Ransomware Group intelligence
Payoutsking
ActiveTrack Payoutsking with 158 published victims and 1 known leak locations in a single intelligence view.
BREACH HOUSE ALERTS
Want an alert every time a new ransomware post is published?
Choose the feeds and the countries you care about — we email you when they move.
Overview
Payoutsking is tracked by Breach House as a ransomware group with 158 published victims.
United States is currently the most targeted country in this dataset.
1 known leak locations are currently associated with this group.
Leak Status Distribution
158
- Leaked 110 69.6%
- Pending 47 29.7%
- Deleted 1 0.6%
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (1)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 1 | Onion service | Up checked 2h ago | payoutsgn7cy6uliwevdqspncjpfxpmzgirwl2au65la7rfs5x3qnbqd.onion |
Top Activity Sectors (16)
- Not identified 28
- Manufacturing / Engineering 27
- IT 11
- Healthcare / Pharma 10
- Construction / Real Estate 10
- Communication / Marketing 9
- Retail / E-commerce 7
- Education 4
- Agriculture / Food 4
- Hospitality / Food & Beverage / Tourism 4
- Services 3
- Transportation / Travel / Logistics 3
- Energy 3
- null 2
- Telecommunications 2
- Finance / Legal / Insurance 2
Typical Attacks (8)
▼MITRE ATT&CK does not currently catalogue Payoutsking, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v19.2. Confidence: medium. Treat it as orientation, not attribution.
-
T1059.001 PowerShell Execution
What they do: payoutsking uses PowerShell scripts to execute malicious commands and deploy ransomware payloads across compromised systems.
What that means: Adversaries may abuse PowerShell commands and scripts for execution.
-
What they do: payoutsking persists by adding malicious entries to Windows Registry Run Keys to ensure recurring execution.
What that means: Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.
-
T1685 Disable or Modify Tools Defense Impairment
What they do: payoutsking disables antivirus tools and security monitoring by terminating security processes and modifying system configurations.
What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
-
T1070.004 File Deletion Stealth
What they do: payoutsking deletes Volume Shadow Copies and backup directories using built-in Windows utilities to prevent recovery.
What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
-
T1018 Remote System Discovery Discovery
What they do: payoutsking moves laterally via SMB shares and mapped drives to access additional servers within the victim network.
What that means: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system.
-
T1135 Network Share Discovery Discovery
What they do: payoutsking scans network shares to discover victim file structures and identify high-value targets for encryption.
What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.
-
T1041 Exfiltration Over C2 Channel Exfiltration
What they do: payoutsking exfiltrates stolen data through encrypted C2 channels before deploying ransomware to enable double extortion.
What that means: Adversaries may steal data by exfiltrating it over an existing command and control channel.
-
T1486 Data Encrypted for Impact Impact
What they do: payoutsking encrypts victim files using a custom ransomware engine, targeting business documents and backups for maximum disruption.
What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
Ransom Notes (1)
▼The note this group leaves on a compromised machine. Click a filename to read it.
readme_locker.txt
The files on the company's network have been encrypted, and significant amount of confidential data has been downloaded from it. To recover your files to the initial state and prevent disclosure of your sensitive information contact us as soon as possible via the TOX chat platform. - Download a TOX messaging client(https://tox.chat); - Create an account; - Add the following contact ID for futher negotiations: 74FB30F3FCC73D6B1BCE403238D082426F43D95F42CA25DF20CB278D91E8754B151651ED12DD In case you don't get in touch within 7 days, the exfiltrated data will be disclosed on our website: https://payoutsgn7cy6uliwevdqspncjpfxpmzgirwl2au65la7rfs5x3qnbqd.onion
Ransom-note text from RansomLook, licensed CC BY 4.0.
