Payouts King

A double-extortion cybercriminal group also tracked by Sophos as GOLD ENCOUNTER, active since 2025. It uses VPN or application compromise, email bombing, Teams-based vishing, Quick Assist and other remote tools, steals data, and deploys its own ransomware; reporting links some tradecraft to former Black Basta affiliates.