Ransomware Group intelligence
Payoutsking
ActiveTrack Payoutsking with 144 published victims and 1 known leak locations in a single intelligence view.
DARK EYE ALERTS
Want an alert every time a new ransomware post is published?
Choose the feeds and the countries you care about — we email you when they move.
Overview
Payoutsking is tracked by Dark Eye as a ransomware group with 144 published victims.
United States is currently the most targeted country in this dataset.
1 known leak locations are currently associated with this group.
Leak Status Distribution
144
- Leaked 96 66.7%
- Pending 47 32.6%
- Deleted 1 0.7%
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (1)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 1 | Onion service | Up checked 57m ago | payoutsgn7cy6uliwevdqspncjpfxpmzgirwl2au65la7rfs5x3qnbqd.onion |
Top Activity Sectors (16)
- Not identified 27
- Manufacturing / Engineering 24
- IT 12
- Construction / Real Estate 8
- Healthcare / Pharma 7
- Retail / E-commerce 7
- Communication / Marketing 5
- Hospitality / Food & Beverage / Tourism 4
- Energy 3
- Agriculture / Food 3
- Education 3
- Transportation / Travel / Logistics 3
- Services 3
- null 2
- Telecommunications 2
- Finance / Legal / Insurance 2
Typical Attacks (8)
▼MITRE ATT&CK does not currently catalogue Payoutsking, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v20.0. Confidence: medium. Treat it as orientation, not attribution.
-
T1059.001 PowerShell Execution
What they do: payoutsking uses PowerShell scripts to execute malicious commands and deploy ransomware payloads across compromised systems.
What that means: Adversaries may abuse PowerShell commands and scripts for execution.
-
What they do: payoutsking persists by adding malicious entries to Windows Registry Run Keys to ensure recurring execution.
What that means: Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.
-
T1685 Disable or Modify Tools Defense Impairment
What they do: payoutsking disables antivirus tools and security monitoring by terminating security processes and modifying system configurations.
What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
-
T1070.004 File Deletion Stealth
What they do: payoutsking deletes Volume Shadow Copies and backup directories using built-in Windows utilities to prevent recovery.
What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
-
T1018 Remote System Discovery Discovery
What they do: payoutsking moves laterally via SMB shares and mapped drives to access additional servers within the victim network.
What that means: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system.
-
T1135 Network Share Discovery Discovery
What they do: payoutsking scans network shares to discover victim file structures and identify high-value targets for encryption.
What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.
-
T1041 Exfiltration Over C2 Channel Exfiltration
What they do: payoutsking exfiltrates stolen data through encrypted C2 channels before deploying ransomware to enable double extortion.
What that means: Adversaries may steal data by exfiltrating it over an existing command and control channel.
-
T1486 Data Encrypted for Impact Impact
What they do: payoutsking encrypts victim files using a custom ransomware engine, targeting business documents and backups for maximum disruption.
What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
Ransom Notes (1)
▼The note this group leaves on a compromised machine. Click a filename to read it.
readme_locker.txt
The files on the company's network have been encrypted, and significant amount of confidential data has been downloaded from it. To recover your files to the initial state and prevent disclosure of your sensitive information contact us as soon as possible via the TOX chat platform. - Download a TOX messaging client(https://tox.chat); - Create an account; - Add the following contact ID for futher negotiations: 74FB30F3FCC73D6B1BCE403238D082426F43D95F42CA25DF20CB278D91E8754B151651ED12DD In case you don't get in touch within 7 days, the exfiltrated data will be disclosed on our website: https://payoutsgn7cy6uliwevdqspncjpfxpmzgirwl2au65la7rfs5x3qnbqd.onion
Ransom-note text from RansomLook, licensed CC BY 4.0.
Victims (144)
Search, filter and paginate the victim timeline for Payoutsking. Showing 101–144 of 144.