Victims (158)
Search, filter and paginate the victim timeline for Payoutsking. Showing 101–158 of 158.
| Type | Target | Discovered | Country | Business Category | Intel Link | Leak status |
|---|---|---|---|---|---|---|
| Ransomware | V****e id24015 View details | Germany | Other | leaked | ||
|
No additional victim description available. |
||||||
| Ransomware | P****s id24014 View details | France | Other | leaked | ||
|
No additional victim description available. |
||||||
| Ransomware | J****e id24013 View details | United States | Other | leaked | ||
|
No additional victim description available. |
||||||
| Ransomware | K****n id23948 View details | Germany | Other | — | pending | |
|
No additional victim description available. |
||||||
| Ransomware | L****x id23947 View details | United States | Other | leaked | ||
|
No additional victim description available. |
||||||
| Ransomware | A****n id23896 View details | United States | Other | leaked | ||
|
No additional victim description available. |
||||||
| Ransomware | Irwin Car id23810 View details | United States | Manufacturing / Engineering | leaked | ||
|
[AI generated] Irwin Car and Equipment is a manufacturing company specialized in the production of heavy-duty material handling equipment. They create custom mining cars, conveyor cars, tunneling cars and more. It aids various industries, including mining and tunneling, in improving their efficiency and safety. The company is based in the USA and is recognized for its innovative and durable equipment. |
||||||
| Ransomware | Irwin Car id32896 View details | United States | Manufacturing / Engineering | pending | ||
|
[AI generated] Irwin Car and Equipment is a manufacturing company specialized in the production of heavy-duty material handling equipment. They create custom mining cars, conveyor cars, tunneling cars and more. It aids various industries, including mining and tunneling, in improving their efficiency and safety. The company is based in the USA and is recognized for its innovative and durable equipment. |
||||||
| Ransomware | I****r id23599 View details | United States | Other | leaked | ||
|
No additional victim description available. |
||||||
| Ransomware | Time Equities id23492 View details | United States | Construction / Real Estate | pending | ||
|
[AI generated] Time Equities is a globally diversified real estate firm, founded in 1966, based in New York City. The company focuses on 3 main aspects: acquisition, development, and management of properties. It handles a variety of types, ranging from office and retail to industrial and residential. They have properties in 30 states in the US, as well as in Europe and Canada. |
||||||
| Ransomware | Time Equities id32901 View details | United States | Construction / Real Estate | pending | ||
|
[AI generated] Time Equities is a globally diversified real estate firm, founded in 1966, based in New York City. The company focuses on 3 main aspects: acquisition, development, and management of properties. It handles a variety of types, ranging from office and retail to industrial and residential. They have properties in 30 states in the US, as well as in Europe and Canada. |
||||||
| Ransomware | T****s id23281 View details | United States | Other | — | pending | |
|
No additional victim description available. |
||||||
| Ransomware | Linxx Global Solutions id22881 View details | United States | Services | leaked | ||
|
[AI generated] Linxx Global Solutions is a U.S. based company that provides training and operational support services for the defense sector. Their offerings include security and defense training, protective services, intelligence, and maritime solutions. Linxx works in partnership with the federal government and military, and is particularly specialized in counter-terrorism and law enforcement training. |
||||||
| Ransomware | Linxx Global Solutions id32908 View details | United States | Services | pending | ||
|
[AI generated] Linxx Global Solutions is a U.S. based company that provides training and operational support services for the defense sector. Their offerings include security and defense training, protective services, intelligence, and maritime solutions. Linxx works in partnership with the federal government and military, and is particularly specialized in counter-terrorism and law enforcement training. |
||||||
| Ransomware | L****s id22673 View details | United States | Other | leaked | ||
|
No additional victim description available. |
||||||
| Ransomware | Monterey Mushrooms id22093 View details | United States | Retail / E-commerce | leaked | ||
|
[AI generated] Monterey Mushrooms, founded in 1971 and headquartered in Watsonville, California, is a multinational company that cultivates, packs, and distributes fresh market mushrooms for retail, foodservice, and ingredient markets. Its product portfolio includes various types of mushrooms, such as white, brown, specialty, and organic mushrooms. |
