Executive Summary
Pay2Key ransomware, a sophisticated strain linked to Iranian threat actors, has been identified in a campaign using professionally engineered multi-stage deployment tactics. The infection begins with a 7-Zip self-extracting archive (SFX) masquerading as a Google Chrome update, which triggers a complex execution chain designed to bypass traditional security controls.
The attack is notable for its use of polyglot files—scripts that function as both Batch and PowerShell—to perform fileless in-memory execution of malicious payloads. Additionally, the malware specifically targets Avast antivirus installations by performing DLL search order hijacking to turn security software into a malware loader. This ensures high stealth while the ransomware proceeds to encrypt data and demand payment via TOR and I2P infrastructures.
Critically, the ransomware eliminates any chance of local recovery by deleting Windows Backup catalogs, disabling boot recovery, and suspending BitLocker protection. This double-extortion threat model, which includes threats to publish stolen data, poses a significant risk to organizations, making offline backups the only viable recovery strategy.