pay2key

Executive Summary

The pay2key ransomware is used by the Fox Kitten threat actor, primarily targeting Israeli companies since July 2020. The group operates a darknet leak site to publish sensitive information of their victims, including Intel's Habana Labs and Israel Aerospace Industries. Their primary goal is financial gain through ransom demands.

Goals & Targeting

The Fox Kitten threat actor's strategic objectives appear to be primarily focused on achieving financial gain through ransom demands. They target Israeli companies, likely due to the perceived likelihood of payment, and seek to steal sensitive information that can be used to extort payment. Their typical victims are companies in the tech and aerospace sectors, although they may also target other organizations that they believe will be willing to pay a ransom.

The Pay2Key ransomware is likely just one tool in the Fox Kitten threat actor's arsenal, and the group may use a range of other tactics and techniques to achieve their goals. However, the fact that they have been able to successfully use Pay2Key to extort payment from multiple victims suggests that they are a formidable opponent, and that organizations should be taking steps to protect themselves against this threat. This may include implementing robust security controls, such as backups and encryption, as well as providing training to employees on how to avoid falling victim to phishing and other social engineering attacks.

Key Capabilities

• Ransomware development and deployment
• Darknet leak site operation
• Data exfiltration and extortion
• Social engineering and phishing

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

The Fox Kitten threat actor's campaign patterns suggest a focus on targeting Israeli companies, with a range of victims across the tech and aerospace sectors. Their operational tempo appears to be relatively slow, with a focus on carefully selecting and targeting specific organizations. Notable past operations include the targeting of Intel's Habana Labs and Israel Aerospace Industries, and the group may continue to target similar organizations in the future.

IOC Patterns

• Spear-phishing with macro-laced Office documents
• C2 over DNS using fast-flux
• Staging infrastructure on bulletproof hosting

Recommended Actions

• Implement robust backups and encryption
• Provide training to employees on phishing and social engineering attacks
• Monitor for suspicious network activity
• Use anti-ransomware software

Suggested Tags