A ransomware group with ties to Iran breached a US healthcare provider in the run-up to the Iran war, according to a report from cybersecurity firm Halcyon. The group, tracked under the name Pay2Key, gained access to a compromised administrative account and held it for several days before encrypting it.
Investigators from Halcyon and Beazley Security found no evidence that any data was taken, a departure from the group's usual pattern. Researchers reading the incident say Pay2Key may be shifting from extortion toward outright destruction, and that its attention has moved toward US targets after years spent mostly on Israeli systems.
“The attack was notable for its use of stealthy encryption without data exfiltration,” Johnny Collins, Halcyon's director of intelligence operations, told Cybersecurity Dive. “Pay2Key has not been dormant but has actively shifted to targeting U.S. organizations.”
Following the launch of the American-Israeli bombing campaign in late February, Iran-linked actors have stepped up activity against US, Israeli and other Middle Eastern targets. Earlier this month, a separate state-linked group called Handala briefly disrupted ordering, manufacturing and shipping at Stryker, a large US medical device maker.
Pay2Key first surfaced in 2020, when Check Point Research and blockchain-intelligence firm Whitestream uncovered a wave of ransomware attacks against Israeli companies built on a previously unknown strain. Most of its ransom payments moved through an Iranian firm called Excoino, which required an Iranian national ID to open an account, according to Halcyon.
By 2024, the FBI, the Cybersecurity and Infrastructure Security Agency and the Department of Defense had issued a joint advisory on the group, which also operates under the name Fox Kitten. Its targets have included schools, defense contractors, healthcare providers and municipal governments, often in partnership with other ransomware operators it pays more than 70 percent of the proceeds.
Sergey Shykevich, a threat intelligence group manager at Check Point Research, takes a more cautious view of the Iran connection than Halcyon does. “While Pay2Key was previously associated with Iranian operations, since the beginning of 2025 it has been promoted as a ransomware-as-a-service offering on Russian underground forums,” he told Cybersecurity Dive. “Currently, we do not have clear indications linking its activity to Iran.”
That shift toward a rental model on Russian cybercrime forums began last year, when the group started advertising its own infrastructure for other operators to use. It was also unusually active during the twelve-day bombing campaign the United States and Israel carried out in 2025, according to Halcyon, though that alone does not resolve whether Tehran still directs it or merely benefits from operators who once did.
Separately, Morphisec has tracked a four-month stretch in which the group collected about $4 million from 51 ransom payments, activity that continued while researchers still debate how closely, if at all, its current operations run through Tehran.
Leave a Reply