Threat reportRansomwareTL-2026-3951
Payouts King Ransomware and AI-Assisted Data-Theft Extortion via Teams Vishing and Quick Assist
Payouts King Ransomware and AI-Assisted Data-Theft Extortion (TL-2026-3951) is a high-severity ransomware operation, first published 2026-10-20. It is attributed to Payouts King with high confidence, affects Microsoft Windows (endpoints and Active Directory environments), maps to 17 MITRE ATT&CK techniques (T1003.003, T1021.002, T1027.007), and is covered by 9 detection rules and 14 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 17MITRE ATT&CK
- Actors
- 1Payouts King
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 14Indicators of compromise
Key facts for TL-2026-3951
- Threat ID
- TL-2026-3951
- Severity
- HIGH
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- Last reviewed
- Attribution
- Payouts King
- Attribution confidence
- HIGH
- Motivation
- FINANCIAL
- Target sectors
- health, finance, manufacturing, technology, freight-logistics, utilities
- Target regions
- North America, Europe
- Detection rules
- 9
- Indicators of compromise
- 14
Malware and tooling in Payouts King Ransomware and AI-Assisted Data-Theft Extortion
Malware and tooling: AnyDesk, TeamViewer, payoutsking, AnyDesk, Quick Assist, Rclone - S1040, TeamViewer
How Payouts King Ransomware and AI-Assisted Data-Theft Extortion works
Ransomware operators, including Payouts King (linked with high confidence to former BlackBasta affiliates), use email flooding, Microsoft Teams IT-support impersonation and Quick Assist to gain access, then stage and exfiltrate data over SFTP within hours. Zscaler ThreatLabz reports 896.2 TB exfiltrated by the top 10 groups (Apr 2025-Mar 2026) and generative-AI use to speed scripting and data triage.
Payouts King is a ransomware operation that emerged in April 2025. Zscaler ThreatLabz attributes it with high confidence to former BlackBasta affiliates, following BlackBasta's February 2025 dissolution after its internal chat logs leaked. Activity intensified in early 2026 and targeted organizations in the United States, Germany, Canada, France, Italy, Spain, the United Kingdom, Norway, Mexico, Poland and Belgium.
Initial access relies on social engineering. Operators flood a victim's inbox with email (spam bombing), then contact the user on Microsoft Teams while impersonating internal IT staff and persuade them to launch Quick Assist and hand over remote control. The GBHackers write-up of the Zscaler ThreatLabz 2026 Ransomware Report also lists AnyDesk, TeamViewer and other remote management tools as abused for access. After the foothold, reporting describes AI-assisted triage of which files and accounts matter, lateral movement using native Windows features, Active Directory shadow credential abuse for persistence, and data staging and exfiltration over SFTP within hours of initial access. Hive Pro and search summaries of Zscaler's analysis also describe NTDS.dit, SAM and SYSTEM hive theft via a VSS shadow copy, SMB and Rclone to remote SFTP servers. Some victims are extorted on the threat of disclosure alone: the article describes a healthcare victim that paid $2 million with no encryption taking place. Zscaler's own report pages checked for this research did not repeat the Payouts King, shadow-credential or $2 million details, so those come from the GBHackers article.
The Payouts King payload uses stack-based string building, FNV1 hash-based Windows API resolution, a custom CRC scheme to obfuscate command-line arguments (-i identity key required, -mode all/local/share, -path, -percent, -note, -nopersist, -nohide, -noelevate, -backup, -log, -time), and direct system calls (manually resolved Zw* functions) to terminate processes matching 131 hard-coded AV/EDR process checksums. Persistence is via SYSTEM scheduled tasks named \Mozilla\UpdateTask and \Mozilla\ElevateTask that run at startup and are deleted after execution. Files are encrypted with a statically linked OpenSSL implementation using 4096-bit RSA and 256-bit AES in counter mode (ChaCha20 also referenced in the file format), with partial encryption of large files in 13 alternating blocks. Encrypted files receive the .ZWIAAW extension, and the ransom note readme_locker.txt is dropped only if -note is set. Anti-forensics include vssadmin delete shadows /all /quiet, recycle bin emptying and Windows event log clearing. Victims are directed to TOX and a Tor leak site.
Broader context from the Zscaler ThreatLabz 2026 Ransomware Report (press release dated 2026-09-30): ransomware data theft rose more than 275% year over year to 896.2 TB, 7,366 victims were listed on leak sites, blockchain ransomware payments totalled $328 million, the average payment was $431,995 (+5.3%), and manager-level or higher employees were 62% of victims. Per the article, more than 75% of victims worked in finance, sales, operations, HR or marketing. Generative AI is being used to accelerate scripting (JavaScript, PowerShell, Python) and tooling. No CVEs are involved; this is a social-engineering and trusted-tool abuse campaign.
