Pay2Key — Malware Profile

Pay2Key is a ransomware written in C++ that has been used by Fox Kitten since at least July 2020 including campaigns against Israeli companies. Pay2Key has been incorporated with a leak site to display stolen sensitive information to further pressure victims into payment.

MITRE ATT&CK techniques (8)

• T1016 System Network Configuration Discovery
• T1070.004 File Deletion
• T1082 System Information Discovery
• T1090.001 Internal Proxy
• T1095 Non-Application Layer Protocol
• T1486 Data Encrypted for Impact
• T1489 Service Stop
• T1573.002 Asymmetric Cryptography

IntelFusions coverage

• MosesStaff Technical Analysis: PyDCrypt Loader and DCSrv Wiper Use DiskCryptor for Ideologically Motivated Destruction Without Ransom 2026-02-16

Attributed threat actors

• Fox Kitten

Read the full analysis on IntelFusions