| Type | Target | Discovered | Country | Business Category | Intel Link | Leak status |
|---|---|---|---|---|---|---|
| Ransomware | L****s id22673 View details | United States | Other | leaked | ||
|
No additional victim description available. |
||||||
| Ransomware | Monterey Mushrooms id22093 View details | United States | Other | leaked | ||
|
[AI generated] Monterey Mushrooms, founded in 1971 and headquartered in Watsonville, California, is a multinational company that cultivates, packs, and distributes fresh market mushrooms for retail, foodservice, and ingredient markets. Its product portfolio includes various types of mushrooms, such as white, brown, specialty, and organic mushrooms. |
||||||
| Ransomware | Monterey Mushrooms id32909 | United States | Other | pending | ||
|
[AI generated] Monterey Mushrooms, founded in 1971 and headquartered in Watsonville, California, is a multinational company that cultivates, packs, and distributes fresh market mushrooms for retail, foodservice, and ingredient markets. Its product portfolio includes various types of mushrooms, such as white, brown, specialty, and organic mushrooms. |
||||||
| Ransomware | Sofo Foods id21884 View details | United States | Other | leaked | ||
|
[AI generated] Sofo Foods is a family-owned food distribution company specializing in Italian and Mediterranean products. Founded in 1949, the company offers a wide range of products including deli items, produce, bakery items, meats, and cheeses. Sofo Foods mainly serves restaurants and retailers in the midwest and southeastern regions of the United States. It also provides catering services, food preparation tips, and recipes to its clients. |
||||||
| Ransomware | Sofo Foods id32915 | United States | Other | pending | ||
|
[AI generated] Sofo Foods is a family-owned food distribution company specializing in Italian and Mediterranean products. Founded in 1949, the company offers a wide range of products including deli items, produce, bakery items, meats, and cheeses. Sofo Foods mainly serves restaurants and retailers in the midwest and southeastern regions of the United States. It also provides catering services, food preparation tips, and recipes to its clients. |
||||||
| Ransomware | M****s id21623 View details | United States | — | leaked | ||
|
No additional victim description available. |
||||||
| Ransomware | S****s id21533 View details | United States | — | leaked | ||
|
No additional victim description available. |
||||||
| Ransomware | Creditinfo id21339 View details | United Kingdom | Other | leaked | ||
|
[AI generated] Creditinfo is a leading service provider for credit information and risk management solutions worldwide. It was established in 1997 and has grown to have a presence in over 50 countries. As an international financial services company, it assists businesses, individuals, and organizations with credit-related decisions by offering a range of services, including credit risk management, marketing intelligence, and decision analytics. |
||||||
| Ransomware | Creditinfo id32922 | United Kingdom | Other | pending | ||
|
[AI generated] Creditinfo is a leading service provider for credit information and risk management solutions worldwide. It was established in 1997 and has grown to have a presence in over 50 countries. As an international financial services company, it assists businesses, individuals, and organizations with credit-related decisions by offering a range of services, including credit risk management, marketing intelligence, and decision analytics. |
||||||
| Ransomware | Thompson+Hanson id21277 View details | United States | Other | leaked | ||
|
[AI generated] Thompson+Hanson is a landscape architecture firm specializing in personalized garden designs. The company, established in 1985 in Texas, blends architecture with horticulture to create unique outdoor spaces. They also have garden shops and a cafe, offering a diverse range of plants, garden essentials, and unique artifacts. |
||||||
| Ransomware | Thompson+Hanson id32923 | United States | Other | pending | ||
|
[AI generated] Thompson+Hanson is a landscape architecture firm specializing in personalized garden designs. The company, established in 1985 in Texas, blends architecture with horticulture to create unique outdoor spaces. They also have garden shops and a cafe, offering a diverse range of plants, garden essentials, and unique artifacts. |
||||||
| Ransomware | MEDIALAB id21166 View details | United States | IT | leaked | ||
|
Medialab Published: 2025-07-15 Status: Disclosed Data size: 4GB Views: 143063 Website: https://medialab3dsolutions.com/ Country: USA Revenue: $11M Employees: 200 About company: MediaLab 3D Solutions develops end-to-end digital imagery and visualizations for the residential building and consumer product industries. The company's clients include Whirlpool, Lennar, American Standard, KitchenAid, ClosetMaid, Jenn-Air, Stanley Black & Decker, and Basco. |
||||||
| Ransomware | MEDIALAB id32927 | United States | IT | pending | ||
|
