Ransomware & Extortion · Ransomware

Iran-linked Pay2Key encrypts U.S. healthcare provider systems

Iran-linked Pay2Key encrypted systems at a U.S. healthcare provider. Investigators say actors used stolen credentials, TeamViewer and a self-extracting 7zip (SFX) installer to encrypt the environment in about three hours. The actors deployed and removed an evasion toolkit; forensics found no evidence of data exfiltration.

4 sources · Mar 27

Timeline

Mar 27 Reported by The Hacker News
Mar 26 Reported by The Record from Recorded Future
Mar 25 Reported by Cybersecurity Dive

Sources

Mar 27 The Hacker News
Bearlyfy Hits Russian Firms with Custom GenieLocker Ransomware
Bearlyfy launched 70+ attacks since 2025 using GenieLocker ransomware, targeting Russian firms, driving high ransom payments.
original
Mar 26 The Record from Recorded Future
Pro-Ukraine hacker group Bearlyfy targets Russian companies with custom ransomware
A pro-Ukrainian hacker group known as Bearlyfy has carried out more than 70 cyberattacks against Russian companies over the past year and is now escalating its campaign with newly developed ransomware tools, researchers have found.
original
Mar 26 Infosecurity Magazine
Iran-Linked Pay2Key Ransomware Group Re-Emerges
Halcyon and Beazley Security track the return of Iranian ransomware group Pay2Key
original

Part of the PlainSec briefing for 2026-03-26

Every edition of this story: Iran-linked Pay2Key encrypts U.S. healthcare provider systems