Pay2Key (virus racketeer)

Main article: Viruses racketeers (encoders) of Ransomware

2020: The first attacks of the encoder

The racketeer of Pay2Key is capable to cipher networks of corporations of all for an hour. It became known on November 10, 2020.

A number of the companies and large corporations in Israel became the victims of cyber attacks using this racketeering software under the name Pay2Key. The first attacks were recorded by specialists from Check Point company at the end of October, 2020, and now their number increased.

According to specialists, criminals usually perform the attacks after midnight when in the companies less IT employees work. Pay2Key malware, presumably, gets into network of the organizations through poorly protected RDP connection (remote desktop protocol). Malefactors get access to corporate networks "for some time before the attack", and the malware is capable to cipher network of the victim for an hour.

Having got into a local network, hackers install on one of devices the proxy server for ensuring communication of all copies of a malware with C&C-сервером. Start of the payload (Cobalt.Client.exe) is performed far off using the legitimate PsExec utility.

Numerous artifacts of compilation indicate that the racketeer has also other name — Cobalt. Though the identity of malefactors remains to the unknown, the formulations in different code lines written in broken English allow to assume that the malefactor is not a native speaker of English.

This racketeer is written in language C ++. He ciphers files the AES key, and for communication with C&C-сервером uses RSA keys. In the same way Pay2Key receives a configuration file with the list of expansions for enciphering, a message template with the requirement of the redemption, etc.

After completion of enciphering in the cracked systems there are notes with the requirement of the redemption. The Pay2Key grouping usually demands the redemption in the amount of 7 up to 9 bitcoins (approximately from $110 to $140 thousand). The cryptographic scheme of criminals looks reliable (using algorithms of AES and RSA), and, unfortunately, experts could not develop the free version of the decoder for the victims yet^[1].

Notes

See Also