Loading threat actor…
Payouts King, also styled PayoutsKing and Payouts Kings, is a financially motivated ransomware and data-extortion operation active since 2025. It conducts double extortion through data theft, selective file encryption, and threats to publish stolen information on a dedicated leak site. Its targets are concentrated in the United States and Germany, with additional targeting in the United Kingdom, Italy, and Spain. Manufacturing, professional services, technology, and healthcare feature prominently among its listed victims. Sophos tracks Payouts King activity as GOLD ENCOUNTER and STAC4713. Some campaigns have been linked to former Black Basta affiliates, but this does not establish that the entire operation is a continuation of Black Basta. Initial-access methods include compromised VPN accounts lacking multifactor authentication, exposed VPN services, exploitation of SolarWinds Web Help Desk vulnerability CVE-2025-26399, and social engineering. Its social-engineering playbook combines email bombing with Microsoft Teams calls impersonating internal IT support, persuading victims to grant remote access through Quick Assist. Associated initial access brokers, including UNC6692, supply access for follow-on ransomware activity. Broker campaigns deploy Edgecution, a malicious Microsoft Edge extension paired with a Python backdoor that abuses browser native messaging for host-level command execution, reconnaissance, and persistence. Payouts King has concealed post-exploitation tooling inside hidden QEMU virtual machines running Alpine Linux, using tunneling and virtualized execution to reduce endpoint-security visibility. Later intrusions used DLL side-loading to deploy Havoc. Other observed behaviors include scheduled-task persistence, privilege escalation, network-share discovery, theft of Active Directory credential material, and Rclone-based exfiltration. Its ransomware combines AES-256-CTR encryption with RSA-4096 key protection and partially encrypts large files to accelerate execution. Defense-evasion and recovery-inhibition measures include runtime string decryption, hashed API resolution, execution gating, direct system calls to terminate security software, shadow-copy deletion, and Windows event-log clearing.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
64 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
2 malware families Mallory has associated with this actor across public reporting.
4 indicators attributed to this actor. Values are masked here and available in full in Mallory.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.