Payouts King Ransomware Uses Evasion Techniques and RSA-AES Encryption
Summary
Zscaler researchers detail Payouts King ransomware, linking some activity to former BlackBasta affiliates and describing its social-engineering access methods, evasion, persistence, encryption, and impact on security processes.
Key points
- ThreatLabz observed ransomware activity from early 2026 consistent with former BlackBasta initial access brokers and attributed some attacks to Payouts King.
- Reported access methods include spam bombing, phishing or vishing, and impersonating IT staff through Microsoft Teams and Quick Assist.
- Payouts King uses stack-based string obfuscation, hashed API resolution, and a custom checksum; it can establish persistence and elevate privileges through scheduled tasks.
- The ransomware uses 4,096-bit RSA and 256-bit AES-CTR to encrypt files, with partial encryption for many files larger than 10 MB.
- It can attempt to terminate security-related processes using direct system calls, and deletes shadow copies, empties the recycle bin, and clears Windows event logs.
- The ransom note is created only when the `-note` argument is specified; the article also provides two sample SHA-256 hashes.
Article Details
- Attack Vectors
- Spam bombing followed by phishing or vishing that impersonates the victim organization’s IT staff and directs the victim to join a Microsoft Teams call and initiate Quick Assist.
- After gaining access, attackers deploy malware to establish a foothold on the victim organization’s network.
- Payouts King selectively encrypts files and steals data; it can establish persistence through scheduled tasks, elevate privileges, terminate security-related processes, delete shadow copies, empty the recycle bin, and clear Windows event logs.
- Defensive Notes
- Train users to recognize and report spam bombing, vishing, and fake technical-support scams.
- Enforce multi-factor authentication.
- Monitor for anomalous use of remote access tools such as Quick Assist.
- Use proactive threat hunting and continuously adapt security controls.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 335ad12a950f885073acdfebb250c93fb28ca3f374bbba5189986d9234dcbff4 | SHA-256 hash of a Payouts King ransomware sample. |
| SHA256 | d68ce82e82801cd487f9cd2d24f7b30e353cafd0704dcdf0bb8f12822d4227c2 | SHA-256 hash of a Payouts King ransomware sample. |
MITRE ATT&CK
T1053.005 · Scheduled TaskPayouts King establishes persistence and schedules privilege elevation using Windows scheduled tasks.T1055 · Process InjectionNot supported by the article.T1070.001 · Clear Windows Event LogsPayouts King clears Windows event logs using EvtClearLog.T1070.004 · File DeletionPayouts King empties the recycle bin using SHEmptyRecycleBinW.T1486 · Data Encrypted for ImpactPayouts King encrypts files on victim systems.T1490 · Inhibit System RecoveryPayouts King deletes Windows shadow copies using vssadmin.exe.T1562.001 · Disable or Modify ToolsPayouts King attempts to terminate antivirus and EDR processes using direct system calls.
Threat Actors
Malware
Cactusthe group’s former affiliates have continued attacks by deploying different ransomware families such as Cactus. Zscaler ThreatLabz has observed continued ransomware activity that is consistent with attacks launchedPayouts Kingof these attacks have been attributed to a relatively unknown ransomware group that calls itself the Payouts King.
Vendors
Products
Microsoft TeamsMany of the attacks follow similar techniques, tactics, and procedures (TTPs) as prior attacks such as leveraging spam bombing, Microsoft Teams, and Quick Assist.Microsoft Windowscommon obfuscation methods such as building and decrypting strings on the stack, importing and resolving Windows API functions by hash, and hashing important strings instead of hardcoding them. Payouts King uses aOpenSSLa combination of 4,096-bit RSA and 256-bit AES in counter (CTR) mode. The encryption code leverages the OpenSSL library, which is statically linked. Each file is encrypted with a pseudorandom key and nonce. The formatQuick AssistMany of the attacks follow similar techniques, tactics, and procedures (TTPs) as prior attacks such as leveraging spam bombing, Microsoft Teams, and Quick Assist.