Loading malware…
Payouts King is a Windows ransomware family and associated double-extortion operation first observed in April 2025. Its operators steal sensitive data, selectively deploy file encryption, and threaten publication through a Tor-based leak site. Victims include manufacturing, professional services, technology, and healthcare organizations, particularly in the United States and Europe. Sophos tracks associated activity as GOLD ENCOUNTER and STAC4713; some campaigns have separately been linked to former BlackBasta affiliates.
Observed intrusions use email bombing followed by Microsoft Teams phishing or voice-based impersonation of IT support, persuading victims to grant remote access through Quick Assist. Other entry points include exposed VPN services, VPN accounts without multifactor authentication, and exploitation of SolarWinds Web Help Desk vulnerability CVE-2025-26399. Post-compromise activity includes credential theft, network-share discovery, and data exfiltration using Rclone. Operators have used hidden QEMU virtual machines running Alpine Linux to conceal offensive tooling and SSH tunneling from host-based security products. Other observed intrusions used DLL sideloading to execute Havoc command-and-control payloads.
The ransomware encrypts files using per-file AES-256-CTR keys protected with RSA-4096. It supports local-disk and network-share encryption, fully encrypts smaller files, and uses intermittent encryption across 13 blocks for larger files. Scheduled tasks provide persistence and execution with SYSTEM privileges. Anti-analysis features include runtime string decryption, hashed API resolution, and a required identity argument validated before encryption. When file access is blocked, the malware can identify and terminate security-related processes using direct system calls to bypass user-mode security hooks. It also deletes volume shadow copies, empties the recycle bin, and clears Windows event logs to impede recovery and investigation.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
3 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Payouts King steals large amounts of data, encrypts selectively, and posts victims to a Tor leak site.
A new ransomware group known as Payouts King has quietly been building a reputation since it first appeared in April 2025.
A relatively unknown ransomware group called Payouts King has emerged as a serious cybersecurity threat... Once a foothold is established on the victim’s network, Payouts King deploys its ransomware payload, steals large volumes of sensitive data, and then selectively encrypts files.
26 distinct techniques documented for this family, organized by ATT&CK tactic.
The technique of spam bombing combined with phishing and vishing continues to be an effective technique...
The Payouts King ransomware... exhibits maturity through diverse initial access methods (including VPN exploitation, social engineering via Microsoft Teams, and vulnerability abuse)...
The technique of spam bombing combined with phishing and vishing continues to be an effective technique...
The Payouts King ransomware... exhibits maturity through diverse initial access methods (including VPN exploitation, social engineering via Microsoft Teams, and vulnerability abuse)...
If the -nopersist parameter is not passed on the command-line, persistence is established using scheduled tasks... If the -noelevate parameter is not specified, Payouts King will schedule another task to elevate privileges and run as the SYSTEM user...
The code then calls CreateProcess to launch cmd.exe without any arguments and redirects standard input and output to one end of the pipe. The ransomware code then writes the commands to the other end of the cmd.exe pipe...
However, instead of using standard Windows API calls, the ransomware uses low-level direct system calls to evade antivirus and EDR hooks.
If the -nopersist parameter is not passed on the command-line, persistence is established using scheduled tasks... If the -noelevate parameter is not specified, Payouts King will schedule another task to elevate privileges and run as the SYSTEM user...
The Payouts King ransomware... exhibits maturity through diverse initial access methods (including VPN exploitation, social engineering via Microsoft Teams, and vulnerability abuse)...
If the -nopersist parameter is not passed on the command-line, persistence is established using scheduled tasks...
If the -nopersist parameter is not passed on the command-line, persistence is established using scheduled tasks... If the -noelevate parameter is not specified, Payouts King will schedule another task to elevate privileges and run as the SYSTEM user...
If the -nopersist parameter is not passed on the command-line, persistence is established using scheduled tasks...
It builds and decrypts strings on the fly rather than storing them as readable text, making static analysis much harder.
It also resolves Windows functions using hash values instead of plain names, and applies a custom checksum algorithm with a unique seed per value, defeating tools that rely on pre-built hash tables to identify malware.
It attempts to gain full system-level privileges, deletes Windows shadow copies to block recovery, clears event logs to slow forensic investigations, and empties the recycle bin before starting encryption.
When a file cannot be opened for encryption since a security tool has locked it, the ransomware scans all running processes and checks them against a list of 131 known antivirus and endpoint detection software processes. | the ransom note named readme_locker.txt is only dropped when a specific command-line flag is provided at runtime, making automated sandbox analysis considerably harder.
By default the ransomware will not perform file encryption unless the -i parameter is specified with a value whose CRC checksum matches an expected value. This is likely an anti-sandbox evasion technique.
Rather than using standard Windows API calls to terminate these tools, it uses direct system calls that bypass the hooks most endpoint detection products depend on to catch suspicious activity.
It attempts to gain full system-level privileges, deletes Windows shadow copies to block recovery, clears event logs to slow forensic investigations, and empties the recycle bin before starting encryption.
This is complemented by the use of Cobalt Strike, Mimikatz...
The campaign also exhibits maturity through diverse initial access methods ... and extensive post-compromise activity, such as credential extraction (e.g., NTDS.dit)...
...extensive post-compromise activity, such as credential extraction (e.g., NTDS.dit), Active Directory reconnaissance, and controlled data exfiltration.
If opening fails due to an error code 32 (ERROR_SHARING_VIOLATION), the ransomware will enumerate the running processes and compute a checksum value for each process name...
The following files are not encrypted... The following directories are also skipped... After the content of a file is encrypted, the file is renamed...
When a file cannot be opened for encryption since a security tool has locked it, the ransomware scans all running processes and checks them against a list of 131 known antivirus and endpoint detection software processes. | the ransom note named readme_locker.txt is only dropped when a specific command-line flag is provided at runtime, making automated sandbox analysis considerably harder.
By default the ransomware will not perform file encryption unless the -i parameter is specified with a value whose CRC checksum matches an expected value. This is likely an anti-sandbox evasion technique.
They then impersonate an IT support employee, reaching out via Microsoft Teams and convincing the victim to initiate a Quick Assist session. Once access is granted, the attacker drops malware on the system, quietly establishing a foothold inside the organization’s network.
The victim is instructed to join a Microsoft Teams call and initiate Quick Assist. If the victim falls for the ruse, the threat actor deploys malware onto the victim’s system...
...extensive post-compromise activity, such as credential extraction (e.g., NTDS.dit), Active Directory reconnaissance, and controlled data exfiltration.
The group targets organizations through well-worn but effective tactics, stealing large volumes of sensitive data before selectively encrypting files on compromised systems.
The group targets organizations through well-worn but effective tactics, stealing large volumes of sensitive data before selectively encrypting files on compromised systems.
The group also operates a dark web data leak site, adding pressure on victims to pay by threatening to publish stolen information.
4 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.