Iran-Linked Pay2Key Ransomware Gang Targeted U.S. Healthcare Organization Amid Military Conflict

What happened

An Iran-linked Pay2Key ransomware gang targeted a U.S. healthcare organization in late February amid military conflict involving the United States and Iran. Incident responders at Beazley Security helped the unnamed healthcare organization respond to the attack, while the Halcyon Ransomware Research Center assisted in the investigation. According to the report, the attackers compromised an administrative account on the victim’s network several days before deploying the ransomware and encrypting the environment. Investigators also found that the hackers sought to clear traces of their activity and event logs after encryption. The report said there was no evidence that data was exfiltrated during the intrusion. Halcyon also found improvements in the ransomware that made it harder to detect and more damaging. 

Who is affected

The direct victim was an unnamed U.S. healthcare organization. The report also states that Pay2Key has targeted organizations in the United States, Israel, Azerbaijan, and the United Arab Emirates, making the exposure broader than a single sector or geography. 

Why CISOs should care

The incident is relevant because it involved ransomware deployment inside a healthcare environment after compromise of an administrative account, followed by efforts to erase traces of attacker activity. The report also said Pay2Key activity increased following the recent military conflict between the United States and Iran. 

3 practical actions:

1. Review privileged account exposure: Determine whether any administrative accounts show signs of unauthorized access or misuse consistent with the intrusion sequence described in the incident. 
2. Preserve and verify logging coverage: Confirm that logging, retention, and recovery controls can withstand attempts to clear event logs and erase evidence after ransomware deployment. 
3. Scope for encryption without theft: Treat incidents involving Pay2Key as potentially destructive even where there is no evidence of data exfiltration, and align response scoping accordingly. 

For more coverage of ransomware campaigns and extortion-driven attacks, explore our reporting under the Ransomware tag.