Iranian hackers were behind the Pay2Key ransomware attack on dozens of Israeli companies last week, according to the Israeli cyber security firm Check Point, which worked with the Israeli blockchain intelligence firm Whitestream to discover the source of the attack.

From each of the companies that fell prey to the attack, the hackers demanded payment of seven to nine bitcoins, worth some NIS 375,000-NIS 475,000 shekels ($111,000-$141,000).

Check Point reported that after four of the firms decided to pay the ransom to release their data, it tracked the bitcoin transactions carried out by the hackers and identified them as Iranian.

The tracing process began with the addresses of the bitcoin wallets to which the victims were instructed to send their ransom payments. Eventually, the transactions wound up in wallets belonging to Excoino, an Iranian entity that supplies secure business services in cryptocurrency.

Excoino only works with Iranian citizens. To sign up for the service, a potential user must have a valid Iranian phone number as well as an Iranian identity number. The service also demands a copy of the account holder’s ID, as well, all of which led Check Point to the conclusion that the hackers were Iranians.

Check Point explained that this latest attack used the “double extortion” method on its victims, a new development in ransomware attacks. In the double extortion model, hackers not only encode a company’s data, blocking access to it, they also threaten to steal data and leak it if their demands for payment are not met.

To show what can happen when companies do not comply with their demands, the operators of the Pay2Key scam created a dedicated website on which they post content stolen from companies who refused to pay them. These include three Israeli companies.

This article first appeared in Israel Hayom.

Support Jewish Journalism
with 2020 Vision

One of the most intriguing stories of the sudden Coronavirus crisis is the role of the internet. With individuals forced into home quarantine, most are turning further online for information, education and social interaction.

JNS's influence and readership are growing exponentially, and our positioning sets us apart. Most Jewish media are advocating increasingly biased progressive political and social agendas. JNS is providing more and more readers with a welcome alternative and an ideological home.

During this crisis, JNS continues working overtime. We are being relied upon to tell the story of this crisis as it affects Israel and the global Jewish community, and explain the extraordinary political developments taking place in parallel.

Our ability to thrive in 2020 and beyond depends on the generosity of committed readers and supporters. Monthly donations in particular go a long way in helping us sustain our operations. We greatly appreciate any contributions you can make during these challenging times. We thank you for your ongoing support and wish you blessings for good health and peace of mind.