Iranian-Backed Pay2Key Ransomware Resurfaces with 80% Profit Share for Cybercriminals

Jul 11, 2025

An Iranian-backed ransomware-as-a-service (RaaS) named Pay2Key has resurfaced in the wake of the Israel-Iran-U.S. conflict last month, offering bigger payouts to cybercriminals who launch attacks against Israel and the U.S.
The financially motivated scheme, now operating under the moniker Pay2Key.I2P, is assessed to be linked to a hacking group tracked as Fox Kitten (aka Lemon Sandstorm).

Get Free Report & Network Analysis

Please check your email for the free report.