Linux Ransomware Pay2Key Attacking Organizations Ervers, Virtualization Hosts, and Cloud Workloads
## Linux Ransomware: Pay2Key Targeting Servers and Cloud Infrastructure
Linux Ransomware: Pay2Key Targeting Servers and Cloud Infrastructure
Recent developments reveal that the ransomware group Pay2Key, associated with Iranian threat actors, has introduced a Linux variant specifically targeting organizational servers, virtualization hosts, and cloud workloads. This variant was initially detected in late August 2025.
Pay2Key's Linux version is designed for rapid and broad deployment, focusing on infrastructure rather than desktop environments. This shift in strategy allows the malware to directly impact the core systems that organizations rely on.
The ransomware executes with root-level privileges, granting it full control over the file system and operating system functions. It is configuration-driven, ensuring that it runs only when full access is guaranteed.
The introduction of this Linux-specific ransomware variant poses a significant threat to organizations relying on Linux-based infrastructures. Key targets include:
Servers hosting databases and application backends Virtual machines Cloud workloads critical for continuous operations
Recent developments reveal that the ransomware group Pay2Key, associated with Iranian threat actors, has introduced a Linux variant specifically targeting organizational servers, virtualization hosts, and cloud workloads.
Pay2Key's ability to categorize mounted file systems and selectively encrypt them allows it to maximize damage while keeping systems operational enough to issue ransom demands.
Before encrypting files, the ransomware disables vital security frameworks such as SELinux and AppArmor, and stops running services and processes. This disables the host's active security defenses.
To ensure persistence, the malware installs a cron entry that triggers upon system restart, allowing it to resume operations post-reboot.
The encryption process uses the ChaCha20 algorithm, with keys stored in an obfuscated metadata block, making decryption without the appropriate key nearly impossible.
Organizations should implement strict controls on root-level access and audit accounts with elevated privileges. Disabling unnecessary cron job creation for non-admin users is recommended to mitigate persistence threats.
Active monitoring for unexpected disabling of SELinux or AppArmor can signal active ransomware execution. Maintaining offline, immutable backups of critical data is crucial for recovery without paying ransoms.
Based on reporting by Cyber Security News.
