Back Gbhackers

Linux Ransomware Pay2Key Targets Servers, Virtualization Hosts, and Cloud Workloads

Gbhackers •Mayura Kathir • March 25, 2026

Linux-focused ransomware Pay2Key is actively targeting enterprise servers, VMware ESXi virtualization hosts, and cloud workloads, underscoring how far Linux ransomware has evolved beyond simple file lockers. Originally known for fast, human-operated Windows intrusions against Israeli and Brazilian organizations, Pay2Key has re-emerged as a ransomware-as-a-service (RaaS) with explicit support for Linux environments. Recent research shows that newer […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Linux Ransomware Pay2Key Targets Enterprise Systems and Cloud Workloads The Linux ransomware Pay2Key has evolved to target enterprise servers, VMware ESXi hosts, and cloud workloads, indicating a significant shift in its operational focus. Initially recognized for its attacks on Windows systems, particularly against Israeli and Brazilian organizations, it has now expanded its capabilities to Linux environments. The ransomware is attributed to Iranian threat actors and operates as a ransomware-as-a-service (RaaS). Recent reports indicate that this malware is actively exploiting vulnerabilities in organizational infrastructures, raising alarms about its potential impact on enterprise security. The exact number of affected organizations remains unclear, but the scope of its attacks suggests a growing trend in targeting Linux systems. Security professionals are advised to enhance their defenses against this emerging threat. Current mitigation strategies and specific vulnerabilities exploited by Pay2Key have not been detailed in the articles. 2 sources 58

Extracted Entities

Linux Ransomware Pay2Key Targets Servers, Virtualization Hosts, and Cloud Workloads

The full story

Extracted Entities

Attack Types (1)

Platforms (2)

Ransomware Groups (1)