MITRE ATT&CK techniques used in TL-2026-3951
Credential Access
Lateral Movement
T1021.002 SMB/Windows Admin Shares
Defense Evasion
T1027.007 Dynamic API Resolution; T1140 Deobfuscate/Decode Files or Information
Exfiltration
T1048 Exfiltration Over Alternative Protocol
Persistence
T1053.005 Scheduled Task; T1098 Account Manipulation
Execution
T1059.003 Windows Command Shell; T1106 Native API
Command and Control
Impact
T1490 Inhibit System Recovery; T1657 Financial Theft
Discovery
T1518.001 Security Software Discovery
Initial Access
T1566.003 Spearphishing via Service; T1566.004 Spearphishing Voice
defense-impairment
T1685 Disable or Modify Tools; T1685.005 Clear Windows Event Logs
Affected products and versions in Payouts King Ransomware and AI-Assisted Data-Theft Extortion
- Microsoft — Windows (endpoints and Active Directory environments); Microsoft Teams and Quick Assist abused as access vectors
Remediation for Payouts King Ransomware and AI-Assisted Data-Theft Extortion
Immediate actions
- Alert on Quick Assist (quickassist.exe) launches that follow an external Microsoft Teams call or mail-flood event
- Hunt for scheduled tasks \Mozilla\UpdateTask and \Mozilla\ElevateTask running as SYSTEM with ONSTART triggers
- Hunt for files named readme_locker.txt and files with the .ZWIAAW or .esVnyj extensions
- Block or alert on outbound SFTP/SSH and Rclone use from non-approved hosts and servers holding sensitive data
- Review Active Directory for unexpected msDS-KeyCredentialLink (shadow credential) changes and NTDS.dit/SAM/SYSTEM copies
Workarounds
- Remove the Quick Assist app where not needed
- Block external Teams chats from unmanaged tenants
Longer-term hardening
- Restrict Microsoft Teams external federation and external-user chat to approved tenants
- Disable or restrict Quick Assist and unapproved remote access tools (AnyDesk, TeamViewer) via application control
- Train staff, especially managers and finance, sales, operations, HR and marketing roles, on IT-support impersonation and email-bombing
- Segment SMB traffic between workstations and file servers and limit user write access to shares
- Maintain immutable, air-gapped 3-2-1 backups and test restoration
- Deploy tamper-protected EDR and monitor for direct-syscall process termination of security tools
Timeline of Payouts King Ransomware and AI-Assisted Data-Theft Extortion
- BlackBasta dissolves in February 2025 after internal chat logs leak; Zscaler later links Payouts King to former BlackBasta affiliates (day of month not stated in sources).
- Payouts King ransomware operation emerges in April 2025 (day of month not stated in sources).
- Payouts King spam-bombing, Teams vishing and Quick Assist campaigns intensify in early 2026, hitting organizations in the US, Germany, Canada, France, Italy, Spain, UK, Norway, Mexico, Poland and Belgium (exact start not stated).
- Zscaler ThreatLabz and Hive Pro publish technical analysis of Payouts King, covering the CRC-obfuscated arguments, direct-syscall EDR termination, scheduled-task persistence and the .ZWIAAW extension (April 2026, from source URLs; exact day not stated).
- Zscaler publishes its 2026 Ransomware Report: 896.2 TB exfiltrated (+275% year over year), 7,366 leak-site victims, $328M in blockchain ransom payments, AI-assisted scripting and Teams/Quick Assist abuse.
- GBHackers reports ransomware groups using AI to find sensitive data quickly, with SFTP exfiltration within hours of access and a healthcare victim paying $2 million without any encryption.
Sources cited for Payouts King Ransomware and AI-Assisted Data-Theft Extortion
- Ransomware Gangs Use AI to Find and Steal the Most Sensitive Company Data Quickly
- Zscaler ThreatLabz: Payouts King - New Ransomware on the Rise
- Zscaler Press Release: New Report Reveals AI-Assisted Attackers Move to Massive Data Theft and Executive Targeting
- Zscaler ThreatLabz 2026 Ransomware Report (landing page)
- Hive Pro Threat Advisory: Payouts King Ransomware - Blending In Before Breaking Through
- Hive Pro Advisory TA2026104 (PDF)
- Payouts King Takes Aim at the Ransomware Throne (Security Boulevard)
Detection coverage for TL-2026-3951
As of 2026-10-20, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3951 across Splunk SPL, Microsoft KQL and Sigma, covering 14 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.