Payouts King: Payouts King Emerges: New Ransomware Operation Tied to Ex-BlackBasta Members

Payouts King: A Sophisticated Ransomware Operation Emerges from BlackBasta’s Shadow

A new ransomware group, Payouts King, has surfaced as a highly technical successor to the defunct BlackBasta operation, leveraging refined tactics from former affiliates while introducing advanced evasion techniques. First observed in April 2025 and gaining momentum in 2026, the group is believed to be operated by ex-BlackBasta initial access brokers, repurposing proven social-engineering methods and infrastructure.

Origins and Tactics

BlackBasta, a Conti-linked ransomware strain, rose to prominence in early 2022 before collapsing in early 2025 following a massive leak of internal chat logs. While the brand dissolved, its affiliates particularly initial access brokers migrated to other Ransomware-as-a-Service (RaaS) programs like Cactus, retaining their tactics, techniques, and procedures (TTPs). Zscaler ThreatLabz began tracking Payouts King in 2026, noting striking similarities to BlackBasta’s phishing lures, victim targeting, and infrastructure.

Initial Access: Social Engineering at Scale

Payouts King’s attacks begin with spam bombing, overwhelming victims with junk emails before deploying vishing (voice phishing). Attackers impersonate internal IT support, pressuring targets to join a Microsoft Teams session and launch Quick Assist a legitimate remote support tool under the guise of resolving email issues. Once access is granted, malware is deployed to establish persistence, move laterally, and prepare for encryption.

This method mirrors BlackBasta’s 2024–2025 playbook, which similarly exploited Teams-based phishing and social engineering against executives. The reuse of these TTPs particularly the Teams + Quick Assist + phone pressure combination strongly suggests continuity with BlackBasta’s ecosystem.

Technical Sophistication: Obfuscation and Evasion

Payouts King employs multi-layered obfuscation to evade detection:

• Stack-based string decryption and API hashing (via FNV1 with unique seeds) frustrate static analysis.
• Custom CRC-like checksums obscure command-line arguments, which control encryption behavior (e.g., -backup, -percent, -path).
• A hybrid encryption scheme combines 4,096-bit RSA with 256-bit AES-CTR, using statically linked OpenSSL libraries.
• Selective encryption balances speed and impact: small files are fully encrypted, while large files undergo partial, block-based encryption (e.g., 13 blocks, half encrypted per file).
• Anti-sandbox measures include an -i flag requiring a checksum match before execution.

EDR Evasion and Ransomware Execution

To bypass endpoint detection:

• The malware avoids common MoveFile APIs, instead using SetFileInformationByHandle with FileRenameInfo to rename encrypted files.
• It targets defensive processes by hashing running process names and comparing them against a list of 100+ AV/EDR checksums.
• Critical system files and directories (e.g., OS folders, executables) are spared to maintain system stability and ransom leverage.
• Progress-tracking headers in temporary files allow encryption to resume after interruptions.

Impact and Indicators

Payouts King’s emergence underscores the persistence of BlackBasta’s affiliate network, now operating under a rebranded, technically hardened threat. Organizations face heightened risks from spam bombing, vishing, and Quick Assist abuse, requiring stricter verification for remote support requests.

Key Indicators of Compromise (IOCs):

• SHA256: 335ad12a950f885073acdfebb250c93fb28ca3f374bbba5189986d9234dcbff4
• SHA256: d68ce82e82801cd487f9cd2d24f7b30e353cafd0704dcdf0bb8f12822d4227c2

  Source: https://gbhackers.com/payouts-king-emerges/

  Zscaler cybersecurity rating report: https://www.rankiteo.com/company/zscaler

"id": "ZSC1776414345",
"linkid": "zscaler",
"type": "Ransomware",
"date": "4/2025",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"

{'attack_vector': ['Social Engineering',
                   'Vishing',
                   'Phishing (Spam Bombing)',
                   'Microsoft Teams Abuse',
                   'Quick Assist Exploitation'],
 'data_breach': {'data_encryption': 'Hybrid (4,096-bit RSA + 256-bit AES-CTR)'},
 'date_detected': '2026',
 'date_publicly_disclosed': '2026',
 'description': 'A new ransomware group, Payouts King, has surfaced as a '
                'highly technical successor to the defunct BlackBasta '
                'operation, leveraging refined tactics from former affiliates '
                'while introducing advanced evasion techniques. The group is '
                'believed to be operated by ex-BlackBasta initial access '
                'brokers, repurposing proven social-engineering methods and '
                'infrastructure.',
 'initial_access_broker': {'entry_point': ['Spam Bombing',
                                           'Vishing',
                                           'Microsoft Teams + Quick Assist']},
 'lessons_learned': 'Organizations face heightened risks from spam bombing, '
                    'vishing, and Quick Assist abuse, requiring stricter '
                    'verification for remote support requests.',
 'motivation': 'Financial Gain',
 'post_incident_analysis': {'root_causes': 'Ex-BlackBasta affiliates '
                                           'repurposing proven TTPs, including '
                                           'social engineering, Teams-based '
                                           'phishing, and Quick Assist '
                                           'exploitation.'},
 'ransomware': {'data_encryption': 'Hybrid (4,096-bit RSA + 256-bit AES-CTR), '
                                   'selective encryption (small files fully '
                                   'encrypted, large files partially '
                                   'encrypted)',
                'ransomware_strain': 'Payouts King'},
 'references': [{'source': 'Zscaler ThreatLabz'}],
 'threat_actor': 'Payouts King (ex-BlackBasta affiliates)',
 'title': 'Payouts King: A Sophisticated Ransomware Operation Emerges from '
          'BlackBasta’s Shadow',
 'type': 'Ransomware'}