Latest Research on INC and The Gentlemen Ransomware: Exposed AI Infrastructure
PayoutsKING Ransomware Group
Ransomware group profile
Description
PayoutsKING is a newly-identified ransomware group that surfaced in July 2025, primarily targeting hospitals, manufacturers, and educational institutions. The group's operations appear to follow a ransomware-as-a-service model, rapidly listing victims on data leak sites and employing aggressive financial extortion tactics.
Key insights
- •Targets diverse sectors, including healthcare, manufacturing, and education.
- •Utilizes remote desktop protocol (RDP) access, phishing templates, and cracked panel kits for initial access.
- •Employs various malware families like Azorult and RedLine for data theft and credential harvesting.
- •Adopts a victim-centric approach, quickly disclosing compromised data on leak sites.
- •Active in both North America and Europe, with a broad geographic reach.
- •Indicates a strong financial motivation, evident in aggressive ransom demands.
Threat Level & Status Breakdown
For PayoutsKING · Based on incidents in selected period
Status Breakdown
Recent activity
Monthly attack count for PayoutsKING in the selected period
Intelligence
IOCs, YARA/Sigma rules, and related families for PayoutsKING
- 7eec7d07587112777016e5742c0d002d7e64a3e1fe7bde82fed8f65e3663456a
- e1c371c7c39c16d208bcbaa5b5d0714df696e6ef68b95a880673a904527c8b96
- e06520c65bf27d9110d68ecc0de0e0824c3a99be080ead1a5b5be8fd2a26d12d
TTPs & Attack Vectors
Tools, initial access, and MITRE ATT&CK techniques for PayoutsKING
T1486
T1486
T1490
T1490
T1078
T1078
T1021
T1021
T1562
T1562
T1059
T1059
T1547
T1547
T1021.001
T1021.001
T1005
T1005
T1041
T1041
T1080
T1080
Victims(55)
| Company | Country | Status | Discovered | |
|---|---|---|---|---|
| Merical LLC | United States | Claimed | 6 days ago | |
| Morrow Meadows Corporation | United States | Claimed | 15 days ago | |
| Watermark Retirement Communities | United States | Claimed | 23 days ago | |
| Proliance Surgeons | United States | Claimed | about 2 months ago | |
| Merrill Iron & Steel | United States | Claimed | 21 days ago | |
| Turner | United States | Claimed | 3 months ago | |
| H.W. Lochner | United States | Claimed | 2 months ago | |
| Casta Diva Group | Italy | Claimed | 4 months ago | |
| Welldyne | United States | Claimed | 4 months ago | |
| Caunton Engineering Ltd | United Kingdom | Claimed | 6 months ago | |
| V. FRAAS | Germany | Claimed | 6 months ago | |
| BHID Group | United Kingdom | Claimed | 6 months ago | |
| Vortex Companies | United States | Claimed | 6 months ago | |
| Telia | Norway | Claimed | 6 months ago | |
| Prater Engineering Associates, Inc. | United States | Claimed | 6 months ago | |
| ESENTIA Energy Systems | Mexico | Claimed | 6 months ago | |
| Del Monte Foods | United States | Claimed | 6 months ago | |
| UFP Technologies | United States | Claimed | 6 months ago | |
| AERO-COATING GmbH | Germany | Claimed | 6 months ago | |
| Peachtree Group | United States | Claimed | 6 months ago |
Page 1 of 3
Affected countries(54)
Countries where this group has been reported to target or leak victims.