Payouts King Rises as New Ransomware Threat Linked to Former BlackBasta Affiliates

Payouts King is an active and technically sophisticated ransomware group that emerged after the collapse of BlackBasta; it performs targeted attacks combining spam bombing, Microsoft Teams social engineering, abuse of Quick Assist for remote access, large-scale data theft, selective file encryption using 4,096-bit RSA and AES-256-CTR, and publishes stolen data on a Tor-based leak site. The malware includes strong anti-analysis features (stack-based string encryption, hashed API resolution, custom CRC, anti-sandbox checks) and uses direct syscalls to disable 131 AV/EDR products, then deletes shadow copies and logs to impede recovery and forensics.