Pay2Kitten report

## Executive Summary: The report documents the Pay2Key ransomware campaign (June–December 2020) targeting Israeli companies, links the operation to the Iranian APT 'Fox Kitten' with medium-high confidence, and describes exploitation of VPN vulnerabilities (Fortinet, Citrix, F5), use of reverse proxy tools (FRP, Ngrok, LanProxy), lateral movement and persistence techniques, data exfiltration and public leaks (TOR, Keybase, Twitter), detailed IOCs (hashes, IPs, domains) and defensive recommendations.