# Payouts King Ransomware — BlackBasta Successor Operation Targeting US Manufacturing, Healthcare, and Construction Sectors

> Payouts King is an active double-extortion ransomware operation that emerged in April 2025 and has been attributed with high confidence by Zscaler ThreatLabz to former BlackBasta affiliates following BlackBasta's February 2025 disbandment. The group reuses BlackBasta-era TTPs — email bombing, Microsoft Teams IT-support impersonation, and Quick Assist remote-control abuse for initial access — then performs hands-on-keyboard lateral movement, broad data theft, and selective file encryption using RSA-4096 + AES-256-CTR. As of April 2026 the group has publicly named 60+ victims with approximately 18.7 TB of claimed exfiltrated data, concentrated in US manufacturing, healthcare, and construction organizations.

- **Published:** 2026-04-16T12:00:00Z
- **Last reviewed:** 2026-04-16T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0378
- **ID:** TL-2026-0378
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Payouts King (Russia)
- **Detections:** 9 · **IOCs:** 24 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Payouts King is a ransomware-and-extortion operation first observed in April 2025 following the February 2025 collapse of the BlackBasta cartel, whose internal Matrix chat logs were leaked by the handle 'ExploitWhispers' in mid-February 2025. Zscaler ThreatLabz's April 2026 research attributes Payouts King to former BlackBasta affiliates with high confidence based on shared tradecraft, reused tooling, overlapping victimology, and near-identical social-engineering playbooks.

Initial access is achieved through a distinctive social-engineering chain directly inherited from BlackBasta. Operators first conduct 'email bombing' against a target employee — subscribing the victim's corporate email to thousands of newsletter and marketing lists within minutes to produce a flood of legitimate-looking but overwhelming inbound mail. While the victim is distracted, the operator places a Microsoft Teams chat or call from an externally federated tenant configured with a display name that impersonates the organization's IT help-desk (e.g., 'IT Support', 'Help Desk', 'Security Operations'). Posing as IT, the operator walks the victim through opening Windows Quick Assist (quickassist.exe) and accepting a remote-control session, at which point the attacker has an interactive foothold on a domain-joined workstation.

From the Quick Assist foothold, operators drop second-stage tooling — typically AnyDesk, NetSupport Manager, or ScreenConnect for resilient remote access — alongside a Cobalt Strike beacon. Payouts King operators conduct credential access via LSASS memory dumping and Kerberoasting, enumerate Active Directory with BloodHound/SharpHound and native LOLBins (net.exe, nltest, dsquery), and pivot laterally via SMB admin shares, WMI, and RDP. Domain Admin compromise is typically achieved within hours.

Prior to encryption, operators stage large volumes of business data using rclone, MegaSync, WinSCP, and occasionally FileZilla, exfiltrating to attacker-controlled cloud endpoints. Selective encryption is then performed with a custom Windows PE-based encryptor that implements RSA-4096 envelope encryption of per-file AES-256-CTR keys — a direct evolution of the BlackBasta encryption scheme. Volume shadow copies are destroyed with vssadmin.exe and wbadmin.exe, backups are targeted where reachable, and Microsoft Defender is tampered with via registry keys and PowerShell cmdlets.

The group operates a Tor-hosted data-leak site ('payoutsking') where victims are named and countdown timers drive payment pressure. ransomware.live tracker first profiled the group in July 2025; BlackFog's February 2026 analysis and Zscaler ThreatLabz's April 2026 deep-dive confirm 60+ listed victims with approximately 18.7 TB of claimed exfiltrated data. Known named victims include rehabilitation clinics in Jacksonville, Florida (September 2025) and Prater Engineering Associates (February 2026, 2.5 TB claim). Sector targeting is concentrated in US manufacturing, healthcare (notably behavioral health and rehab), and construction/engineering firms — organizations typically characterized by tight operational uptime requirements and limited mature EDR coverage.

Defensive priorities: (1) restrict Microsoft Teams external federation and display-name spoofing via tenant-level policy; (2) disable or tightly constrain Quick Assist in enterprise environments, or alert on quickassist.exe execution; (3) monitor for email-bombing patterns (sudden spike in unique sender domains per mailbox); (4) alert on unsigned RMM binaries (AnyDesk, NetSupport, ScreenConnect) appearing on endpoints outside sanctioned deployments; (5) enforce tamper protection on Microsoft Defender and EDR; (6) monitor vssadmin/wbadmin destructive subcommands; (7) baseline rclone/MegaSync/WinSCP egress to unfamiliar cloud endpoints.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1583.001 Acquire Infrastructure: Domains
- T1587.001 Develop Capabilities: Malware
- T1589.002 Gather Victim Identity Information: Email Addresses
- T1566.004 Phishing: Spearphishing Voice
- T1566 Phishing
- T1078.002 Valid Accounts: Domain Accounts
- T1204.002 User Execution: Malicious File
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1059.003 Command and Scripting Interpreter: Windows Command Shell
- T1047 Windows Management Instrumentation
- T1219 Remote Access Tools
- T1543.003 Create or Modify System Process: Windows Service
- T1134 Access Token Manipulation
- T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control
- T1685 Disable or Modify Tools
- T1070.004 Indicator Removal: File Deletion
- T1027 Obfuscated Files or Information
- T1036.005 Match Legitimate Resource Name or Location
- T1003.001 OS Credential Dumping: LSASS Memory
- T1558.003 Steal or Forge Kerberos Tickets: Kerberoasting
- T1087.002 Account Discovery: Domain Account
- T1482 Domain Trust Discovery
- T1083 File and Directory Discovery
- T1135 Network Share Discovery
- T1021.002 Remote Services: SMB/Windows Admin Shares
- T1021.001 Remote Services: Remote Desktop Protocol
- T1570 Lateral Tool Transfer
- T1005 Data from Local System
- T1039 Data from Network Shared Drive
- T1560 Archive Collected Data
- T1105 Ingress Tool Transfer
- T1071.001 Application Layer Protocol: Web Protocols
- T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage
- T1048 Exfiltration Over Alternative Protocol
- T1486 Data Encrypted for Impact
- T1490 Inhibit System Recovery
- T1489 Service Stop

## Sources

- [Payouts King Takes Aim at the Ransomware Throne — Zscaler ThreatLabz (via Security Boulevard)](https://securityboulevard.com/2026/04/payouts-king-takes-aim-at-the-ransomware-throne/)
- [ransomware.live — Payouts King group profile and victim tracker](https://www.ransomware.live/group/payoutsking)
- [BlackFog — Payouts King ransomware profile](https://www.blackfog.com/cybersecurity-101/payouts-king/)
- [Comparitech — Rehab Clinics in Jacksonville Targeted by New Ransomware Gang](https://www.comparitech.com/news/rehab-clinics-in-jacksonville-fl-targeted-by-new-ransomware-gang/)
- [Dark Web Informer — Prater Engineering Associates victim post (2.5 TB claim)](https://darkwebinformer.com/payouts-kings-ransomware-group-claims-attack-on-prater-engineering-associates-threatens-to-leak-2-5tb-of-data/)
- [MITRE ATT&CK — T1566.004 Spearphishing Voice](https://attack.mitre.org/techniques/T1566/004/)
- [MITRE ATT&CK — T1219 Remote Access Software](https://attack.mitre.org/techniques/T1219/)
- [CISA StopRansomware — Ransomware Guide](https://www.cisa.gov/stopransomware/ransomware-guide)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0378