Inside Pay2Key

Overview

In the first week of November 2020, an unusual cluster of Israeli companies reported full-network ransomware encryption from a strain no security vendor recognized. Check Point Research named it Pay2Key after the contact handle the operators used. Compilation artifacts revealed the developers’ own name for the project — Cobalt (unrelated to Cobalt Strike) — visible in the PDB path and class hierarchy of an unstripped C++ binary. The campaign was later attributed by ClearSky to Fox Kitten (also Pioneer Kitten, UNC757, Parisite, Lemon Sandstorm), an Iranian IRGC-nexus group, and the operation is best understood not as ordinary crime but as a hack-and-leak information operation against Israeli industry.

What makes Pay2Key worth dissecting is not novel cryptography or a clever loader — it is the operational architecture. The operators engineered the campaign to encrypt an entire network within an hour while presenting only a single host to perimeter monitoring, and built the encryptor to depend on live C2 contact. Those two design choices shape both the threat and the defensive opportunities, and they are the backbone of this analysis.

Attribution and Strategic Context

Check Point initially declined to attribute the campaign, noting only that inconsistent English in the strings and logs pointed to a non-native speaker. ClearSky’s follow-on “Pay2Kitten” analysis tied the operation to Fox Kitten on the basis of shared tooling — most tellingly the use of the FRPC (Fast Reverse Proxy) and a Go-language LanProxy reverse-proxy to relay traffic out of victim networks, infrastructure overlaps, and a configuration file that embedded the victim organization’s name. The U.S. government (CISA/FBI advisory AA24-241A) later cited Pay2Key explicitly as a 2020 hack-and-leak campaign that this Iranian group ran to undermine Israeli cyber infrastructure — leaking stolen data on a Tor site and tagging media outlets, with reputational damage rather than profit as the objective.

That framing matters for defenders: the 7–9 BTC ransom (roughly $110K–$140K) and the double-extortion language in the note were, in part, theater layered over a state information operation. The encryption was real and destructive; the “business model” was a cover story.

Attack Lifecycle

The intrusion followed a consistent, hands-on-keyboard sequence. The operators already held network access — obtained earlier, consistent with Fox Kitten’s known exploitation of internet-facing VPN and gateway appliances — and the November activity was the staging and detonation phase.

[1] INITIAL ACCESS   — interactive logon to an internal host (RDP)
   └─ prior foothold via VPN/edge exploitation (Fox Kitten tradecraft)
[2] STAGE PIVOT      — drop + run ConnectPC.exe on the entry host
   └─ FRPC / LanProxy reverse proxy → external C2 (single egress point)
[3] PROPAGATE        — PsExec pushes Cobalt.Client.exe + Config.ini
   └─ Config.ini Server = <internal pivot IP>, Port = 5050
[4] EXECUTE          — each client dials the INTERNAL pivot, not the C2
   └─ pivot relays RSA-secured TCP to the real control server
[5] ENCRYPT          — online-only AES/RSA encryption, .pay2key ext
   └─ net stop mssqlserver → drop [ORG]_MESSAGE.TXT → self-clean

Initial access to the detonation host was made interactively, most likely over RDP. The operators copied a small toolkit to the host — the ransomware (Cobalt.Client.exe), a configuration file (Config.ini), the pivot utility (ConnectPC.exe), and PsExec.exe — commonly under paths such as C:\Windows\IME\en-GB\client\ or C:\Windows\Temp\[org]tmp\. Lateral movement and remote execution across the estate were driven by PsExec, which let a single operator detonate the encryptor on hundreds of hosts in minutes.

The Pivot / Proxy Architecture

The signature design choice is the internal relay. Conventional ransomware has every infected host beacon directly to an external C2 — noisy, and trivially revealing of the C2 address to any responder watching egress. Pay2Key inverts this. The Config.ini dropped on each victim does not point at the internet; it points at a peer inside the LAN:

; Config.ini  — dropped alongside Cobalt.Client.exe
[Config]
Server = 10.x.x.x        ; the INTERNAL pivot host, not the C2
Port   = 5050

Only the pivot host — running ConnectPC.exe and a reverse proxy (FRPC or Go LanProxy) — holds and contacts the real external C2. Every other encrypting client speaks only to that internal peer over port 5050. Two defensive consequences follow. First, internal-to-internal traffic is more likely to be permitted by segmentation rules, raising reliability. Second, perimeter logs show a single host talking to the C2 instead of a swarm — suppressing the volumetric signal that usually betrays mass encryption, and hiding the C2 address from all but one machine. If you accept the command-line override –config [path], the client will read an arbitrary config, but the dropped default is the internal-pivot pattern above.

