Loading malware…
PayoutsKing is a double-extortion ransomware operation linked in the provided reporting to the GOLD ENCOUNTER threat group. The malware operation steals victim data and encrypts files before demanding payment, and the reporting states it is not operated as a ransomware-as-a-service model and does not rely on affiliates. Sophos-linked activity ties PayoutsKing to the STAC4713 campaign, first observed in November 2025, in which attackers abused hidden QEMU virtual machines to evade host-based security controls, maintain covert access, harvest credentials, exfiltrate data, and ultimately deploy ransomware. The campaign used a scheduled task named TPMProfiler to launch qemu-system-x86_64.exe as SYSTEM, booting disguised virtual disk images such as vault.db and later bisrv.dll, with port forwarding from 32567 and 22022 to SSH and reverse SSH tunnels established via AdaptixC2 or OpenSSH. Reporting states the hidden VM used Alpine Linux 3.22.0 and contained tooling including Linker2, AdaptixC2, wg-obfuscator, BusyBox, Chisel, and Rclone. Initial access associated with PayoutsKing activity included exposed Cisco or SonicWall SSL VPN devices, exposed VPN systems lacking MFA, exploitation of SolarWinds Web Help Desk vulnerability CVE-2025-26399, and email-bombing followed by Microsoft Teams vishing. Post-compromise behavior associated with the operators included use of QuickAssist and SuperOps for remote access, Havoc C2 via DLL sideloading, SSH backdoors via AdaptixC2 or OpenSSH, credential harvesting including copying NTDS.dit, SAM, and SYSTEM hives over SMB, attempted AV/EDR disabling via BYOVD, and data exfiltration using WinSCP and Rclone to remote SFTP infrastructure. The content further states that PayoutsKing focuses on hypervisor environments and has developed encryptors for VMware and ESXi systems.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
2 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
GOLD ENCOUNTER is a cybercriminal threat group that operators the PayoutsKing double extortion operation, stealing data and encrypting files before demanding a ransom payment from victims.
AdaptixC2 is an open-source red-teaming framework that we’ve seen used in ransomware attacks, specifically as part of a threat activity cluster we track as STAC4713, involving PayoutsKing ransomware.
3 distinct techniques documented for this family, organized by ATT&CK tactic.
The use of hidden virtual machines (VMs) enables long-term access, credential harvesting, data exfiltration, and PayoutsKing ransomware deployment
Threat actors are now weaponizing QEMU, a legitimate open-source machine emulator and virtualizer, as a covert backdoor... malicious activity running inside a virtual machine (VM) is essentially invisible to most endpoint protection tools.
Threat actors are now weaponizing QEMU, a legitimate open-source machine emulator and virtualizer, as a covert backdoor... malicious activity running inside a virtual machine (VM) is essentially invisible to most endpoint protection tools.
Threat actors are now weaponizing QEMU... to steal credentials and deliver ransomware... The STAC4713 campaign... is directly linked to the PayoutsKing ransomware operation...
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.