Payouts King Ransomware Evades EDR via Obfuscation and Direct System Calls

Key Takeaways

• The Payouts King ransomware group, active since April 2025, has significantly increased its activity in early 2026, with strong ties to former BlackBasta affiliates.
• The ransomware employs sophisticated evasion techniques, including on-the-fly string decryption, hash-based Windows function resolution, and direct system calls to bypass Endpoint Detection and Response (EDR) tools.
• Initial infections often leverage social engineering via Microsoft Teams and Quick Assist, followed by data exfiltration and targeted file encryption using a hybrid RSA/AES scheme.
• Organizations must prioritize user training, multi-factor authentication, and proactive threat hunting to defend against Payouts King’s advanced tactics.

Payouts King Ransomware: Former BlackBasta Affiliates Fuel Evasive New Threat

The Payouts King ransomware operation has steadily escalated its activities since its initial appearance in April 2025. After a period of relative obscurity last year, early 2026 has seen a marked surge in attacks, which security researchers attribute to individuals previously involved with the now-defunct BlackBasta ransomware group.

Payouts King employs a well-established but highly effective attack methodology. This typically involves infiltrating target networks, exfiltrating substantial quantities of sensitive data, and then selectively encrypting critical files on compromised systems.

BlackBasta, which emerged in February 2022 as a successor to the notorious Conti ransomware, ceased operations in February 2025 following the public leak of its internal chat logs. While the group officially disbanded, many of its affiliates simply transitioned to new operations. These former BlackBasta actors have been observed deploying other ransomware families, such as Cactus, and are now increasingly aligning with Payouts King.

Researchers at Zscaler documented these evolving attack patterns, sharing their findings with Cyber Security News (CSN). Their report confirms with high confidence that a significant portion of the renewed ransomware activity can be attributed to Payouts King. The analysis highlighted striking similarities between current Payouts King campaigns and previous BlackBasta operations, particularly in their social engineering tactics.

Initial Access and Lateral Movement

The typical infection chain for Payouts King often commences with “spam bombing,” where attackers inundate a victim’s email inbox with a flood of unsolicited messages. This is followed by an impersonation attempt, where the attacker poses as an IT support employee, initiating contact via Microsoft Teams. The ultimate goal is to persuade the victim to authorize a Quick Assist session, granting the attacker remote access.

Once initial access is secured, the attacker deploys malware, establishing a covert foothold within the target organization’s network. From this point, Payouts King moves rapidly to escalate privileges, gain full system-level access, and take steps to hinder recovery and forensic efforts. This includes deleting Windows shadow copies, clearing event logs, and emptying the recycle bin before initiating the encryption process. The group also maintains a dedicated data leak site on the dark web, employing double extortion tactics by threatening to publish stolen information if the ransom is not paid.

Advanced Evasion Techniques Bypass EDR

A critical characteristic of Payouts King is its aggressive focus on evading detection by security tools. The ransomware dynamically builds and decrypts strings during execution, rather than storing them in a readily readable format, which significantly complicates static analysis. Furthermore, it resolves Windows API functions using hash values instead of plain function names and implements a custom checksum algorithm with a unique seed for each value. This approach effectively thwarts security solutions that rely on pre-computed hash tables for malware identification.

When Payouts King encounters a file locked by a security product, preventing encryption, it scans all active processes. It then cross-references these against a hardcoded list of 131 known antivirus and endpoint detection software processes. Crucially, instead of using standard Windows API calls to terminate these security tools, Payouts King employs direct system calls. This method allows the ransomware to bypass the API hooks that most EDR products rely on to detect and prevent suspicious activities.

Encryption Design and Defense Evasion

Payouts King utilizes a robust encryption scheme combining 4096-bit RSA with 256-bit AES in counter mode, embedding a statically linked OpenSSL library within the malware itself. Files smaller than 10MB are fully encrypted. For larger files, the ransomware divides them into 13 blocks, encrypting only half of each block. This partial encryption strategy is designed to accelerate the attack process without diminishing its impact on data accessibility.

To further evade detection, the ransomware avoids standard Windows file rename functions after encryption. Instead, it employs a lower-level system call that many security tools do not actively monitor. Encrypted files are appended with the .ZWIAAW extension. The ransom note, named readme_locker.txt, is only deployed when a specific command-line flag is provided at runtime, making automated sandbox analysis more challenging.

What You Should Do

• Enhance User Awareness Training: Educate employees about common social engineering tactics, particularly those involving fake IT support requests via platforms like Microsoft Teams.
• Implement Multi-Factor Authentication (MFA): Enforce MFA across all user accounts and critical systems to prevent unauthorized access even if credentials are compromised.
• Monitor Remote Access Tools: Closely monitor for unusual or unauthorized usage of remote assistance tools such as Quick Assist.
• Proactive Threat Hunting: Invest in and conduct regular proactive threat hunting activities to identify advanced threats that may bypass automated detection systems.
• Regular Backups and Recovery Plans: Maintain immutable, offsite backups of critical data and regularly test recovery procedures.
• Review Indicators of Compromise (IoCs): Incorporate the following IoCs into your security monitoring and detection systems:
  • SHA256: 335ad12a950f885073acdfebb250c93fb28ca3f374bbba5189986d9234dcbff4 (Payouts King sample)
  • SHA256: d68ce82e82801cd487f9cd2d24f7b30e353cafd0704dcdf0bb8f12822d4227c2 (Payouts King sample)
  • File Extension: .ZWIAAW (Encrypted files)
  • File Name: readme_locker.txt (Ransom note)
  • File Extension: .esVnyj (Temporary backup files during encryption)

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.