Loading threat actor…
GOLD ENCOUNTER is a financially motivated cybercriminal threat group that operates the PayoutsKing ransomware and extortion operation. The group emerged in mid-2025 and is associated with a double-extortion model that combines data theft with file encryption, followed by public victim shaming on a leak site. Available reporting indicates the operation is conducted directly by the group rather than through a ransomware-as-a-service affiliate structure. Some reporting also links the operation to former Black Basta affiliates based on overlapping tradecraft. GOLD ENCOUNTER has demonstrated a focus on enterprise and virtualized infrastructure, including hypervisors and VMware ESXi environments, and has used encryptors tailored for those platforms. Observed initial access methods include exploitation of exposed Cisco and SonicWall SSL VPN appliances, exploitation of SolarWinds Web Help Desk vulnerability CVE-2025-26399, and social-engineering campaigns involving email bombing followed by Microsoft Teams impersonation of IT staff to induce victims to install remote-access tooling such as Quick Assist. The group has also used remote monitoring and management software for hands-on access. A notable hallmark of GOLD ENCOUNTER tradecraft is the abuse of QEMU to launch hidden Alpine Linux virtual machines on compromised hosts under SYSTEM privileges. These covert virtualized environments have been used to evade host-based endpoint defenses, establish reverse SSH access, host attacker tooling, harvest credentials, stage data, and support ransomware deployment. In the STAC4713 intrusion cluster attributed to GOLD ENCOUNTER, the group used scheduled tasks, disguised virtual disk images, port forwarding, and reverse SSH tunneling to maintain covert access. Tooling associated with the group includes Havoc C2, AdaptixC2, OpenSSH, QEMU, Rclone, WinSCP, and other utilities used for tunneling, obfuscation, and exfiltration. Post-compromise activity has included DLL sideloading to launch command-and-control frameworks, establishment of SSH backdoors, credential harvesting from Active Directory-related stores, shadow-copy abuse, and attempts to disable antivirus and endpoint detection products through bring-your-own-vulnerable-driver techniques. Before encryption, the group has exfiltrated victim data to remote infrastructure using common transfer tools. GOLD ENCOUNTER therefore exhibits mature capabilities across initial access, defense evasion, persistence, credential theft, exfiltration, and ransomware deployment, with particular sophistication in stealthy operations against virtualized enterprise environments.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
26 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
5 malware families attributed to this actor across reporting.
1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.
5 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A threat actor group linked to Payouts King and former BlackBasta affiliates, using stealth-focused ransomware tradecraft including virtualization-based evasion and enterprise compromise techniques.
Conducting ransomware intrusions using QEMU to create hidden virtual machines for credential harvesting, data exfiltration, evasion of endpoint security, and reverse SSH backdoor access.
Threat group attributed to the STAC4713 campaign and linked to the PayoutsKing ransomware operation. It targets hypervisor environments and has developed encryptors for VMware and ESXi platforms, while using QEMU-based hidden VMs to evade detection and support credential theft and ransomware activity.
Threat group attributed with the PayoutsKing ransomware and extortion operation, focused on hypervisors and virtualized environments including VMware and ESXi.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.