*Published: 4/14/2026 · Updated: 9/19/2026* # Payouts King Ransomware **Type:** Ransomware and data-extortion operation, self-declared "not RaaS, no affiliates" **Also tracked as:** GOLD ENCOUNTER (Sophos CTU), STAC4713 activity (Sophos), PayoutsKing (ransomware.live, RansomLook) **First observed:** April 2025 per Zscaler; leak site live July 7, 2025 per ransomware.live **Status:** Active. 110 leak-site victims as of September 2, 2026, the most recent posting on ransomware.live. --- ## Threat Overview Payouts King steals large amounts of data, encrypts selectively, and posts victims to a Tor leak site. The operators say they don't run a RaaS or take affiliates. Sophos's Counter Threat Unit attributes the operation to a group it tracks as GOLD ENCOUNTER and describes it as focused on hypervisors, with encryptors for both VMware and ESXi. Zscaler ties the attacks it analyzed in early 2026 to former BlackBasta affiliates, the initial access crews that moved to other brands after BlackBasta's chat logs leaked in February 2025. Neither vendor says whether those describe the same people. The first version of this profile called the group unsophisticated, which the April 2026 reporting doesn't support. The locker hashes its strings and API imports with a unique seed per value, refuses to encrypt without a checksummed identity argument, and kills security tools holding its target files open through direct system calls. On the intrusion side, Sophos documented the operators running their toolkit from a hidden QEMU virtual machine that host EDR can't see into. | Field | Value | |---|---| | Ransom note | `readme_locker.txt`, written only when the locker runs with `-note` | | Encryption | RSA-4096 over per-file AES-256-CTR keys (statically linked OpenSSL); ChaCha20 code present but unused | | File extension | `.ZWIAAW` in the samples Zscaler analyzed | | Contact | Tox ID: `535F403A...CF00EC8B57D4` (truncated) | | Leak site | `payoutsgn7cy6uliwevdqspncjpfxpmzgirwl2au65la7rfs5x3qnbqd.onion` | | File server | `v2mw3spxqhggig5zjd6tjnfamwntrprreij3dq77jlq74dduyjafeead.onion` (87% uptime) | | Top targets (geo) | US (68), Germany (15), UK (9), Italy (5), Spain (3) | | Top targets (sector) | Manufacturing (25), Professional Services (11), Technology (10), Healthcare (6); 37 postings list no sector | | Exfil volume | 267 GB (Peugeot Motocycles) to 2.5 TB (Prater Engineering) | | Infostealer overlap | 5.0% of victims had prior infostealer infections (ransomware.live, April 2026) | Victim counts, geography and sectors are from ransomware.live as of September 2, 2026. --- ## Activity Standing Payouts King is a mid-tier operator by volume. Its 110 postings over fourteen months compare with 342 for Qilin and 194 for Akira in Q1 2026 alone. The leak site publishes in batches (21 postings in July 2025, 39 in April 2026), so ransomware.live's attack dates are the better read on tempo. Those run between one and nine attacks a month from April to October 2025, jump to 23 in November, hold at 9 to 15 a month from January through April 2026, then fall to none in May and three a month from June through August. The drop starts right after Zscaler and Sophos published on April 16, though nothing public ties the two. Sophos describes two phases of tradecraft. From November 2025 through January 2026 the group came in through SonicWall VPNs without MFA and, in January, through SolarWinds Web Help Desk, then worked from a hidden QEMU VM. From February 2026 it dropped QEMU, came in through an exposed Cisco SSL VPN in one case and a Teams vishing call in another, and ran Havoc C2 sideloaded into a legitimate binary. Zscaler's early-2026 cases match the second phase. Sophos reads the variation as deliberate choices by one group rather than separate actors, which fits the no-affiliates claim without proving it. --- ## Initial Access **Edge access:** SonicWall SSL VPN accounts without MFA (November 2025 to January 2026) and an exposed Cisco SSL VPN (February 2026), per Sophos. **Exploitation:** SolarWinds Web Help Desk, CVE-2025-26399, in a January 2026 intrusion (Sophos). **Social engineering:** A burst of spam to the target mailbox, then a Microsoft Teams call from someone posing as internal IT who talks the user into starting Quick Assist. Zscaler reports this across early-2026 attacks and Sophos saw it in March 2026. --- ## Infection Chain ### Step 1 - Initial Access T1133 (External Remote Services), T1190 (Exploit Public-Facing Application), T1566.004 (Spearphishing Voice), T1219 (Remote Access Software) | Operator The three routes are covered above. The vishing route ends with the operator on the user's desktop through Quick Assist, and Zscaler says malware goes down from there to hold the foothold. > **Detection Opportunity:** `QuickAssist.exe` starting on a workstation shortly after an external Teams call, on a mailbox