Iran-linked ransomware gang targeted US healthcare org amid military conflict

A U.S. healthcare organization was struck in late February by the Pay2Key ransomware; responders observed prior administrative account compromise, encryption, and attempts to clear logs. Investigators found no evidence of data exfiltration in this incident, but Halcyon and Beazley highlight Pay2Key's expanded activity (about 170 victims and ~$8M in ransoms) and potential Iranian government ties that suggest some attacks may be strategically destructive rather than solely financially motivated.