payoutsking

Payoutsking is a ransomware group operating an extortion-based model that threatens to leak stolen data unless negotiations are opened, and it has used QEMU-based virtualization to hide Linux environments inside Windows systems to evade detection, enabling long-term access, credential theft, data exfiltration, and ransomware deployment. More than 70 victims have been attributed to the group, across sectors including Manufacturing, Healthcare, Technology, Construction, and Agriculture and Food Production, with the United States, Germany, the United Kingdom, Italy and France most affected. A recent pattern in the reporting shows extortion tied to data-leak threats, illustrated by the Proliance Surgeons incident where an extortion notice threatened to release sensitive data.

Sectors: Manufacturing, Healthcare, Technology · Countries: US, DE, UK