Pay2Key was discovered in November in a joint research project by two Israeli cybersecurity firms, Check Point and Whitestream. Initially, the group was thought to be another band of cybercriminals active in the field of ransomware.
Ransomware attacks tend to follow a similar pattern: a company is targeted, its files either stolen or encrypted, and they must then pay a ransom to have the information released. However, this group was slightly different and requested small sums while showing “concerning” tradecraft usually reserved for more advanced hackers, if not those affiliated with a nation state.
Even before linking it back to Iran, Check Point warned in their report that the attackers had “advanced capabilities’’ not usually associated with cybercriminals. Lotem Finkelstein, head of cyber intelligence at Check Point, told me last Thursday that in some of the cases revealed in the past, the attackers managed to take control “of the entire network within an hour,” whereas most criminal operations will “take a few hours if not days – say, the entire weekend.”
“This is the type of skill we have only seen from the most skilled hackers in this business,” he said. “The fact that this operation also had what is termed ‘operational security’ (or OpSec) covering their tracks is impressive. The fact that this is a new group showing such skills is suspicious, because in what seems like a very short time, it managed to learn the business, make up for lost time and emerge as a serious player on par with teams with much more experience. It’s almost as if they didn’t need any practice, as if there’s simply no learning curve,” he said.