# Payouts King Ransomware and AI-Assisted Data-Theft Extortion via Teams Vishing and Quick Assist

> Ransomware operators, including Payouts King (linked with high confidence to former BlackBasta affiliates), use email flooding, Microsoft Teams IT-support impersonation and Quick Assist to gain access, then stage and exfiltrate data over SFTP within hours. Zscaler ThreatLabz reports 896.2 TB exfiltrated by the top 10 groups (Apr 2025-Mar 2026) and generative-AI use to speed scripting and data triage.

- **Published:** 2026-10-20T10:42:17Z
- **Last reviewed:** 2026-10-20T10:42:17Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3951
- **ID:** TL-2026-3951
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Payouts King
- **Detections:** 9 · **IOCs:** 14 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Payouts King is a ransomware operation that emerged in April 2025. Zscaler ThreatLabz attributes it with high confidence to former BlackBasta affiliates, following BlackBasta's February 2025 dissolution after its internal chat logs leaked. Activity intensified in early 2026 and targeted organizations in the United States, Germany, Canada, France, Italy, Spain, the United Kingdom, Norway, Mexico, Poland and Belgium.

Initial access relies on social engineering. Operators flood a victim's inbox with email (spam bombing), then contact the user on Microsoft Teams while impersonating internal IT staff and persuade them to launch Quick Assist and hand over remote control. The GBHackers write-up of the Zscaler ThreatLabz 2026 Ransomware Report also lists AnyDesk, TeamViewer and other remote management tools as abused for access. After the foothold, reporting describes AI-assisted triage of which files and accounts matter, lateral movement using native Windows features, Active Directory shadow credential abuse for persistence, and data staging and exfiltration over SFTP within hours of initial access. Hive Pro and search summaries of Zscaler's analysis also describe NTDS.dit, SAM and SYSTEM hive theft via a VSS shadow copy, SMB and Rclone to remote SFTP servers. Some victims are extorted on the threat of disclosure alone: the article describes a healthcare victim that paid $2 million with no encryption taking place. Zscaler's own report pages checked for this research did not repeat the Payouts King, shadow-credential or $2 million details, so those come from the GBHackers article.

The Payouts King payload uses stack-based string building, FNV1 hash-based Windows API resolution, a custom CRC scheme to obfuscate command-line arguments (-i identity key required, -mode all/local/share, -path, -percent, -note, -nopersist, -nohide, -noelevate, -backup, -log, -time), and direct system calls (manually resolved Zw* functions) to terminate processes matching 131 hard-coded AV/EDR process checksums. Persistence is via SYSTEM scheduled tasks named \Mozilla\UpdateTask and \Mozilla\ElevateTask that run at startup and are deleted after execution. Files are encrypted with a statically linked OpenSSL implementation using 4096-bit RSA and 256-bit AES in counter mode (ChaCha20 also referenced in the file format), with partial encryption of large files in 13 alternating blocks. Encrypted files receive the .ZWIAAW extension, and the ransom note readme_locker.txt is dropped only if -note is set. Anti-forensics include vssadmin delete shadows /all /quiet, recycle bin emptying and Windows event log clearing. Victims are directed to TOX and a Tor leak site.

Broader context from the Zscaler ThreatLabz 2026 Ransomware Report (press release dated 2026-09-30): ransomware data theft rose more than 275% year over year to 896.2 TB, 7,366 victims were listed on leak sites, blockchain ransomware payments totalled $328 million, the average payment was $431,995 (+5.3%), and manager-level or higher employees were 62% of victims. Per the article, more than 75% of victims worked in finance, sales, operations, HR or marketing. Generative AI is being used to accelerate scripting (JavaScript, PowerShell, Python) and tooling. No CVEs are involved; this is a social-engineering and trusted-tool abuse campaign.

## MITRE ATT&CK

- T1566.004 Spearphishing Voice
- T1566.003 Spearphishing via Service
- T1219 Remote Access Tools
- T1053.005 Scheduled Task
- T1098 Account Manipulation
- T1106 Native API
- T1059.003 Windows Command Shell
- T1027.007 Dynamic API Resolution
- T1685 Disable or Modify Tools
- T1685.005 Clear Windows Event Logs
- T1140 Deobfuscate/Decode Files or Information
- T1518.001 Security Software Discovery
- T1003.003 NTDS
- T1021.002 SMB/Windows Admin Shares
- T1048 Exfiltration Over Alternative Protocol
- T1490 Inhibit System Recovery
- T1657 Financial Theft

## Sources

- [Ransomware Gangs Use AI to Find and Steal the Most Sensitive Company Data Quickly](https://gbhackers.com/ai-powered-ransomware-2/)
- [Zscaler ThreatLabz: Payouts King - New Ransomware on the Rise](https://www.zscaler.com/blogs/security-research/payouts-king-new-ransomware-rise)
- [Zscaler Press Release: New Report Reveals AI-Assisted Attackers Move to Massive Data Theft and Executive Targeting](https://www.zscaler.com/press/new-zscaler-report-reveals-ai-assisted-attackers-move-massive-data-theft-executive-targeting)
- [Zscaler ThreatLabz 2026 Ransomware Report (landing page)](https://www.zscaler.com/campaign/threatlabz-ransomware-report)
- [Hive Pro Threat Advisory: Payouts King Ransomware - Blending In Before Breaking Through](https://hivepro.com/threat-advisory/payouts-king-ransomware-blending-in-before-breaking-through/)
- [Hive Pro Advisory TA2026104 (PDF)](https://hivepro.com/wp-content/uploads/2026/04/TA2026104.pdf)
- [Payouts King Takes Aim at the Ransomware Throne (Security Boulevard)](https://securityboulevard.com/2026/04/payouts-king-takes-aim-at-the-ransomware-throne/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3951