[AI generated] MediaLab is a tech company that owns and operates a portfolio of leading digital brands, including Whisper, Kik, Datpiff, Worldstar Hip Hop, among others. Their brands serve over 60 million users every month. They focus on acquiring, investing in, and building sustainable, user-centric, data-driven, and mobile-first internet properties. |
||||||
| Ransomware | C****o id21162 View details | United Kingdom | — | leaked | ||
|
No additional victim description available. |
||||||
| Ransomware | Schlemmer Holding GmbH id21147 View details | Germany | Other | leaked | ||
|
[AI generated] Schlemmer Holding GmbH, based in Germany, is a global technology company focusing on innovative solutions and products for a variety of sectors. Schlemmer specializes in the production of protective systems like cable protection and production technologies, offering its services to industries like the automotive, energy, and telecommunication sectors. |
||||||
| Ransomware | Schlemmer Holding GmbH id32928 | Germany | Other | pending | ||
|
[AI generated] Schlemmer Holding GmbH, based in Germany, is a global technology company focusing on innovative solutions and products for a variety of sectors. Schlemmer specializes in the production of protective systems like cable protection and production technologies, offering its services to industries like the automotive, energy, and telecommunication sectors. |
||||||
| Ransomware | G***** id21144 View details | United States | Other | — | pending | |
|
No additional victim description available. |
||||||
| Ransomware | T****n id21143 View details | United States | — | leaked | ||
|
No additional victim description available. |
||||||
| Ransomware | G****d id21072 View details | United States | Other | — | pending | |
|
No additional victim description available. |
||||||
| Ransomware | Belmont Engineered Plastics id21031 View details | United States | Manufacturing / Engineering | leaked | ||
|
Belmont Engineered Plastics Published: 2025-06-27 Status: Disclosed Data size: 850GB Views: 142099 Website: https://beplastics.com/ Country: USA Revenue: $15M Employees: 200 About company: Belmont Engineered Plastics specializes in high-quality injection molding services, offering an end-to-end service model from engineering through to distribution all within one facility. With a world-class manufacturing facility equipped with 35 injection molding presses, the company is equipped to handle various production demands efficiently. |
||||||
| Ransomware | Belmont Engineered Plastics id32929 | United States | Manufacturing / Engineering | pending | ||
|
[AI generated] Belmont Engineered Plastics is a manufacturing company located in Belmont, Michigan. It specializes in producing high-quality plastic products through injection molding, heavy gauge thermoforming and other complex processes. The firm caters to a wide range of industries, including automotive, medical, consumer products and more. In addition to manufacturing, they also provide design, engineering, and assembly services, ensuring a comprehensive solution for clients. |
||||||
| Ransomware | BARIATRIX NUTRITION id21030 View details | Canada | Healthcare / Pharma | leaked | ||
|
Bariatrix Nutrition Published: 2025-06-27 Status: Disclosed Data size: 204GB Views: 141850 Website: https://bariatrix.com/ Country: CA Revenue: $38M Employees: 200 About company: Throughout the years, Bariatrix has been a leading developer of high protein foods and remained on the cutting edge of high protein food manufacturing for athletes, medical weight loss, and everyday consumers. |
||||||
| Ransomware | BARIATRIX NUTRITION id32930 | Canada | Healthcare / Pharma | pending | ||
|
[AI generated] Bariatix Nutrition is a company specializing in the field of medical nutrition therapy. The company develops and manufactures a wide range of high protein, low carb food products specifically designed to meet the dietary needs of bariatric patients. Their products are clinically tested and used by doctors to help patients lose weight and maintain a healthy lifestyle post-surgery. Their offerings include protein supplements, meal replacements, protein bars, and vitamin and mineral supplements, among others. |
||||||
| Ransomware | EvoluPharm id21029 View details | France | Healthcare / Pharma | leaked | ||
|
EvoluPharm Published: 2025-06-27 Status: Disclosed Data size: 858GB Views: 141616 Website: https://evolupharm.fr/ Country: FR Revenue: $71M Employees: 500 About company: EvoluPharm is a pharmaceutical laboratory founded in 1986. All of the laboratory's pharmacy and parapharmacy products are positioned in the hygiene, health, and beauty markets, including some of the most affordable products on the market. The laboratory offers a wide range of branded products, from baby products to dietary supplements and aromatherapy. |
||||||
| Ransomware | EvoluPharm id32931 | France | Healthcare / Pharma | pending | ||
|
[AI generated] EvoluPharm is a leading player in the pharmaceutical sector in France. The company offers an innovative model providing solutions and services for pharmacists, including a wide range of generic and specialty pharmaceuticals. They aim to optimize and digitize pharmacies through various management tools, marketing solutions and training. They also emphasize environmentally friendly practices. |
