Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

11/12/2020
05:45 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

'Pay2Key' Could Become Next Big Ransomware Threat

Researchers from Check Point say an Iranian-based threat actor has successfully attacked multiple Israeli companies could soon go global.

A rapidly proliferating new ransomware strain that over the past two weeks has already impacted multiple large companies in Israel and a few in Europe soon could pose a major threat to organizations all over the world.

Check Point Software Technologies, which published a report today about the new so-called Pay2Key ransomware strain, said it's almost certainly of Iranian origin and capable of encrypting an entire network in an hour or less.

Related Content:

Ransomware Attacks Show Little Sign of Slowing in 2021

The Changing Face of Threat Intelligence

New on The Edge: We Secured the Election. Now How Do We Secure Trust in Results?

As with many other ransomware tools, the authors of Pay2Key have mainly been exploiting exposed Remote Desktop Protocol (RDP) services to infiltrate victim networks and then expand their presence. It's possible they may be using other vectors as well.

Once on a victim network, the attackers have been setting up what Check Point described as a "pivot device" or proxy for all communications between infected systems and Pay2Keys C2 servers. The tactic of using a single device to communicate externally has helped the threat actor evade detection before encryption. The group is using the psexec dot exe utility to move laterally on an infected network and to execute the ransomware on different systems, Check Point said.

In addition to encrypting networks, the Pay2Key attackers have also been stealing sensitive data from victim organizations and threatening to publicly expose the data if the demanded ransom is not paid. Pay2Key threat actors are currently demanding a relatively modest 7- to 9 bitcoins from victims, or between $113,000 and $145,500 at Thursday's rates, according to Check Point.

At least four victims have paid the attackers to get their data back, and at least three others who refused to do so have already had their data released via a Tor website that the attackers have expressly set up for the purpose, Check Point said.

Double Extortion

In each case, the leaked data was uploaded to a dedicated folder on the website and was accompanied with a message that provided detailed information on the victim's network including domain, servers, and backup. In its report, Check Point described one of the victims that had been doxed as a law firm, and another as a gaming company. Interestingly, the attackers released a lot of sensitive information belonging to the law firm immediately upon expiry of the deadline, but gave the gaming company a second chance at making payment before releasing sensitive information.

It remains unclear whether victims who paid the ransom were able to recover their data.

"We at Check Point consider this attack sophisticated and advanced—way above what you can expect from a threat actor who has never been seen before," says Lotem Finkelsteen, head of threat intelligence at Check Point Software Technologies.

The group's ability to synchronize attacks against several companies over a time span of a few days, its ability to encrypt an entire network in less than an hour, and its success extorting money from victims are hallmarks of a sophisticated actor, he notes.

Iran Connection

Researchers focused on bitcoin wallets in the ransom notes sent to companies who actually paid the threat actor: they then were able to track the transaction to an Iranian cryptocurrency exchange called Excoino that appears open only to Iranian citizens, based on the fact that registration requires a national ID card.

For the moment, most observed attacks have targeted Israeli companies though at least one European entity has been impacted as well. "We see no technical limit for the attackers to stay local," Finkelsteen says. "We do see evidence of infection in Europe, so maybe they'll consider going global."

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 11/19/2020
New Proposed DNS Security Features Released
Kelly Jackson Higgins, Executive Editor at Dark Reading,  11/19/2020
How to Identify Cobalt Strike on Your Network
Zohar Buber, Security Analyst,  11/18/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: A GONG is as good as a cyber attack.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-25660
PUBLISHED: 2020-11-23
A flaw was found in the Cephx authentication protocol in versions before 15.2.6 and before 14.2.14, where it does not verify Ceph clients correctly and is then vulnerable to replay attacks in Nautilus. This flaw allows an attacker with access to the Ceph cluster network to authenticate with the Ceph...
CVE-2020-25688
PUBLISHED: 2020-11-23
A flaw was found in rhacm versions before 2.0.5 and before 2.1.0. Two internal service APIs were incorrectly provisioned using a test certificate from the source repository. This would result in all installations using the same certificates. If an attacker could observe network traffic internal to a...
CVE-2020-25696
PUBLISHED: 2020-11-23
A flaw was found in the psql interactive terminal of PostgreSQL in versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If an interactive psql session uses \gset when querying a compromised server, the attacker can execute arbitrary code as the operating sy...
CVE-2020-26229
PUBLISHED: 2020-11-23
TYPO3 is an open source PHP based web content management system. In TYPO3 from version 10.4.0, and before version 10.4.10, RSS widgets are susceptible to XML external entity processing. This vulnerability is reasonable, but is theoretical - it was not possible to actually reproduce the vulnerability...
CVE-2020-28984
PUBLISHED: 2020-11-23
prive/formulaires/configurer_preferences.php in SPIP before 3.2.8 does not properly validate the couleur, display, display_navigation, display_outils, imessage, and spip_ecran parameters.