Pay2Key (Fox Kitten / Pioneer Kitten, Iran-linked)

Pay2Key first appeared in late 2020 in a wave of intrusions against Israeli companies, characterized less by extortion revenue than by public shaming and disruption, which analysts (notably ClearSky) tied to Iranian interests via the 'Pay2Kitten' assessment. MITRE ATT&CK tracks the broader actor set as Fox Kitten (G0117), an Iran-nexus group active since at least 2017 known for exploiting internet-facing appliances (VPNs, firewalls), deploying web shells, and providing initial access that has been linked to multiple ransomware operations.

In 2025 the brand resurfaced as 'Pay2Key.I2P,' hosting infrastructure on the anonymous I2P network rather than Tor and operating as a ransomware-as-a-service program. Reporting indicates it was promoted on Russian and Chinese darknet forums and on X, added a Linux payload variant in mid-2025, and offered affiliates an elevated cut (reported around 70-80%) specifically for participating in attacks against Iran's adversaries, blending financial and ideological motives.

Its targeting is heavily oriented toward Israel and the United States, with MENA-relevant claims including Israel, the UAE and Azerbaijan. Public reporting cited multi-million-dollar cumulative proceeds and dozens of payouts within months of the 2025 relaunch. As with all extortion brands, individual victim claims should be treated as unverified unless confirmed by a reputable source; the Iran-nexus attribution is an analytic assessment supported by multiple vendors rather than an admission.