The Rise of Payouts King and the Resurrection of BlackBasta

Security researchers observed a new ransomware group, "Payouts King," emerging from former BlackBasta affiliates that uses spam-bombing and vishing to trick victims into granting remote access via legitimate tools (e.g., Teams, Quick Assist), then deploys a sophisticated ransomware family employing direct system calls, anti-analysis techniques (API and string hashing, stack-based string obfuscation), and strong encryption (RSA and AES-256); the group has an active data leak site and confirmed victims across Europe and the USA.