Security Resilience

Threat actor · all actors

Pay2KeyHACK-PAY2KEY hacktivist

🇮🇷 IR

aka Pay2Key, Pay2Key.Ransom

Last updated: 2026-10-16

6attributed CVEs
0ATT&CK techniques
12.9IDF score (tooling uniqueness)
0exclusive CVEs
2019–2024years active

About this actor

An IRGC-aligned ransomware-as-hacktivism operation first observed in late 2020 against Israeli logistics and tech firms. Claims followed a hacktivist messaging pattern (anti-Israel proclamations) while attempting cryptocurrency extortion; relaunched in 2025 as Pay2Key.I2P following the OFAC sanctioning of related infrastructure.

How we know this

Data origin
Curated overlay Hacktivist entry synthesised from public reporting — not a MITRE-tracked intrusion set.
Techniques
No ATT&CK techniques mapped.
Named victims
None on file.

Thin data: No ATT&CK techniques are mapped yet — the behavioural profile is empty.

See how actor data is built for the full pipeline.

Activity timeline

2019: 1 CVE published120192021: 1 KEV added120212022: 1 CVE published2022: 1 KEV added220222023: 1 CVE published2023: 1 KEV added220232024: 3 CVE published2024: 3 KEV added62024
CVE publishedKEV added

Profile

CVERiskCVSSEPSSPublishedProducts
CVE-2024-3400 KEV10.010.01.00002024-04-12see CVE
CVE-2019-19781 KEV9.99.81.00002019-12-27see CVE
CVE-2022-1388 KEV9.99.80.99962022-05-05see CVE
CVE-2023-3519 KEV9.99.80.99752023-07-19see CVE
CVE-2024-21887 KEV9.09.11.00002024-01-12see CVE
CVE-2024-24919 KEV8.88.60.99982024-05-28see CVE

No techniques attributed.

Co-occurring actors

Similar actors

Overlapping CVEs

Active in same years

Same nation-state

Same category