||||||
| Ransomware | Silent Gliss Italia id21028 View details | Italy | IT | leaked | ||
|
Silent Gliss Italia Published: 2025-06-27 Status: Disclosed Data size: 414GB Views: 141580 Website: https://silentgliss.it/ Country: IT Revenue: $25M Employees: 200 About company: Silent Gliss is the world's leading supplier of high-end interior shading systems. Known for innovative and sustainable solutions, exceptional design, and superior quality, Silent Gliss design and manufacture some of the quietest, smoothest-moving custom systems in the world. |
||||||
| Ransomware | Silent Gliss Italia id32932 | Italy | IT | pending | ||
|
[AI generated] Silent Gliss Italia is a branch of the global company, Silent Gliss, that specialises in the production and distribution of high-quality, innovative window treatments. The Switzerland-based company provides a wide range of products including curtain and blind systems. Silent Gliss Italia follows the parent company's commitment to exceptional Swiss quality, precision, and careful attention to detail in design. |
||||||
| Ransomware | Gateway Community id21027 View details | United States | Services | leaked | ||
|
Gateway Community Published: 2025-06-27 Status: Disclosed Data size: 890GB Views: 143764 Website: https://gatewaycommunity.com/ Country: USA Revenue: $39M Employees: 0 About company: Addiction treatment rehab. Massive leak of patients' information! Thousands of PII and medical records, identity documents. Full info! |
||||||
| Ransomware | Gateway Community id32933 | United States | Services | pending | ||
|
[AI generated] Gateway Community, also known as Gateway Community Services, is a non-profit organization based in the U.S. Their mission is to provide comprehensive and effective services for individuals and families affected by addictive diseases, mental health disorders, and homelessness. They offer assistance through education, prevention, treatment, and housing programs. |
||||||
| Ransomware | Arch-Con Corporation id21026 View details | United States | Construction / Real Estate | leaked | ||
|
Arch-Con Corporation Published: 2025-06-27 Status: Disclosed Data size: 2.7TB Views: 143243 Website: https://arch-con.com/ Country: USA Revenue: $270M Employees: 200 About company: Arch-Con Corporation is a general contractor specializing in commercial construction, offering services across various sectors including healthcare, hospitality, industrial, multifamily, office, retail, and corporate interiors. With a strong portfolio that includes over 120 industrial projects and nearly 200 healthcare projects, Arch-Con aims to anticipate challenges and deliver high-quality results. |
||||||
| Ransomware | Arch-Con Corporation id32934 | United States | Construction / Real Estate | pending | ||
|
[AI generated] Arch-Con Corporation is a Texas-based general contractor offering construction services for multiple industries. Its expertise spans commercial, industrial, retail, healthcare, hospitality, community, and corporate interiors. Besides traditional construction services, Arch-Con offers pre-construction planning such as feasibility studies, value engineering options, and constructability reviews. |
||||||
| Ransomware | KOLBUS id21025 View details | Germany | Manufacturing / Engineering | leaked | ||
|
[AI generated] KOLBUS is a leading international manufacturer of machines and tools for bookbinders, print shops, and packaging companies. Headquartered in Germany, the company’s innovative solutions include packaging production lines, bookbinding systems, and luxury packaging. Additionally, KOLBUS offers spare parts, conversions, and upgrades services for its machinery. Established in 1775, the company has a rich history and significant experience in the printing and packaging industry. |
||||||
| Ransomware | KOLBUS id32935 | Germany | Manufacturing / Engineering | pending | ||
|
[AI generated] KOLBUS is a leading international manufacturer of machines and tools for bookbinders, print shops, and packaging companies. Headquartered in Germany, the company’s innovative solutions include packaging production lines, bookbinding systems, and luxury packaging. Additionally, KOLBUS offers spare parts, conversions, and upgrades services for its machinery. Established in 1775, the company has a rich history and significant experience in the printing and packaging industry. |
||||||
| Ransomware | CR Architecture + Design id21024 View details | United States | Construction / Real Estate | leaked | ||
|
CR Architecture + Design Published: 2025-06-27 Status: Disclosed Data size: 2TB Views: 142814 Website: https://cr-architects.com/ Country: USA Revenue: $33M Employees: 200 About company: CR architecture + design specializes in creating diverse architectural solutions for retail, hospitality, public safety, mixed-use, education, and commercial sectors. CR Architects is dedicated to transforming spaces and solving practical problems with exceptional design. They focus on building communities by meticulously translating client visions into tangible designs while ensuring technical accuracy and creativity. |
