Skip to main content
Darkfield

Operator dossier

payoutsking is a ransomware operator currently active on public leak sites. Darkfield has indexed 105 public victims claimed by this operator between July 7, 2025 and July 14, 2026. Payoutsking is a ransomware group first observed in July 2025 with an apparent primary motivation of financial gain, having been attributed to approximately 100 known victims within a relatively short operational window. Limited public documentation exists from major threat intelligence sources such as CISA, FBI, or Mandiant at this time, which is consistent with the group's recent emergence and potentially limited public disclosure of incidents. Based on available victimology data, the group has concentrated its targeting efforts primarily across the United States, Germany, the United Kingdom, France, and Spain, suggesting a deliberate focus on economically developed Western nations likely selected for their higher ransom-payment capacity. The sectors most frequently targeted include manufacturing, business services, technology, and construction, with a notable proportion of victims falling outside readily classifiable industry categories, which may indicate opportunistic targeting rather than a highly specialized vertical focus. No definitive attribution regarding country of origin, RaaS affiliation, or specific technical tooling has been publicly confirmed by authoritative sources as of this writing, and the group's attack methodology, encryption schemes, and extortion tactics remain insufficiently documented in open-source reporting to characterize with analytical confidence. Given the group's very recent emergence and the relatively high victim count accumulated in a short timeframe, payoutsking warrants continued monitoring, and security researchers and organizations in the identified target sectors should treat this actor as an active and potentially escalating threat pending further technical analysis and public disclosure.

Most-targeted sectors

Most-affected countries

Recent disclosures by payoutsking

Most recent 104 of 105 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for payoutsking →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Active ransomware operator

← All groups

payoutsking

105 victims indexed · first seen 1 year ago · last activity 17 hours ago

105
Victims indexed
#71 of 364 tracked operators
1y 0m
Active period
Jul 2025 → Jul 2026
11
Countries hit
top US · 60

At a glance

Status
active
First seen
1 year ago
Last activity
17 hours ago
Primary sector
Not Found · 38 hits

About

Payoutsking is a ransomware group first observed in July 2025 with an apparent primary motivation of financial gain, having been attributed to approximately 100 known victims within a relatively short operational window. Limited public documentation exists from major threat intelligence sources such as CISA, FBI, or Mandiant at this time, which is consistent with the group's recent emergence and potentially limited public disclosure of incidents. Based on available victimology data, the group has concentrated its targeting efforts primarily across the United States, Germany, the United Kingdom, France, and Spain, suggesting a deliberate focus on economically developed Western nations likely selected for their higher ransom-payment capacity. The sectors most frequently targeted include manufacturing, business services, technology, and construction, with a notable proportion of victims falling outside readily classifiable industry categories, which may indicate opportunistic targeting rather than a highly specialized vertical focus. No definitive attribution regarding country of origin, RaaS affiliation, or specific technical tooling has been publicly confirmed by authoritative sources as of this writing, and the group's attack methodology, encryption schemes, and extortion tactics remain insufficiently documented in open-source reporting to characterize with analytical confidence. Given the group's very recent emergence and the relatively high victim count accumulated in a short timeframe, payoutsking warrants continued monitoring, and security researchers and organizations in the identified target sectors should treat this actor as an active and potentially escalating threat pending further technical analysis and public disclosure.

References

1 link

External sources curated by the MISP threat-intel community.

Timeline

8 months
2025-07-01T00:00:00+00:00 · 212025-08-01T00:00:00+00:00 · 32025-09-01T00:00:00+00:00 · 22025-10-01T00:00:00+00:00 · 32025-11-01T00:00:00+00:00 · 142026-01-01T00:00:00+00:00 · 172026-04-01T00:00:00+00:00 · 392026-05-01T00:00:00+00:00 · 1
2025-07-01T00:00:00+00:002026-05-01T00:00:00+00:00

Top countries

🇺🇸 United States
60
🇩🇪 Germany
15
🇬🇧 United Kingdom
9
🇫🇷 France
3
🇪🇸 Spain
3
🇮🇹 Italy
3
🇧🇪 Belgium
2
🇨🇦 Canada
2
United States dossier →Germany dossier →United Kingdom dossier →France dossier →

Top sectors

Manufacturing
21
Business Services
8
Technology
7
Construction
4
Healthcare
4
Agriculture and Food Production
4
Energy
3
Consumer Services
3
Manufacturing dossier →Business Services dossier →Technology dossier →Construction dossier →

MITRE ATT&CK

15 techniques · 7 tactics

Tactics

Initial AccessExecutionDefense EvasionDiscoveryCollectionExfiltrationImpact

Techniques

  • T1190Exploit Public-Facing Application
  • T1566Phishing
  • T1059Command and Scripting Interpreter
  • T1047Windows Management Instrumentation
  • T1562Impair Defenses
  • T1070Indicator Removal
  • T1027Obfuscated Files or Information
  • T1083File and Directory Discovery
  • T1082System Information Discovery
  • T1057Process Discovery
  • T1005Data from Local System
  • T1041Exfiltration Over C2 Channel
  • T1486Data Encrypted for Impact
  • T1490Inhibit System Recovery
  • T1489Service Stop

Recent victims

Loading…

Source

Updated 17 hours ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time payoutsking posts a victim.

Add payoutsking to your watchlist — Pro pings you within 5 minutes of any new payoutsking leak-site post, Telegram callout, or affiliate-rebrand inference.