Pay2Key Ransomware Expands to Linux, Targeting Enterprise and Cloud Infrastructure The Linux-focused ransomware strain Pay2Key, previously known for Windows-based attacks on Israeli and Brazilian organizations, has evolved into a ransomware-as-a-service (RaaS) operation with explicit support for Linux environments. Recent research reveals that its latest builders now include Linux payload options, enabling affiliates to generate customized encryptors for Linux servers, VMware ESXi hypervisors, and cloud workloads aligning with a broader trend of ransomware targeting high-value infrastructure. Linked to Iranian-backed threat actors, Pay2Key has shifted from on-premises corporate networks to financial systems, SAP databases, and virtualization platforms. Its RaaS model expands the pool of attackers capable of compromising critical enterprise assets. ### Technical Execution The Linux variant operates via a configuration-driven binary requiring root privileges. Key features include: - Fine-grained targeting via JSON configurations, specifying paths, file types, and mount classes for encryption. - Pre-encryption sabotage, including stopping services, killing processes, and disabling SELinux/AppArmor to evade detection. - Persistence mechanisms, such as cron jobs that ensure encryption resumes after reboots. - Selective encryption, skipping ELF/MZ binaries and zero-length files to avoid system crashes while maximizing damage to business data. - ChaCha20 encryption (full or partial modes), with per-file keys stored in obfuscated metadata to hinder recovery. ### Impact on Enterprise and Cloud Systems Pay2Key’s Linux variant is optimized for application servers, virtualization hosts, and cloud storage, with a particular focus on ESXi infrastructure. A single compromised hypervisor can trigger cascading outages across dozens or hundreds of guest VMs. Attackers also prioritize financial applications and databases, amplifying operational disruption and ransom leverage. Cloud and DevOps environments are increasingly at risk, as threat actors exploit misconfigurations, over-privileged service accounts, and CI/CD pipeline gaps to deploy ransomware in Kubernetes clusters and containerized workloads. Traditional EDR and signature-based defenses often fail to detect in-memory or script-driven attacks, leaving defenders with minimal response windows once root access is gained. The evolution of Pay2Key underscores that Linux is now a primary ransomware target, requiring organizations to implement strict access controls, least-privilege policies, and purpose-built detection mechanisms to mitigate risks.

LockBit 5.0 Ransomware Expands Threat with Multi-Platform Attacks LockBit ransomware has evolved with the release of version 5.0, now targeting Windows, Linux, and ESXi systems, broadening its impact across diverse IT infrastructures. The updated malware introduces enhanced defense-evasion techniques, faster encryption, and anti-analysis measures, making it a formidable threat to enterprises, government agencies, and critical sectors. ### Key Features and Tactics LockBit 5.0 employs a multi-layered evasion strategy to bypass detection. On Windows, it uses packing, process hollowing, DLL unhooking, and ETW function patching, while also clearing system logs to obscure its activity. The Linux and ESXi variants skip packing but rely on heavily encrypted strings to hinder analysis. The ransomware leverages hybrid encryption (XChaCha20 + Curve25519), optimizing speed by utilizing multiple CPU cores. It appends random extensions to encrypted files and leaves a ransom note demanding payment. Notably, the malware avoids infecting systems in Russia by checking language and geographic settings. ### Targeting Virtualized Environments LockBit 5.0 includes specialized functions for virtual machines, particularly VMware ESXi. It scans the `/vmfs/` directory for virtual machine files and can terminate VMs mid-encryption, disrupting critical infrastructure in enterprise environments. ### Execution and Impact The ransomware executes via command-line arguments, allowing customization per environment. Over 60 victims were listed on LockBit’s data leak site by late 2025, with attacks spanning private companies, healthcare, education, and government agencies, primarily in the U.S. Despite law enforcement efforts, LockBit remains active, repurposing infrastructure from malware like SmokeLoader. Indicators of Compromise (IoCs) for Windows, Linux, and ESXi variants have been identified to aid detection. ### Infrastructure Details - Onion Sites: `lockbitfbinpwhbyomxkiqtwhwiyetrbkb4hnqmshaonqxmsrqwg7yad.onion` (24 mirrors) - C2 Infrastructure: `205.185.116.233`, `205.185.116.233:3389`, `karma0.xyz`