||||||
| Ransomware | Monterey Mushrooms id32909 View details | United States | Retail / E-commerce | pending | ||
|
[AI generated] Monterey Mushrooms, founded in 1971 and headquartered in Watsonville, California, is a multinational company that cultivates, packs, and distributes fresh market mushrooms for retail, foodservice, and ingredient markets. Its product portfolio includes various types of mushrooms, such as white, brown, specialty, and organic mushrooms. |
||||||
| Ransomware | Sofo Foods id21884 View details | United States | Agriculture / Food | leaked | ||
|
[AI generated] Sofo Foods is a family-owned food distribution company specializing in Italian and Mediterranean products. Founded in 1949, the company offers a wide range of products including deli items, produce, bakery items, meats, and cheeses. Sofo Foods mainly serves restaurants and retailers in the midwest and southeastern regions of the United States. It also provides catering services, food preparation tips, and recipes to its clients. |
||||||
| Ransomware | Sofo Foods id32915 View details | United States | Agriculture / Food | pending | ||
|
[AI generated] Sofo Foods is a family-owned food distribution company specializing in Italian and Mediterranean products. Founded in 1949, the company offers a wide range of products including deli items, produce, bakery items, meats, and cheeses. Sofo Foods mainly serves restaurants and retailers in the midwest and southeastern regions of the United States. It also provides catering services, food preparation tips, and recipes to its clients. |
||||||
| Ransomware | M****s id21623 View details | United States | Other | leaked | ||
|
No additional victim description available. |
||||||
| Ransomware | S****s id21533 View details | United States | Other | leaked | ||
|
No additional victim description available. |
||||||
| Ransomware | Creditinfo id21339 View details | United Kingdom | Finance / Legal / Insurance | leaked | ||
|
[AI generated] Creditinfo is a leading service provider for credit information and risk management solutions worldwide. It was established in 1997 and has grown to have a presence in over 50 countries. As an international financial services company, it assists businesses, individuals, and organizations with credit-related decisions by offering a range of services, including credit risk management, marketing intelligence, and decision analytics. |
||||||
| Ransomware | Creditinfo id32922 View details | United Kingdom | Finance / Legal / Insurance | pending | ||
|
[AI generated] Creditinfo is a leading service provider for credit information and risk management solutions worldwide. It was established in 1997 and has grown to have a presence in over 50 countries. As an international financial services company, it assists businesses, individuals, and organizations with credit-related decisions by offering a range of services, including credit risk management, marketing intelligence, and decision analytics. |
||||||
| Ransomware | Thompson+Hanson id21277 View details | United States | Construction / Real Estate | leaked | ||
|
[AI generated] Thompson+Hanson is a landscape architecture firm specializing in personalized garden designs. The company, established in 1985 in Texas, blends architecture with horticulture to create unique outdoor spaces. They also have garden shops and a cafe, offering a diverse range of plants, garden essentials, and unique artifacts. |
||||||
| Ransomware | Thompson+Hanson id32923 View details | United States | Construction / Real Estate | pending | ||
|
[AI generated] Thompson+Hanson is a landscape architecture firm specializing in personalized garden designs. The company, established in 1985 in Texas, blends architecture with horticulture to create unique outdoor spaces. They also have garden shops and a cafe, offering a diverse range of plants, garden essentials, and unique artifacts. |
||||||
| Ransomware | MEDIALAB id21166 View details | United States | Communication / Marketing | leaked | ||
|
[AI generated] MediaLab is a tech company that owns and operates a portfolio of leading digital brands, including Whisper, Kik, Datpiff, Worldstar Hip Hop, among others. Their brands serve over 60 million users every month. They focus on acquiring, investing in, and building sustainable, user-centric, data-driven, and mobile-first internet properties. |
||||||
| Ransomware | MEDIALAB id32927 View details | United States | Communication / Marketing | pending | ||
|
[AI generated] MediaLab is a tech company that owns and operates a portfolio of leading digital brands, including Whisper, Kik, Datpiff, Worldstar Hip Hop, among others. Their brands serve over 60 million users every month. They focus on acquiring, investing in, and building sustainable, user-centric, data-driven, and mobile-first internet properties. |
