PayoutsKing
PayoutsKing is a double-extortion ransomware operation linked in the provided reporting to the GOLD ENCOUNTER threat group. The malware operation steals victim data and encrypts files before demanding payment, and the reporting states it is not operated as a ransomware-as-a-service model and does not rely on affiliates. Sophos-linked activity ties PayoutsKing to the STAC4713 campaign, first observed in November 2025, in which attackers abused hidden QEMU virtual machines to evade host-based security controls, maintain covert access, harvest credentials, exfiltrate data, and ultimately deploy ransomware. The campaign used a scheduled task named TPMProfiler to launch qemu-system-x86_64.exe as SYSTEM, booting disguised virtual disk images such as vault.db and later bisrv.dll, with port forwarding from 32567 and 22022 to SSH and reverse SSH tunnels established via AdaptixC2 or OpenSSH. Reporting states the hidden VM used Alpine Linux 3.22.0 and contained tooling including Linker2, AdaptixC2, wg-obfuscator, BusyBox, Chisel, and Rclone. Initial access associated with PayoutsKing activity included exposed Cisco or SonicWall SSL VPN devices, exposed VPN systems lacking MFA, exploitation of SolarWinds Web Help Desk vulnerability CVE-2025-26399, and email-bombing followed by Microsoft Teams vishing. Post-compromise behavior associated with the operators included use of QuickAssist and SuperOps for remote access, Havoc C2 via DLL sideloading, SSH backdoors via AdaptixC2 or OpenSSH, credential harvesting including copying NTDS.dit, SAM, and SYSTEM hives over SMB, attempted AV/EDR disabling via BYOVD, and data exfiltration using WinSCP and Rclone to remote SFTP infrastructure. The content further states that PayoutsKing focuses on hypervisor environments and has developed encryptors for VMware and ESXi systems.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Older incidents leveraged exposed SonicWall VPNs that did not have multi-factor authentication (MFA) enabled, while a January 2026 incident exploited a SolarWinds Web Help Desk vulnerability (CVE-2025-26399). In February, Microsoft and Huntress reported similar observations of this vulnerability leading to QEMU deployment.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
GOLD ENCOUNTER is a cybercriminal threat group that operators the PayoutsKing double extortion operation, stealing data and encrypting files before demanding a ransom payment from victims.
AdaptixC2 is an open-source red-teaming framework that we’ve seen used in ransomware attacks, specifically as part of a threat activity cluster we track as STAC4713, involving PayoutsKing ransomware.
Techniques & procedures
3 distinct techniques documented for this family, organized by ATT&CK tactic.
Execution
1 techniqueThe use of hidden virtual machines (VMs) enables long-term access, credential harvesting, data exfiltration, and PayoutsKing ransomware deployment
Stealth
1 techniqueDiscovery
1 techniqueImpact
1 techniqueThreat actors are now weaponizing QEMU... to steal credentials and deliver ransomware... The STAC4713 campaign... is directly linked to the PayoutsKing ransomware operation...
Recent activity
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A ransomware family mentioned as part of a threat activity cluster where AdaptixC2 was used.
PayoutsKing is a ransomware family linked to the STAC4713 campaign and is described as focusing on encrypting virtualized environments, including hypervisors and VMware/ESXi systems.
Ransomware operation linked to the STAC4713 campaign. It emerged in mid-2025, is operated directly rather than as a ransomware-as-a-service model, and targets hypervisor environments with encryptors for VMware and ESXi platforms.
Ransomware used in financially motivated intrusions where attackers leverage QEMU-based virtual machines for stealth, data theft, persistence, and eventual encryption/extortion operations, with encryptors targeting VMware and ESXi environments.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.