Pay2Key’s Linux Ransomware Shifts Focus to Enterprise Infrastructure

For a long time, Linux has been thought to be safer than Windows, especially in business settings. Now that reputation is being tested because ransomware groups aren’t just after work computers and desktops anymore. It is much riskier now that more of them are going after the infrastructure that businesses need to run.

Now, a Linux version of the Pay2Key ransomware family is going after company servers, virtualization hosts, and cloud workloads. Researchers said they saw the malware for the first time in the wild in late August 2025. What makes it stand out now is that it seems to have been designed to be large, fast, and reliable.

Pay2Key is not a new threat. This group has been around for years and has been linked to Iranian threat actors. Earlier campaigns concentrated mostly on Western and Israeli targets. The change in approach in this most recent Linux-oriented endeavor is what distinguishes it. The operators are now focusing on the back-end systems supporting databases, applications, and virtual machines rather than end-user systems.

The Linux sample, known as Pay2Key.I2, was found by Morphisec researchers to be intended to run only when root-level rights are already accessible. This allows the ransomware to access all files and the primary operating system functions without altering its permissions once it has been run.

A shift toward infrastructure targets

That matters because Linux systems often sit at the center of business operations. They host databases, application back ends, internal services, virtual environments, and cloud workloads. If one of these systems is hit, the disruption can spread quickly.

This is what makes the Linux variant of Pay2Key more concerning than a typical ransomware infection on a desktop machine. It is not just about locking files on a single device. It is about hitting the systems that businesses rely on every day to keep services online.

The malware can also classify mounted file systems and selectively encrypt them. That means it is built to cause as much operational damage as possible while still keeping the host stable enough for the ransom demand to be delivered. For organizations running Linux-based infrastructure, that is a serious problem. Before Pay2Key starts encrypting files, it first removes obstacles.

For file targeting, Pay2Key reads /proc/mounts to map the system’s mounted file systems. It filters out pseudo-filesystems and separates mounts by type, including read-only and removable storage. It skips read-only mounts and avoids encrypting ELF and MZ binaries, along with zero-length files. That choice appears designed to reduce the chances of crashing the system before the attack is complete.

Why this is becoming harder to ignore

The encryption routine uses ChaCha20 and can run in full-file or partial-file mode depending on the configuration. Researchers also found a hardcoded string, DontDecompileMePlease, inside the binary, which plays a role in metadata key derivation and validation. Per-file keys are stored in an obfuscated metadata block, making recovery without the decryption key extremely difficult.

For security teams, the warning signs are clear. Root-level access needs tighter control. Unexpected attempts to disable SELinux or AppArmor should raise immediate concern. Unauthorized cron job creation should be monitored closely. Offline and immutable backups also remain one of the best ways to recover without paying a ransom.

Pay2Key’s Linux campaign shows that ransomware operators are putting real effort into attacks on Linux infrastructure. For organizations that depend on these environments, this is no longer a secondary threat.