Pay2Key

aliases

Last seen:Mar 17, 2026

Intelligence Profile

Malware family tracked by Malpedia. ID: win.pay2key

Threat Analysis

Pay2Key is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

Intelligence Reports Mentioning Pay2Key

Iran-Linked Pay2Key Ransomware Group Re-Emerges

Infosecurity Magazine· Mar 26, 2026

Iran-linked ransomware gang targeted US healthcare org amid military conflict

The Record· Mar 24, 2026

External References

→https://research.checkpoint.com/2020/ransomware-alert-pay2key

→https://www.twitter.com/p2ktwtacc

→https://keybase.io/pay2key

→https://docs.google.com/spreadsheets/d/1MI8Z2tBhmqQ5X8Wf_ozv3dVjz5sJOs-3

→https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf

→https://research.checkpoint.com/2020/ransomware-alert-pay2key/

→https://twitter.com/TrendMicroRSRCH/status/1389422784808378370

→https://www.bleepingcomputer.com/news/security/intels-habana-labs-hacked-by-pay2key-ransomware-data-stolen/

→https://www.clearskysec.com/wp-content/uploads/2020/12/Pay2Kitten.pdf

→https://www.pwc.co.uk/cyber-security/pdf/pwc-cyber-threats-2020-a-year-in-retrospect.pdf

Quick Facts

TypeAPT / Threat Group

Aliases3

Also Known As

Cobaltwin.pay2keyPay2Key

External Intelligence

Malpedia: win.pay2key

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search Pay2Key