Iran-Linked Pay2Key Ransomware Group Re-Emerges

A new Halcyon/Beazley analysis describes a Pay2Key ransomware attack on a US healthcare provider that demonstrates enhanced evasion and anti-forensics: actors gained interactive access (TeamViewer), harvested credentials (Mimikatz, LaZagne, ExtPassword), scanned the network and interacted with Active Directory, enumerated backup solutions, and executed ransomware via a self-extracting 7zip (abc.exe), encrypting the target infrastructure in about three hours; the report notes political motivations, unclear ownership, ~$8M in ransoms tied to 170 victims, and advises ongoing monitoring and intelligence sharing.