||||||
| Ransomware | CR Architecture + Design id32936 | United States | Construction / Real Estate | pending | ||
|
[AI generated] CR Architecture + Design is a US-based company that specializes in providing architectural and design solutions. The firm delivers expertise across various sectors including housing, education, hospitality, and government. The team of architects, interior designers, and graphic designers work together, drawing on their different perspectives to create both functional and innovative spaces. They balance aesthetic concerns with practical requirements, ensuring successful project outcomes. |
||||||
| Ransomware | Institute of Culinary Education id21023 View details | United States | Education | leaked | ||
|
Institute of Culinary Education Published: 2025-06-27 Status: Disclosed Data size: 1.5TB Views: 142598 Website: https://ice.edu/ Country: USA Revenue: $50M Employees: 500 About company: The Institute of Culinary Education (ICE) is one of the largest and most diverse culinary schools in the world with campuses in New York and Los Angeles. ICE also offers continuing education for culinary professionals and is home to one of the world's largest recreational cooking, baking and beverage programs. |
||||||
| Ransomware | Institute of Culinary Education id32937 | United States | Education | pending | ||
|
[AI generated] The Institute of Culinary Education (ICE) is a reputable culinary school based in New York City, USA. Founded in 1975, ICE offers a wide range of professional certificate programs in culinary arts, pastry & baking, hospitality management, and culinary technology, among others. The Institute is known for its modern facilities, experienced faculty, and strong industry connections. |
||||||
| Ransomware | Crenshaw Community Hospital id21022 View details | United States | Healthcare / Pharma | leaked | ||
|
Crenshaw Community Hospital Published: 2025-06-27 Status: Disclosed Data size: 53GB Views: 142636 Website: https://crenshawcommunityhospital.com/ Country: USA Revenue: $22M Employees: 200 About company: Crenshaw Community Hospital, located in Luverne, Alabama, is a full service, 65-bed licensed acute care hospital with 24-hour emergency care. The hospital employs over 200 dedicated full-time and part-time staff members to provide care to the citizens of Crenshaw County. The hospital offers a range of diagnostic, therapeutic, emergency, and surgical services. |
||||||
| Ransomware | Crenshaw Community Hospital id32938 | United States | Healthcare / Pharma | pending | ||
|
[AI generated] Crenshaw Community Hospital is a medical facility based in Luverne, Alabama. Established in 1967, it offers a wide range of comprehensive health care services. In addition to an emergency department, the not-for-profit hospital operates outpatient clinics, laboratory and radiology services, and rehab facilities. The hospital remains committed to meeting the healthcare needs of Crenshaw County and the surrounding communities. |
||||||
| Ransomware | Rhea Vendors Group SpA id21021 View details | Italy | Retail / E-commerce | leaked | ||
|
Rhea Vendors Group SpA Published: 2025-06-27 Status: Disclosed Data size: 1.7TB Views: 141093 Website: https://rheavendors.com/ Country: IT Revenue: $27M Employees: 500 About company: Rhea Vendors Group is one of the largest producers of customized coffee machines in the world. With headquarters and manufacturing based in the province of Varese and 9 foreign branches, Rhea is proud of having spread coffee culture to over 100 countries around the world. |
||||||
| Ransomware | Rhea Vendors Group SpA id32939 | Italy | Retail / E-commerce | pending | ||
|
[AI generated] Rhea Vendors Group SpA is an Italy-based global company specializing in manufacturing vending machines for hot and cold drinks and snacks. Founded in 1960, the company utilizes advanced technology and innovative designs to deliver high-quality products. Their products range from custom-designed vending machines to fully automatic coffee machines. They cater to a broad range of industries, including offices, retail, and hospitality. |
||||||
| Ransomware | LTL id21020 View details | Spain | Transportation / Travel / Logistics | leaked | ||
|
LTL Published: 2025-06-27 Status: Disclosed Data size: 916GB Views: 141065 Website: https://ltlevante.com/ Country: ES Revenue: $14M Employees: 0 About company: With over 30 years’ experience in analytical tests on food, water, sludge, waste and soil as well as everything related to water treatment, LTL works with all certifications required in each field. This ensures the accuracy and reliability of the results obtained and the highest standard of work is performed for customers. |
||||||
| Ransomware | LTL id32940 | Spain | Transportation / Travel / Logistics | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | S****H id21019 View details | Germany | — | leaked | ||
|
No additional victim description available. |
||||||