Pay2Key Ransom Note Written to legalnoticetext Registry Key

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•0

Detects the modification of the 'LegalNoticeText' registry value to display Pay2Key ransomware-related strings. This activity is indicative of a system being targeted or compromised by the Pay2Key ransomware, which uses this registry key to display a ransom message upon user logon.