Payouts King Ransomware — BlackBasta-Affiliate RaaS Evades EDR via Direct System Calls, ntdll Export-Table Walking, and SetFileInformationByHandle Rename Evasion (Zscaler ThreatLabz) — Threadlinqs Intelligence
As of 2026-06-06, Payouts King Ransomware — BlackBasta-Affiliate RaaS Evades EDR via Direct System Calls, ntdll Export-Table Walking, and SetFileInformationByHandle Rename Evasion (Zscaler ThreatLabz) is a high-severity ransomware threat attributed to Payouts King, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 15 indicators of compromise.
Threat ID: TL-2026-0692 · Severity: HIGH · Status: ACTIVE · Category: RANSOMWARE
Attribution: Payouts King · FINANCIAL
Zscaler ThreatLabz published a binary-level analysis of Payouts King, a data-theft-driven ransomware operation run by former BlackBasta affiliates (BlackBasta disbanded Feb 2025; Payouts King first
Payouts King is a double-extortion ransomware operation that ThreatLabz attributes to former BlackBasta affiliates. BlackBasta emerged in February 2022 as a Conti successor and operated until February 2025, when leaked internal chat logs forced the brand to disband. Its initial access brokers continued operations, and Payouts King first appeared in April 2025. By early 2026 the group had claimed 50+ named victims, with the United States the largest share followed by Germany, France, and Spain. Initial access mirrors historic BlackBasta tradecraft: email spam bombing, Microsoft Teams impersonation of IT help desk, and abuse of Quick Assist for remote access.
The core of this analysis is the Windows payload's EDR-evasion engineering. Rather than calling documented Windows APIs (which security products hook in user mode), Payouts King resolves and invokes native NT syscalls directly. At runtime it walks the loaded ntdll module's export table, enumerating function names beginning with the 'Zw' prefix, and computes a custom CRC32 checksum (polynomial 0xBDC65592, per-value FNV1 seed) for each name, matching against expected DWORD constants to locate the functions it needs — including ZwQueryInformationFile (0x806e69a7), ZwQueryInformationProcess (0x1993a634), ZwOpenProcess (0x58ad11ee), ZwTerminateProcess (0x469424d5), ZwOpenFile (0x28a29ebf), and ZwQuerySystemInformation (0xa0595508). This yields a private syscall table that bypasses user-mode API hooks.
Process termination uses the same checksum technique: the binary carries 131 hardcoded DWORD checksum values representing AV/EDR and security tooling. It enumerates running processes via ZwQuerySystemInformation, checksums each process name, and terminates matches via ZwOpenProcess + ZwTerminateProcess. Documented targets span CrowdStrike (csfalconservice.exe), SentinelOne (sentinelagent.exe, sentinelctl.exe, sentinelui.exe), Microsoft Defender (MsMpEng.exe, MsSense.exe), Kaspersky (avp.exe, avpui.exe), Norton, McAfee, Cylance, Cybereason, Deep Instinct, F-Secure, and 100+ additional products.
String obfuscation defeats static signatures and precomputed hash tables: strings and their XOR keys are stored as stack-based arrays of QWORDs, constructed and decrypted in-place at runtime, leaving no plaintext in the on-disk image. The custom CRC32 with unique FNV1 seeds per value further frustrates hash-database lookups.
Encryption is hybrid: a per-file pseudorandom 32-byte AES-256 key and 16-byte IV encrypt file data in CTR mode using statically linked OpenSSL; the per-file parameters are then RSA-4096-encrypted and appended as a 487-byte trailer. The encrypted trailer carries magic bytes 'CRPT' (0x50545243), an encryption-type field (0x825456 for AES), original/encrypted sizes, and a block count (1 = full encryption, 0xd = 13-block partial). Selective encryption: files matching a target extension list or under 10MB are fully encrypted; larger files are split into 13 blocks with ~50% of each block encrypted, controllable via the '-percent' CLI parameter. Executables and system artifacts (.exe, .dll, .sys, .bat, .lnk, .msi) and system directories (Windows, Program Files, Recovery, $Recycle.Bin) are excluded to preserve host stability.
Encrypted files receive the .ZWIAAW extension, with .esVnyj used as a temporary backup during processing. The ransom note readme_locker.txt is dropped to the desktop only when the '-note' CLI flag is supplied; it directs victims to a TOX contact and a Tor-hosted data leak site that publishes victim names with countdown timers and progressive data disclosure. Pre-encryption, the malware performs anti-recovery actions: shadow copy deletion, Windows event log clearing, and recycle bin emptying.
Target sectors: manufacturing, healthcare, construction, financial, professional-services
Target regions: North America, Europe
Detections & IOCs
As of 2026-07-20, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 15 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
RANSOMWARE, HIGH, threat intelligence, cybersecurity, T1566, T1566.003, T1219, T1106, T1562.001, T1027, T1027.007, T1070.001, T1070.004, T1036