Pay2Key’s New Linux Ransomware Strips Server Defenses to Hijack x64 and ARM64 Infrastructure

Morphisec Threat Labs' analysis describes Pay2Key.I2P, a sophisticated Linux ransomware variant delivered via a shell script that fingerprints CPU architecture and drops dual-architecture binaries (x64 and ARM64). The malware enforces root privileges, disables defenses (SELinux/AppArmor), creates persistence via cron jobs, stops services/processes defined in config, and uses ChaCha20 with sampled encryption to accelerate damage; the report warns this productized, maintained tool can rapidly cripple enterprise servers and recommends prevention-first controls.