Client–C2 Protocol

The encryptor (Cobalt.Client.exe) is a C++/MSVC++ 2015 program built on Boost, heavily object-oriented, and — unusually — shipped unstripped with full RTTI and verbose debug logging to Cobalt-Client-log.txt. On launch it reads Server and Port from the config, generates an RSA key pair, and sends its public key to the server over raw TCP to bootstrap a secure channel. It then enters a message loop handled by a custom Message Handler. Fourteen message types are defined; the most consequential is Config, which delivers the operational parameters the binary otherwise lacks.

Because parameters arrive over the wire, the binary alone is under-specified: analyzed in isolation it falls back to defaults (extension .enc, ransom note SALAM_MESSAGE.TXT). In the live incidents the server returned the .pay2key extension and a note file templated as [ORGANIZATION]_MESSAGE.TXT, with the victim’s name even rendered in custom ASCII art.

Encryption Implementation

Pay2Key uses the standard hybrid model — symmetric AES for bulk file data, asymmetric RSA to protect the keys — but with a defining dependency: the RSA public key is supplied by the C2 at runtime. The encryptor does not embed a key and cannot improvise one. The practical implication is decisive:

Check Point’s reversing also surfaced three idiosyncrasies that mark the code as hand-rolled rather than copy-pasted boilerplate. The authors used the RC4 stream cipher (via the Windows API) for some — not all — cryptographic functions; they allocated a custom, named key container, pippo container, instead of the usual null default; and they derived AES keys with CryptDeriveKey over a hash value rather than the conventional CryptGenKey. None of these proved to be an exploitable flaw, but together they signal developers experimenting with the CryptoAPI rather than reusing a known-good ransomware template.

flow: client RSA keypair  ─▶ send pubkey  ─▶ recv server pubkey
      recv SessionKey  ─▶ recv Config (extensions, org, note, ext)
      per file: AES (CryptDeriveKey from hash)  ─▶ key wrapped via RSA
      append .pay2key  ─▶ net stop mssqlserver  ─▶ JobFinished

At completion the encryptor terminates the SQL Server service (net stop mssqlserver > nul) to release locked database files for encryption, drops the templated ransom note, and — in later builds — runs a housekeeping routine that deletes the dropped tooling and reboots the host. A –noreboot switch was added to suppress that restart, and newer samples scrub the debug log that earlier versions left behind.

Binary Characteristics and Tradecraft Tells

Several artifacts make Pay2Key unusually legible to analysts and useful for attribution and YARA development:

• Internal project name Cobalt, exposed in the PDB path F:\2-Sources\21-FinalCobalt\…\Cobalt.Client.pdb.
• Unstripped C++/MSVC++ 2015 binary with Boost, full RTTI, and descriptive class names (Cobalt::Communication::*, Cobalt::DataProcessing::AESEncryptor, RSAClient/RSAServer, TCPClient).
• No packer or obfuscation — only a single VirusTotal engine flagged early samples, underscoring how low-detection novelty, not stealth packing, enabled the campaign.
• Verbose operational logging (e.g. receiving server public key, Start Encrypting Engine, Send Job Finished Message) that doubles as a behavioural fingerprint.

Rapidly iterating samples within days — adding the self-kill/housekeeping logic and the –noreboot flag — indicate an actively maintained codebase rather than a one-off tool.

MITRE ATT&CK Mapping

The campaign maps cleanly to a compact set of techniques spanning access, movement, C2, and impact.

Detection and Mitigation

Pay2Key’s own design dictates the highest-value defenses. Prioritize, roughly in order:

• Close the front door. Restrict and MFA-protect RDP; patch internet-facing VPN/gateway appliances on the shortest cycle possible — the Fox Kitten access path that precedes detonation.
• Hunt the pivot. Alert on a single internal host fanning in many TCP/5050 (or unusual port) sessions while holding a lone outbound connection; flag FRPC, LanProxy, and ConnectPC.exe by hash and name.
• Watch east-west PsExec. Burst service creations (Event ID 7045/4697) and PSEXESVC across many hosts in minutes is a detonation in progress.
• Exploit the online-only dependency. During an active incident, cutting the pivot’s egress or isolating hosts from it can prevent not-yet-started encryption — a rare, decisive containment lever.
• Assume data theft. Despite thin evidence of exfiltration in the binary, the operation was a hack-and-leak; treat any Pay2Key event as a breach and preserve forensics for sanctions and disclosure analysis.

Indicators of Compromise

Published file hashes (Check Point Research). Treat as historical; rotate against current threat-intel feeds before blocking.

In Brief

Pay2Key’s sophistication was operational, not cryptographic. A reused hybrid-encryption scheme was wrapped in a deployment architecture — an internal pivot, RSA-secured relay protocol, and PsExec fan-out — tuned to encrypt fast and surface quietly, in service of an Iranian information operation against Israel. Its defining weakness, the runtime dependency on a reachable C2 for its encryption key, is also the defender’s best lever: control the pivot, and you control the campaign.