

MITRE ATT&CK techniques

8 techniques across 4 tactics.

TA0005 Stealth

T1070Indicator Removal
- T1070.004File Deletion

TA0007 Discovery

T1016System Network Configuration Discovery
T1082System Information Discovery

TA0011 Command and Control

T1090Proxy
- T1090.001Internal Proxy
T1095Non-Application Layer Protocol
T1573Encrypted Channel
- T1573.002Asymmetric Cryptography

TA0040 Impact

T1486Data Encrypted for Impact
T1489Service Stop

Associated groups

G0117Fox Kitten

Alert name variants

Alert Name	Engine
Document-HTML.Trojan.Pay2key	ATP Sandbox Adv. Heuristics
Gen:Variant.Ransom.Pay2Key.1	AV
Gen:Variant.Ransom.Pay2Key.4	AV
Win32.Ransomware.Pay2key	ATP Sandbox Adv. Heuristics
Win32.Ransomware.Pay2Key	ATP Sandbox Adv. Heuristics
Win32.Trojan.Pay2key	ATP Sandbox Adv. Heuristics

Related families

REvil InvisiMole Qilin Royal Gomir