Iranian Ransomware Crew Blurs the Line Between Profit and Proxy Attacks

Pay2Key.I2P is an active Iranian-linked Ransomware-as-a-Service operation that has reportedly collected over $4 million and executed 50+ attacks; it is incentivizing affiliates (offering up to 80% payouts) to target U.S. and Israeli organizations, appears to collaborate with other ransomware operators (including Mimic), and uses wipers disguised as ransomware—illustrating a hybrid state-aligned and financially motivated threat.