||||||
| Ransomware | C****o id21162 View details | United Kingdom | Other | leaked | ||
|
No additional victim description available. |
||||||
| Ransomware | Schlemmer Holding GmbH id21147 View details | Germany | Communication / Marketing | leaked | ||
|
[AI generated] Schlemmer Holding GmbH, based in Germany, is a global technology company focusing on innovative solutions and products for a variety of sectors. Schlemmer specializes in the production of protective systems like cable protection and production technologies, offering its services to industries like the automotive, energy, and telecommunication sectors. |
||||||
| Ransomware | Schlemmer Holding GmbH id32928 View details | Germany | Communication / Marketing | pending | ||
|
[AI generated] Schlemmer Holding GmbH, based in Germany, is a global technology company focusing on innovative solutions and products for a variety of sectors. Schlemmer specializes in the production of protective systems like cable protection and production technologies, offering its services to industries like the automotive, energy, and telecommunication sectors. |
||||||
| Ransomware | G***** id21144 View details | United States | Other | — | pending | |
|
No additional victim description available. |
||||||
| Ransomware | T****n id21143 View details | United States | Other | leaked | ||
|
No additional victim description available. |
||||||
| Ransomware | G****d id21072 View details | United States | Other | — | pending | |
|
No additional victim description available. |
||||||
| Ransomware | Belmont Engineered Plastics id21031 View details | United States | Manufacturing / Engineering | leaked | ||
|
[AI generated] Belmont Engineered Plastics is a manufacturing company located in Belmont, Michigan. It specializes in producing high-quality plastic products through injection molding, heavy gauge thermoforming and other complex processes. The firm caters to a wide range of industries, including automotive, medical, consumer products and more. In addition to manufacturing, they also provide design, engineering, and assembly services, ensuring a comprehensive solution for clients. |
||||||
| Ransomware | Belmont Engineered Plastics id32929 View details | United States | Manufacturing / Engineering | pending | ||
|
[AI generated] Belmont Engineered Plastics is a manufacturing company located in Belmont, Michigan. It specializes in producing high-quality plastic products through injection molding, heavy gauge thermoforming and other complex processes. The firm caters to a wide range of industries, including automotive, medical, consumer products and more. In addition to manufacturing, they also provide design, engineering, and assembly services, ensuring a comprehensive solution for clients. |
||||||
| Ransomware | BARIATRIX NUTRITION id21030 View details | Canada | Healthcare / Pharma | leaked | ||
|
[AI generated] Bariatix Nutrition is a company specializing in the field of medical nutrition therapy. The company develops and manufactures a wide range of high protein, low carb food products specifically designed to meet the dietary needs of bariatric patients. Their products are clinically tested and used by doctors to help patients lose weight and maintain a healthy lifestyle post-surgery. Their offerings include protein supplements, meal replacements, protein bars, and vitamin and mineral supplements, among others. |
||||||
| Ransomware | BARIATRIX NUTRITION id32930 View details | Canada | Healthcare / Pharma | pending | ||
|
[AI generated] Bariatix Nutrition is a company specializing in the field of medical nutrition therapy. The company develops and manufactures a wide range of high protein, low carb food products specifically designed to meet the dietary needs of bariatric patients. Their products are clinically tested and used by doctors to help patients lose weight and maintain a healthy lifestyle post-surgery. Their offerings include protein supplements, meal replacements, protein bars, and vitamin and mineral supplements, among others. |
||||||
| Ransomware | EvoluPharm id21029 View details | France | Healthcare / Pharma | leaked | ||
|
[AI generated] EvoluPharm is a leading player in the pharmaceutical sector in France. The company offers an innovative model providing solutions and services for pharmacists, including a wide range of generic and specialty pharmaceuticals. They aim to optimize and digitize pharmacies through various management tools, marketing solutions and training. They also emphasize environmentally friendly practices. |
||||||
| Ransomware | EvoluPharm id32931 View details | France | Healthcare / Pharma | pending | ||
|
