GOLD ENCOUNTER

GOLD ENCOUNTER is a financially motivated cybercriminal threat group that operates the PayoutsKing ransomware and extortion operation. The group emerged in mid-2025 and is associated with a double-extortion model that combines data theft with file encryption, followed by public victim shaming on a leak site. Available reporting indicates the operation is conducted directly by the group rather than through a ransomware-as-a-service affiliate structure. Some reporting also links the operation to former Black Basta affiliates based on overlapping tradecraft. GOLD ENCOUNTER has demonstrated a focus on enterprise and virtualized infrastructure, including hypervisors and VMware ESXi environments, and has used encryptors tailored for those platforms. Observed initial access methods include exploitation of exposed Cisco and SonicWall SSL VPN appliances, exploitation of SolarWinds Web Help Desk vulnerability CVE-2025-26399, and social-engineering campaigns involving email bombing followed by Microsoft Teams impersonation of IT staff to induce victims to install remote-access tooling such as Quick Assist. The group has also used remote monitoring and management software for hands-on access. A notable hallmark of GOLD ENCOUNTER tradecraft is the abuse of QEMU to launch hidden Alpine Linux virtual machines on compromised hosts under SYSTEM privileges. These covert virtualized environments have been used to evade host-based endpoint defenses, establish reverse SSH access, host attacker tooling, harvest credentials, stage data, and support ransomware deployment. In the STAC4713 intrusion cluster attributed to GOLD ENCOUNTER, the group used scheduled tasks, disguised virtual disk images, port forwarding, and reverse SSH tunneling to maintain covert access. Tooling associated with the group includes Havoc C2, AdaptixC2, OpenSSH, QEMU, Rclone, WinSCP, and other utilities used for tunneling, obfuscation, and exfiltration. Post-compromise activity has included DLL sideloading to launch command-and-control frameworks, establishment of SSH backdoors, credential harvesting from Active Directory-related stores, shadow-copy abuse, and attempts to disable antivirus and endpoint detection products through bring-your-own-vulnerable-driver techniques. Before encryption, the group has exfiltrated victim data to remote infrastructure using common transfer tools. GOLD ENCOUNTER therefore exhibits mature capabilities across initial access, defense evasion, persistence, credential theft, exfiltration, and ransomware deployment, with particular sophistication in stealthy operations against virtualized enterprise environments.