In a research brief, Check Point said the attacks using this ransomware, which is one of the multitude that can wreak havoc on systems running Microsoft's Windows operating system, had mostly targetted Israeli companies.

The ransomware spread quickly across victims' networks, leaving major parts of it encrypted along with the usual ransom note threatening to leak stolen corporate data unless the money that was demanded was paid.

Check Point said as the infections grew, more and more people decided to pay up; while this was regrettable, the company said, it also created a means of finding out the source of the ransomware.

Along with Israeli blockchain analytics firm Whitestream, Check Point said it had followed the payments made by some of the firms. "We followed the sequence of transactions, which began with the deposit of the ransom and ended at what appeared to be an Iranian cryptocurrency exchange named Excoino," it said.

"The [cryptocurrency] flow starts with Bitcoin wallets found in the ransom notes. Once the victim deposits to the ransom wallet specified in the ransom note, the attackers proceed with transferring the money to an intermediate wallet – this wallet was seen to be re-used in ransom payments of several victims.

"Then the Bitcoin is transferred to a final wallet address associated with a high activity cluster. These types of high activity clusters often suggest an association with a financial entity involved with the Bitcoin market, often an exchange.

"In order to verify the link between this 'final wallet' and the Excoino exchange, we used the WalletExplorer service and a known Excoino wallet address."

The Check Point researchers said Excoino was an Iranian company that provided secure cryptocurrency transactions services for Iranian citizens.

"Registration requires the user to have a valid Iranian phone number and ID/Melli code (کد ملی). To be eligible to trade the exchange, however, will also require a copy of the ID itself," it said.

"In its terms and conditions, Excoino states the first transaction (and any other suspicious transaction) will have to be reported to the Iranian Cyber Police, FATA, for further investigation.

"This may suggest the owners of the final wallets are Iranian citizens, who most probably are behind the Pay2Key attack on Israeli companies."