Open Nav
Sign Up

Defending against the “Pay2key” cyber campaign

Ben Brauner

December 16, 2020

Cyber Incident Response

Pay2key – December 2020

Over the last 10 days, OP Innovate has handled a number of cyber incidents resulting from the Iranian ‘Pay2key’ campaign. This intelligence gathering and ransomware campaign has targeted over 80 Israeli organizations thus far, and if successful, would have paralyzed significant sectors of the Israeli industry.

Incident Response Methodology

An incident response methodology coalesces is a number of procedures which aim to identify, investigate, handle and then learn from security incidents. The methodology seeks to minimize impact and downtime, bring about rapid recovery, and feed into an iterative feedback loop which strives to decrease future recurrence. 

The commonly accepted incident response phases are:

This document focuses on the detection, containment and eradication of the “Pay2key” cyber campaign.

Go to the Windows Task Scheduler and identify the newly created task named “VerifiedPublisherCertStoreVerify”. It appears in the \Microsoft\Windows\AppID directory and replaces the existing legitimate Windows task of the similar name (VerifiedPublisherCertStoreCheck) (figure 1).

Figure 1: Task Scheduler showing the disabled legitimate task and its persistent malicious replacement

Investigation of the malicious task shows that it runs an application masquerading as a Windows application each day at 9am. The name of this application is sccm.exe, and mimics the Windows System Center Configuration Manager (SCCM). Use of a legitimate Windows application name may help the malware file to evade some antivirus software which looks for unknown file names. 

This malware file is located in the c:\windows\speech folder. Its location is a further effort to evade the AV software (figure 2).

Figure 2: Malware location

Eradication action items: 

  • The malicious scheduled task must be deleted.
  • The malware file found in c:\windows\speech\sccm.exe must be deleted.

A further artifact found was the creation of a local administrative user on the server, the account named “DefaultAccounts$” (figures 3 and 4). This seeks to mimic the “DefaultAccount”, also known as the Default System Managed Account (DSMA), a built-in account introduced in Windows 10 version 1607 and Windows Server 2016. It remains present in Windows 10, Windows Server 2016 and Windows Server 2019. The legitimate DefaultAccount user is absent since the server predates Windows Server 2016.

Figure 3: The newly created DefaultAccounts$ account

Eradication action items: 

  • The DefaultAccounts$ user must be deleted

Further recommendations to mitigate the attack:

  • Block all traffic to and from the following IPs: 63.32.140.129 , 13.81.213.207 , 162.223.91.13 
  • Reset passwords for all domain admin users, VPN users. Enable and enforce 2FA.
  • Make sure your VPN software and firewall firmware are up to date

Attack Kill Chain

If you find the the indicators of compromise (IOCs) or experience any other suspicious activity please do not hesitate to contact us: 

 

OP Innovate Ltd. © 2020 

   www.op-c.net | info@op-c.net 

Resources highlights

Critical Zero-Day in Microsoft SharePoint Actively Exploited (CVE-2025-53770)

A newly discovered zero-day vulnerability in Microsoft SharePoint Server, tracked as CVE-2025-53770, is currently being exploited in active attacks against on-premises environments. The flaw, rated…

Read more >

CVE-2025-53770

Over 600 Laravel Applications Vulnerable to Remote Code Execution via Leaked APP_KEYs (CVE-2018-15133, CVE-2024-55556)

Security researchers have uncovered a major RCE threat affecting over 600 Laravel applications, triggered by leaked APP_KEYs found on public GitHub repositories. Laravel's APP_KEY, typically…

Read more >

CVE-2018-15133, CVE-2024-55556

CVE-2025-3648: “Count(er) Strike” Vulnerability in ServiceNow

CVE-2025-3648, dubbed “Count(er) Strike”, is a high-severity vulnerability (CVSS 8.2) in ServiceNow's Now Platform, discovered by Varonis Threat Labs. The flaw allows both authenticated and…

Read more >

CVE-2025-3648

What to Look for in a Pentesting Platform (Beyond Just Scans)

Penetration testing platforms are a great way to centralize vulnerability discovery and triage. However, when evaluating penetration testing platforms, many organizations make the mistake of…

Read more >

pentesting platform

CVE-2016-10033: Actively Exploited Remote Code Execution (RCE) Vulnerability in PHPMailer

CVE-2016-10033 is a critical remote code execution vulnerability in PHPMailer, a widely used PHP library for sending emails. The flaw lies in the mailSend function…

Read more >

CVE-2016-10033

High-Severity WordPress Vulnerability in Forminator Plugin (CVE-2025-6463)

A critical vulnerability in the Forminator plugin, one of the most popular form-building plugins in Wordpress, allows unauthenticated attackers to delete arbitrary files on the…

Read more >

CVE-2025-6463
Under Cyber Attack?

Fill out the form and we will contact you immediately.