Linux Ransomware Pay2Key Targets Servers, Virtualization Hosts, and Cloud Workloads
## Linux Ransomware Pay2Key: Targeting Enterprise Infrastructure
Linux Ransomware Pay2Key: Targeting Enterprise Infrastructure
The Linux-based ransomware Pay2Key is increasingly targeting enterprise servers, VMware ESXi virtualization hosts, and cloud workloads, marking a significant evolution from traditional file lockers.
Originally known for Windows-based attacks in specific regions, Pay2Key has expanded into a ransomware-as-a-service (RaaS) model with support for Linux environments. Recent developments allow affiliates to create Linux-specific payloads, enabling attacks on Linux-based infrastructure.
Pay2Key's Linux variant is designed for scale and stability. It requires root privileges and begins by reading a JSON configuration to determine its targets, such as specific paths and file types. The malware disables protections like SELinux and AppArmor to facilitate encryption.
The ransomware installs a cron job to ensure the encryptor resumes after system reboots. It skips ELF/MZ binaries and zero-length files during encryption, using the ChaCha20 algorithm to maximize data impact. Per-file keys are stored in obfuscated metadata, complicating recovery.
Recent developments allow affiliates to create Linux-specific payloads, enabling attacks on Linux-based infrastructure.
Pay2Key's Linux variant targets application servers, virtualization hosts, and cloud storage systems. The selective targeting of ESXi and other virtualization infrastructure can lead to widespread outages across virtual machines. Threat actors prioritize critical applications and databases, increasing business impact.
In cloud and DevOps environments, attackers exploit misconfigurations and gaps in CI/CD pipelines to deploy ransomware in Kubernetes clusters and containers. Traditional defenses are often ineffective against these attacks.
Organizations should implement strict access controls and regular patching, particularly on services commonly exploited by Pay2Key operators. Linux systems require purpose-built controls to intercept ransomware before encryption occurs.
Measures include enforcing least privilege, monitoring for unusual process activity, and baselining filesystem activity. For virtualization and cloud workloads, segmenting networks and verifying backup integrity are critical for resilience against ransomware incidents.
Based on reporting by GBHackers.