GOLD ENCOUNTER
GOLD ENCOUNTER is a financially motivated cybercriminal threat group attributed to the PayoutsKing ransomware and double-extortion operation, active since mid-2025. The group steals data and encrypts victim files before demanding payment, and reporting states that PayoutsKing is not operated as a ransomware-as-a-service model and does not rely on affiliates. GOLD ENCOUNTER has been linked to the STAC4713 campaign and is described as targeting hypervisors and using encryptors for VMware and ESXi environments. Content also notes reported links to former BlackBasta affiliates. Observed initial access methods include targeting exposed Cisco and SonicWall SSL VPN devices, exploitation of SolarWinds Web Help Desk vulnerability CVE-2025-26399, and email-bombing or phishing that leads to Microsoft Teams vishing and Quick Assist abuse. Post-compromise activity includes use of QuickAssist and SuperOps for remote management, DLL sideloading to launch Havoc C2, and establishment of SSH backdoors using AdaptixC2 or OpenSSH. The group has also been observed abusing QEMU to run hidden Alpine Linux virtual machines as SYSTEM, including via a scheduled task named TPMProfiler, with disguised virtual disk images, port forwarding, and reverse SSH tunnels to evade host-based security controls. Credential access and collection activity includes copying NTDS.dit and the SAM and SYSTEM hives via SMB using the print command, as well as use of shadow copies. Data theft and staging have involved WinSCP and Rclone, including exfiltration to remote SFTP locations. Defense evasion includes attempts to disable antivirus and EDR using a bring-your-own-vulnerable-driver technique. Tooling directly associated in the content includes PayoutsKing ransomware, QEMU, Havoc C2, AdaptixC2, OpenSSH, QuickAssist, SuperOps, WinSCP, Rclone, Chisel, BusyBox, wg-obfuscator, and WebDAV hosting. Known aliases and related naming in the content include PayoutsKing Group for the ransomware operation. GOLD ENCOUNTER is the attributed threat group name.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
26 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
5 malware families attributed to this actor across reporting.
Associated vulnerabilities
1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.
Observables
5 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A threat actor group linked to Payouts King and former BlackBasta affiliates, using stealth-focused ransomware tradecraft including virtualization-based evasion and enterprise compromise techniques.
Conducting ransomware intrusions using QEMU to create hidden virtual machines for credential harvesting, data exfiltration, evasion of endpoint security, and reverse SSH backdoor access.
Threat group attributed to the STAC4713 campaign and linked to the PayoutsKing ransomware operation. It targets hypervisor environments and has developed encryptors for VMware and ESXi platforms, while using QEMU-based hidden VMs to evade detection and support credential theft and ransomware activity.
Threat group attributed with the PayoutsKing ransomware and extortion operation, focused on hypervisors and virtualized environments including VMware and ESXi.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.