that just took a spam flood, is the whole social-engineering chain in one sequence, and each piece alone is too common to alert on. The VPN and Web Help Desk routes only show up in appliance and application logs, so coverage there depends on ingesting them. ### Step 2 - Covert Access: Hidden QEMU VM (Nov 2025 to Jan 2026) T1564.006 (Run Virtual Instance), T1053.005 (Scheduled Task), T1572 (Protocol Tunneling) | Operator A scheduled task named `TPMProfiler` launches `qemu-system-x86_64.exe` as SYSTEM against a disk image disguised as `vault.db`, switched to `bisrv.dll` in January 2026, and forwards host ports 32567 and 22022 to the guest's SSH port. The guest is Alpine Linux 3.22.0 carrying AdaptixC2, Chisel, Rclone, BusyBox and a custom WireGuard traffic obfuscator, and on boot it opens a reverse SSH tunnel out through AdaptixC2 or OpenSSH. From then on the operators work inside a machine the host's EDR can't see. > **Detection Opportunity:** The task name and disk-image names are operator choices and have already changed once. What doesn't change is `qemu-system-x86_64.exe` running as SYSTEM out of a scheduled task with a port forward into the guest, which almost no enterprise endpoint has a reason to do. A QEMU binary on a Windows server at all is worth a look. ### Step 3 - Command and Control (Feb 2026 onward) T1574.002 (DLL Side-Loading) | Operator After dropping QEMU, the operators sideloaded a Havoc C2 payload named `vcruntime140_1.dll` beside a legitimate `ADNotificationManager.exe`. > **Detection Opportunity:** `ADNotificationManager.exe` running from a staging directory with its own copy of `vcruntime140_1.dll` beside it is the sideload. ### Step 4 - Discovery T1135 (Network Share Discovery), T1083 (File and Directory Discovery) | Operator Share discovery and file access ran through Paint, Notepad, Microsoft Edge and the free WizTree disk analyzer, none of which leaves a discovery command in process telemetry. > **Detection Opportunity:** This step is close to invisible by design. WizTree appearing on a server is the one piece with a clean process signal. ### Step 5 - Credential Access T1003.003 (NTDS) | Operator The operators created a shadow copy through the VSS GUI, `vssuirun.exe`, and then used the `print` command to copy NTDS.dit and the SAM and SYSTEM hives out of it into temp directories over SMB. > **Detection Opportunity:** `print.exe` with a `/D:` destination is a known file-copy LOLBin, and a source path containing `NTDS.dit` or `\config\SAM` makes it unambiguous. `vssuirun.exe` is rare enough on a domain controller to stand on its own. > > See rule(s): [[edr-win-cred-shadow-copy-abuse]] | [[edr-win-cred-reg-hive-dump]] ### Step 6 - Exfiltration T1048 (Exfiltration Over Alternative Protocol) | Operator Rclone in both phases. In the QEMU phase it ran inside the guest, and in the later phase it pushed data to a remote SFTP server. > **Detection Opportunity:** Rclone inside the VM never touches host process telemetry, but the transfer still leaves through the host's network interface, so outbound volume from a server to an unfamiliar SFTP endpoint is the backstop. > > See rule: [[edr-win-exfil-rclone-usage]] ### Step 7 - Impact T1486 (Data Encrypted for Impact), T1490 (Inhibit System Recovery), T1070.001 (Clear Windows Event Logs), T1562.001 (Disable or Modify Tools) | Malware The locker won't encrypt anything unless it's launched with an `-i` value whose checksum matches a hardcoded one, which keeps it inert in a sandbox. Unless run with `-nopersist` it creates a SYSTEM scheduled task at `\Mozilla\UpdateTask`, and to elevate it creates, runs and deletes `\Mozilla\ElevateTask` in quick succession, writing each `schtasks` command into a `cmd.exe` it launched with no arguments. Files are encrypted with RSA-4096 over per-file AES-256-CTR keys, anything over 10 MB in 13 half-encrypted blocks, and renamed through `SetFileInformationByHandle` rather than `MoveFile`. When a target file is locked, the locker checks running processes against 131 checksummed names, mostly AV and EDR agents, and kills any match through direct system calls. It deletes shadow copies with `vssadmin`, empties the recycle bin, clears the event logs, and only drops `readme_locker.txt` when run with `-note`. > **Detection Opportunity:** Scheduled tasks created under `\Mozilla\` as SYSTEM, with the parent `cmd.exe` carrying an empty command line, are specific to this locker, and the create-run-delete of `ElevateTask` inside a few seconds is the elevation step. Shadow-copy deletion and event-log clearing are the generic backstop. > > See rule(s): [[edr-win-persist-schtask-abuse]] | [[edr-win-impact-inhibit-recovery]] --- ## Raw Command Lines Zscaler published the locker's own scheduled-task and recovery commands. Sophos described the QEMU setup in prose without publishing command lines, so the task name, disk