Skip to main content
Darkfield

Operator dossier

Pay2Key is a ransomware operator no longer publishing new disclosures. Darkfield has indexed 7 public victims claimed by this operator between December 13, 2020 and September 9, 2021. Pay2Key is a relatively obscure ransomware group that emerged in December 2020 with a focused targeting approach primarily against Israeli organizations, suggesting potential geopolitical motivations alongside financial gain. The group's origin and affiliations remain largely undocumented by major security firms, though their concentrated focus on Israeli entities across information technology, telecommunications, and legal sectors indicates possible nation-state backing or politically motivated cybercriminal activity rather than operating as a traditional ransomware-as-a-service model. Limited public documentation exists regarding their specific attack methodologies, initial access vectors, or technical capabilities, though their successful compromise of at least seven documented victims across critical infrastructure and professional services sectors demonstrates operational competency. The group's notable campaigns have primarily involved targeting Israeli organizations, with security researchers noting their emergence during a period of heightened regional tensions, though specific details about ransom demands, victim names, or law enforcement responses remain largely unpublished in major threat intelligence reports. Current intelligence suggests Pay2Key has maintained a low profile with minimal public reporting on recent activities, making their operational status uncertain as of recent assessments.

Most-targeted sectors

Most-affected countries

Recent disclosures by Pay2Key

All 7 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for Pay2Key →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Inactive ransomware operator

← All groups

Pay2Key

7 victims indexed · first seen 6 years ago · last activity 5 years ago

7
Victims indexed
#229 of 364 tracked operators
9m
Active period
Dec 2020 → Sep 2021
1
Countries hit
top Israel · 1

At a glance

Status
inactive
First seen
6 years ago
Last activity
5 years ago
Onion sites
2 known endpoints
Primary sector
Information Technology · 1 hits

About

Pay2Key is a relatively obscure ransomware group that emerged in December 2020 with a focused targeting approach primarily against Israeli organizations, suggesting potential geopolitical motivations alongside financial gain. The group's origin and affiliations remain largely undocumented by major security firms, though their concentrated focus on Israeli entities across information technology, telecommunications, and legal sectors indicates possible nation-state backing or politically motivated cybercriminal activity rather than operating as a traditional ransomware-as-a-service model. Limited public documentation exists regarding their specific attack methodologies, initial access vectors, or technical capabilities, though their successful compromise of at least seven documented victims across critical infrastructure and professional services sectors demonstrates operational competency. The group's notable campaigns have primarily involved targeting Israeli organizations, with security researchers noting their emergence during a period of heightened regional tensions, though specific details about ransom demands, victim names, or law enforcement responses remain largely unpublished in major threat intelligence reports. Current intelligence suggests Pay2Key has maintained a low profile with minimal public reporting on recent activities, making their operational status uncertain as of recent assessments.

References

11 links

External sources curated by the MISP threat-intel community.

Timeline

2 months
2020-12-01T00:00:00+00:00 · 12021-09-01T00:00:00+00:00 · 6
2020-12-01T00:00:00+00:002021-09-01T00:00:00+00:00

Top countries

🇮🇱 Israel
1
Israel dossier →

Top sectors

Information Technology
1
Telecommunications
1
Legal
1
Information Technology dossier →Telecommunications dossier →Legal dossier →

MITRE ATT&CK

4 techniques · 4 tactics

Tactics

Initial AccessExecutionDefense EvasionImpact

Techniques

  • T1566Phishing
  • T1059Command and Scripting Interpreter
  • T1027Obfuscated Files or Information
  • T1486Data Encrypted for Impact

Recent victims

Loading…

Onion infrastructure

2 known
  • http://pay2key2zkg7arp3kv3cuugdaqwuesifnbofun4j6yjdw5ry7zw2asid.onion
  • http://pay2key2zkg7arp3kv3cuugdaqwuesifnbofun4j6yjdw5ry7zw2asid.onion/

Source

Updated 5 years ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time Pay2Key posts a victim.

Add Pay2Key to your watchlist — Pro pings you within 5 minutes of any new Pay2Key leak-site post, Telegram callout, or affiliate-rebrand inference.