Skip to main content
Mallory
5 malware familiesExploits CVEs in the wild

GOLD ENCOUNTER

Also known asGOLD ENCOUNTER

GOLD ENCOUNTER is a financially motivated cybercriminal threat group attributed to the PayoutsKing ransomware and double-extortion operation, active since mid-2025. The group steals data and encrypts victim files before demanding payment, and reporting states that PayoutsKing is not operated as a ransomware-as-a-service model and does not rely on affiliates. GOLD ENCOUNTER has been linked to the STAC4713 campaign and is described as targeting hypervisors and using encryptors for VMware and ESXi environments. Content also notes reported links to former BlackBasta affiliates. Observed initial access methods include targeting exposed Cisco and SonicWall SSL VPN devices, exploitation of SolarWinds Web Help Desk vulnerability CVE-2025-26399, and email-bombing or phishing that leads to Microsoft Teams vishing and Quick Assist abuse. Post-compromise activity includes use of QuickAssist and SuperOps for remote management, DLL sideloading to launch Havoc C2, and establishment of SSH backdoors using AdaptixC2 or OpenSSH. The group has also been observed abusing QEMU to run hidden Alpine Linux virtual machines as SYSTEM, including via a scheduled task named TPMProfiler, with disguised virtual disk images, port forwarding, and reverse SSH tunnels to evade host-based security controls. Credential access and collection activity includes copying NTDS.dit and the SAM and SYSTEM hives via SMB using the print command, as well as use of shadow copies. Data theft and staging have involved WinSCP and Rclone, including exfiltration to remote SFTP locations. Defense evasion includes attempts to disable antivirus and EDR using a bring-your-own-vulnerable-driver technique. Tooling directly associated in the content includes PayoutsKing ransomware, QEMU, Havoc C2, AdaptixC2, OpenSSH, QuickAssist, SuperOps, WinSCP, Rclone, Chisel, BusyBox, wg-obfuscator, and WebDAV hosting. Known aliases and related naming in the content include PayoutsKing Group for the ransomware operation. GOLD ENCOUNTER is the attributed threat group name.

Share:
Are they targeting you?

Know when an actor pivots toward your sector

Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.

MITRE ATT&CK

Tradecraft

26 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.

11 of 15 tactics35 techniques×N= number of intelligence reports citing this technique
MITRE ATT&CK
TA0001
Initial Access
4 techniques
T1078
Valid Accounts
T1133×3
External Remote Services
T1190×3
Exploit Public-Facing Application
T1566×4
Phishing
T1566.003
Spearphishing via Service
TA0002
Execution
3 techniques
T1053
Scheduled Task/Job
T1053.005
Scheduled Task
T1059
Command and Scripting Interpreter
T1569
System Services
T1569.002
Service Execution
TA0003
Persistence
3 techniques
T1053
Scheduled Task/Job
T1053.005
Scheduled Task
T1078
Valid Accounts
T1133×3
External Remote Services
TA0004
Privilege Escalation
2 techniques
T1053
Scheduled Task/Job
T1053.005
Scheduled Task
T1078
Valid Accounts
TA0005
Stealth
3 techniques
T1036
Masquerading
T1078
Valid Accounts
T1497×6
Virtualization/Sandbox Evasion
TA0006
Credential Access
1 technique
T1003×3
OS Credential Dumping
T1003.003
NTDS
TA0007
Discovery
2 techniques
T1018
Remote System Discovery
T1497×6
Virtualization/Sandbox Evasion
TA0008
Lateral Movement
1 technique
T1021
Remote Services
T1021.002
SMB/Windows Admin Shares
T1021.004×2
SSH
TA0011
Command and Control
3 techniques
T1090
Proxy
T1090.002×2
External Proxy
T1105
Ingress Tool Transfer
T1219
Remote Access Tools
TA0010
Exfiltration
3 techniques
T1041
Exfiltration Over C2 Channel
T1048×3
Exfiltration Over Alternative Protocol
T1567
Exfiltration Over Web Service
TA0040
Impact
1 technique
T1486×3
Data Encrypted for Impact
IOCS

Observables

5 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.

IOC values are gated. View more in Mallory for domains, IPs, hashes, and other artifacts, or pipe them straight into your SIEM.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: sector and geo overlap with your footprint, the IOCs they’re burning right now, detection coverage, and what to do next.
Target overlap

Match sector + geo + tech-stack targeting against your real footprint.

Tradecraft mapping26

Every observed MITRE ATT&CK technique, grouped by tactic.

Malware arsenal5

Families this actor is known to deploy, with IOCs and behavior.

Exploited CVEs1

CVEs this actor has used in known campaigns.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Observables5

Domains, IPs, and hashes tied to this actor, refreshed continuously.