images and ports in Step 2 come from its text. > [!example]- Locker persistence, elevation and recovery inhibition (Zscaler) > ``` > schtasks.exe /s "localhost" /ru "SYSTEM" /create /f /sc ONSTART /TN \Mozilla\UpdateTask /TR "" > schtasks.exe /s "localhost" /ru "SYSTEM" /create /f /sc ONSTART /TN \Mozilla\ElevateTask /TR "" > schtasks.exe /run /tn \Mozilla\ElevateTask > schtasks.exe /delete /tn \Mozilla\ElevateTask /f > vssadmin.exe delete shadows /all /quiet > ``` > [!example]- Locker command-line parameters (Zscaler, recovered from CRC checksums) > ``` > -backup use temporary backup files during encryption > -noelevate skip privilege elevation > -nohide don't hide the window > -i <string> identity value; encryption only runs when its checksum matches > -log <file> log file path > -mode <all|local|share> what to encrypt > -note write readme_locker.txt > -path <path> start encrypting at this path > -percent <n> percentage of each file to encrypt > -nopersist skip the \Mozilla\UpdateTask persistence task > -time <seconds> delay before encryption starts > ``` --- ## Intelligence Gaps This profile was first published April 14, 2026. Zscaler and Sophos both published two days later and closed the gaps it originally listed around encryption, initial access, tooling and attribution, and the sections above now draw on those reports. What remains open: - Neither vendor says whether GOLD ENCOUNTER and the former BlackBasta affiliates Zscaler describes are the same people. Sophos reads the variation in tradecraft as one group making deliberate choices, which fits the operators' no-affiliates claim without proving it. - Neither report describes how the group moves laterally once inside. - Ransom amounts, payment methods and negotiation patterns haven't been documented publicly. - Dwell time inside victim networks is undocumented. ransomware.live puts the average delay between attack and discovery at 38.9 days, which measures something different. --- ## Confidence Assessment | Claim | Confidence | Evidence | Flips if... | |---|---|---|---| | 110 leak-site victims since July 2025 | HIGH | ransomware.live, RansomLook | Inflated or recycled claims (common with new groups) | | Initial access via VPN abuse, Web Help Desk exploitation, and Teams vishing | HIGH | Sophos and Zscaler incident reporting | New vectors surface | | Operated by one group (GOLD ENCOUNTER) | MEDIUM | Sophos CTU attribution, operators' no-affiliates claim | Separate actors surface with distinct infrastructure | | Linked to former BlackBasta affiliates | MEDIUM | Zscaler attribution of early-2026 attacks | GOLD ENCOUNTER shown to be unrelated | | Hidden QEMU VM retired since February 2026 | MEDIUM | Sophos, across its own cases | QEMU reappears in later intrusions | | Double extortion model | HIGH | Leak site operational, data samples posted | Encryption-only incidents surface | | US and Germany primary targets | HIGH | Consistent across all trackers | Targeting shifts | | Still operationally active (Sep 2026) | MEDIUM | Posting on Sep 2, 2026; attack tempo down since April | Leak site goes dark | --- ## Detections Sigma rules applicable to documented Payouts King behavior: | Rule ID | Description | |---|---| | [[edr-win-cred-shadow-copy-abuse]] | Shadow Copy Access via LOLbin Parents | | [[edr-win-cred-reg-hive-dump]] | Registry Hive Credential Dump | | [[edr-win-exfil-rclone-usage]] | Rclone Data Exfiltration | | [[edr-win-persist-schtask-abuse]] | Suspicious Persistence via Scheduled Tasks or PowerShell | | [[edr-win-impact-inhibit-recovery]] | System Recovery Inhibition | --- ## Key Publications 1. [Ransomware.live - PayoutsKing Tracker](https://www.ransomware.live/group/payoutsking) (ongoing) 2. [Ransomware.live - PayoutsKing Statistics](https://www.ransomware.live/groupstats/payoutsking) (ongoing) 3. [RansomLook - PayoutsKing Details](https://www.ransomlook.io/group/payoutsking) (ongoing) 4. [BlackFog - Payouts King Overview](https://www.blackfog.com/cybersecurity-101/payouts-king/) (2025) 5. [WatchGuard - Payouts King Ransomware Tracker](https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/payouts-king) (2025, under construction) 6. [FalconFeeds.io - Initial Payouts King Alert](https://x.com/FalconFeedsio/status/1942255648101773504) (Jul 2025) 7. [FalconFeeds.io - Creditinfo Group Attack](https://x.com/FalconFeedsio/status/1948231076507480573) (Jul 2025) 8. [Mjolnir Security - PayoutsKing Profile](https://intel.mjolnirsecurity.com/rw-payoutsking) (2025) 9. [Zscaler ThreatLabz - Payouts King Takes Aim at the Ransomware Throne](https://www.zscaler.com/blogs/security-research/payouts-king-takes-aim-ransomware-throne) (Apr 16, 2026) 10. [Sophos - QEMU abused to evade detection and enable ransomware delivery](https://www.sophos.com/en-us/blog/qemu-abused-to-evade-detection-and-enable-ransomware-delivery) (Apr 16, 2026)