[AI generated] EvoluPharm is a leading player in the pharmaceutical sector in France. The company offers an innovative model providing solutions and services for pharmacists, including a wide range of generic and specialty pharmaceuticals. They aim to optimize and digitize pharmacies through various management tools, marketing solutions and training. They also emphasize environmentally friendly practices. |
||||||
| Ransomware | Silent Gliss Italia id21028 View details | Italy | Communication / Marketing | leaked | ||
|
[AI generated] Silent Gliss Italia is a branch of the global company, Silent Gliss, that specialises in the production and distribution of high-quality, innovative window treatments. The Switzerland-based company provides a wide range of products including curtain and blind systems. Silent Gliss Italia follows the parent company's commitment to exceptional Swiss quality, precision, and careful attention to detail in design. |
||||||
| Ransomware | Silent Gliss Italia id32932 View details | Italy | Communication / Marketing | pending | ||
|
[AI generated] Silent Gliss Italia is a branch of the global company, Silent Gliss, that specialises in the production and distribution of high-quality, innovative window treatments. The Switzerland-based company provides a wide range of products including curtain and blind systems. Silent Gliss Italia follows the parent company's commitment to exceptional Swiss quality, precision, and careful attention to detail in design. |
||||||
| Ransomware | Gateway Community id21027 View details | United States | Communication / Marketing | leaked | ||
|
[AI generated] Gateway Community, also known as Gateway Community Services, is a non-profit organization based in the U.S. Their mission is to provide comprehensive and effective services for individuals and families affected by addictive diseases, mental health disorders, and homelessness. They offer assistance through education, prevention, treatment, and housing programs. |
||||||
| Ransomware | Gateway Community id32933 View details | United States | Communication / Marketing | pending | ||
|
[AI generated] Gateway Community, also known as Gateway Community Services, is a non-profit organization based in the U.S. Their mission is to provide comprehensive and effective services for individuals and families affected by addictive diseases, mental health disorders, and homelessness. They offer assistance through education, prevention, treatment, and housing programs. |
||||||
| Ransomware | Arch-Con Corporation id21026 View details | United States | Construction / Real Estate | leaked | ||
|
[AI generated] Arch-Con Corporation is a Texas-based general contractor offering construction services for multiple industries. Its expertise spans commercial, industrial, retail, healthcare, hospitality, community, and corporate interiors. Besides traditional construction services, Arch-Con offers pre-construction planning such as feasibility studies, value engineering options, and constructability reviews. |
||||||
| Ransomware | Arch-Con Corporation id32934 View details | United States | Construction / Real Estate | pending | ||
|
[AI generated] Arch-Con Corporation is a Texas-based general contractor offering construction services for multiple industries. Its expertise spans commercial, industrial, retail, healthcare, hospitality, community, and corporate interiors. Besides traditional construction services, Arch-Con offers pre-construction planning such as feasibility studies, value engineering options, and constructability reviews. |
||||||
| Ransomware | KOLBUS id21025 View details | Germany | Manufacturing / Engineering | leaked | ||
|
[AI generated] KOLBUS is a leading international manufacturer of machines and tools for bookbinders, print shops, and packaging companies. Headquartered in Germany, the company’s innovative solutions include packaging production lines, bookbinding systems, and luxury packaging. Additionally, KOLBUS offers spare parts, conversions, and upgrades services for its machinery. Established in 1775, the company has a rich history and significant experience in the printing and packaging industry. |
||||||
| Ransomware | KOLBUS id32935 View details | Germany | Manufacturing / Engineering | pending | ||
|
[AI generated] KOLBUS is a leading international manufacturer of machines and tools for bookbinders, print shops, and packaging companies. Headquartered in Germany, the company’s innovative solutions include packaging production lines, bookbinding systems, and luxury packaging. Additionally, KOLBUS offers spare parts, conversions, and upgrades services for its machinery. Established in 1775, the company has a rich history and significant experience in the printing and packaging industry. |
||||||
| Ransomware | CR Architecture + Design id21024 View details | United States | Construction / Real Estate | leaked | ||
