Pay2Key Ransomware Expands to Linux, Targeting Enterprise and Cloud Infrastructure The Linux-focused ransomware strain Pay2Key, previously known for Windows-based attacks on Israeli and Brazilian organizations, has evolved into a ransomware-as-a-service (RaaS) operation with explicit support for Linux environments. Recent research reveals that its latest builders now include Linux payload options, enabling affiliates to generate customized encryptors for Linux servers, VMware ESXi hypervisors, and cloud workloads aligning with a broader trend of ransomware targeting high-value infrastructure. Linked to Iranian-backed threat actors, Pay2Key has shifted from on-premises corporate networks to financial systems, SAP databases, and virtualization platforms. Its RaaS model expands the pool of attackers capable of compromising critical enterprise assets. ### Technical Execution The Linux variant operates via a configuration-driven binary requiring root privileges. Key features include: - Fine-grained targeting via JSON configurations, specifying paths, file types, and mount classes for encryption. - Pre-encryption sabotage, including stopping services, killing processes, and disabling SELinux/AppArmor to evade detection. - Persistence mechanisms, such as cron jobs that ensure encryption resumes after reboots. - Selective encryption, skipping ELF/MZ binaries and zero-length files to avoid system crashes while maximizing damage to business data. - ChaCha20 encryption (full or partial modes), with per-file keys stored in obfuscated metadata to hinder recovery. ### Impact on Enterprise and Cloud Systems Pay2Key’s Linux variant is optimized for application servers, virtualization hosts, and cloud storage, with a particular focus on ESXi infrastructure. A single compromised hypervisor can trigger cascading outages across dozens or hundreds of guest VMs. Attackers also prioritize financial applications and databases, amplifying operational disruption and ransom leverage. Cloud and DevOps environments are increasingly at risk, as threat actors exploit misconfigurations, over-privileged service accounts, and CI/CD pipeline gaps to deploy ransomware in Kubernetes clusters and containerized workloads. Traditional EDR and signature-based defenses often fail to detect in-memory or script-driven attacks, leaving defenders with minimal response windows once root access is gained. The evolution of Pay2Key underscores that Linux is now a primary ransomware target, requiring organizations to implement strict access controls, least-privilege policies, and purpose-built detection mechanisms to mitigate risks.

Pay2Key Linux Ransomware Targets Servers, Virtualization, and Cloud Environments A new Linux-based ransomware variant, developed by the Iranian-linked threat group Pay2Key, is actively compromising organizational infrastructure. First detected in late August 2025, the malware prioritizes speed, scalability, and reliability over stealth, distinguishing it from traditional ransomware that typically targets desktop systems. Unlike conventional attacks, Pay2Key’s Linux strain directly targets servers, virtualization hosts, and cloud workloads critical components of enterprise operations. The shift to infrastructure-layer attacks underscores a growing trend of ransomware groups expanding beyond Windows environments, challenging Linux’s long-held reputation for security. The campaign highlights the evolving tactics of state-aligned threat actors, who are increasingly focusing on high-impact, high-value targets to maximize disruption and ransom potential. Organizations relying on Linux-based systems for core operations may face heightened risk as this threat continues to develop.