Iran-Linked Pay2Key Ransomware Targets US Healthcare Organization Amid Military Conflict

Iran-affiliated ransomware group Pay2Key targeted an unnamed US healthcare provider in late February, compromising an administrative account days before deploying ransomware. No data was exfiltrated; researchers suggest the group 'does not always appear to prioritize extortion and financial gain over destruction,' indicating strategic motivations tied to the military conflict. The attack preceded the higher-profile Stryker medical device company breach claimed by Iranian group Handala.