|
[AI generated] CR Architecture + Design is a US-based company that specializes in providing architectural and design solutions. The firm delivers expertise across various sectors including housing, education, hospitality, and government. The team of architects, interior designers, and graphic designers work together, drawing on their different perspectives to create both functional and innovative spaces. They balance aesthetic concerns with practical requirements, ensuring successful project outcomes. |
||||||
| Ransomware | CR Architecture + Design id32936 View details | United States | Construction / Real Estate | pending | ||
|
[AI generated] CR Architecture + Design is a US-based company that specializes in providing architectural and design solutions. The firm delivers expertise across various sectors including housing, education, hospitality, and government. The team of architects, interior designers, and graphic designers work together, drawing on their different perspectives to create both functional and innovative spaces. They balance aesthetic concerns with practical requirements, ensuring successful project outcomes. |
||||||
| Ransomware | Institute of Culinary Education id21023 View details | United States | Education | leaked | ||
|
[AI generated] The Institute of Culinary Education (ICE) is a reputable culinary school based in New York City, USA. Founded in 1975, ICE offers a wide range of professional certificate programs in culinary arts, pastry & baking, hospitality management, and culinary technology, among others. The Institute is known for its modern facilities, experienced faculty, and strong industry connections. |
||||||
| Ransomware | Institute of Culinary Education id32937 View details | United States | Education | pending | ||
|
[AI generated] The Institute of Culinary Education (ICE) is a reputable culinary school based in New York City, USA. Founded in 1975, ICE offers a wide range of professional certificate programs in culinary arts, pastry & baking, hospitality management, and culinary technology, among others. The Institute is known for its modern facilities, experienced faculty, and strong industry connections. |
||||||
| Ransomware | Crenshaw Community Hospital id21022 View details | United States | Healthcare / Pharma | leaked | ||
|
[AI generated] Crenshaw Community Hospital is a medical facility based in Luverne, Alabama. Established in 1967, it offers a wide range of comprehensive health care services. In addition to an emergency department, the not-for-profit hospital operates outpatient clinics, laboratory and radiology services, and rehab facilities. The hospital remains committed to meeting the healthcare needs of Crenshaw County and the surrounding communities. |
||||||
| Ransomware | Crenshaw Community Hospital id32938 View details | United States | Healthcare / Pharma | pending | ||
|
[AI generated] Crenshaw Community Hospital is a medical facility based in Luverne, Alabama. Established in 1967, it offers a wide range of comprehensive health care services. In addition to an emergency department, the not-for-profit hospital operates outpatient clinics, laboratory and radiology services, and rehab facilities. The hospital remains committed to meeting the healthcare needs of Crenshaw County and the surrounding communities. |
||||||
| Ransomware | Rhea Vendors Group SpA id21021 View details | Italy | Communication / Marketing | leaked | ||
|
[AI generated] Rhea Vendors Group SpA is an Italy-based global company specializing in manufacturing vending machines for hot and cold drinks and snacks. Founded in 1960, the company utilizes advanced technology and innovative designs to deliver high-quality products. Their products range from custom-designed vending machines to fully automatic coffee machines. They cater to a broad range of industries, including offices, retail, and hospitality. |
||||||
| Ransomware | Rhea Vendors Group SpA id32939 View details | Italy | Communication / Marketing | pending | ||
|
[AI generated] Rhea Vendors Group SpA is an Italy-based global company specializing in manufacturing vending machines for hot and cold drinks and snacks. Founded in 1960, the company utilizes advanced technology and innovative designs to deliver high-quality products. Their products range from custom-designed vending machines to fully automatic coffee machines. They cater to a broad range of industries, including offices, retail, and hospitality. |
||||||
| Ransomware | LTL id21020 View details | Spain | Other | leaked | ||
|
[AI generated] N/A |
||||||
| Ransomware | LTL id32940 View details | Spain | Other | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | S****H id21019 View details | Germany | Other | leaked | ||
|
No additional victim description available. |
||||||