Payouts King Ransomware Bypasses EDR via Obfuscation and Direct Syscalls

Payouts King ransomware has emerged as a notable post-BlackBasta threat, leveraging advanced obfuscation and direct system calls to evade endpoint detection and response (EDR) solutions.

Threat activity observed in early 2026 shows strong overlaps with historical BlackBasta tradecraft, particularly the use of spam bombing combined with phishing and vishing.

In these campaigns, attackers overwhelm victims with spam emails before impersonating IT personnel via Microsoft Teams calls.

Victims are then convinced to launch Quick Assist, enabling remote access that attackers exploit to deploy ransomware payloads and establish persistence داخل enterprise environments.

Payouts King, first observed in April 2025, operates as a data-theft-driven ransomware group that selectively encrypts files to maximize impact while reducing detection risk.

The malware employs a hybrid encryption model using 4,096-bit RSA and AES-256 in CTR mode, with OpenSSL statically linked into the binary.

Each targeted file is encrypted using a unique key and nonce, with encrypted data appended alongside RSA-protected metadata containing encryption parameters.

A defining characteristic of Payouts King is its heavy use of obfuscation to bypass static and behavioral defenses. The malware constructs strings dynamically on the stack, resolves Windows API calls via hashing, and avoids hardcoded values.

According to recent findings from Zscaler ThreatLabz, the group is likely operated by former BlackBasta affiliates who have continued ransomware operations following the cartel’s collapse in February 2025 after internal chat leaks exposed its infrastructure and workflows.

It combines FNV1 hashing with a custom CRC-based algorithm, where even hash seeds vary per string. This approach significantly complicates reverse engineering and defeats precomputed hash-based detection mechanisms commonly used by analysts.

Payouts King Ransomware Bypasses EDR

The ransomware also obfuscates its command-line arguments using CRC checksums. Notably, execution of file encryption requires a valid “-i” parameter whose checksum matches an expected value, likely serving as an anti-sandbox control. Without this, the malware remains dormant, reducing exposure during automated analysis.

Function Name	CRC Checksum
ZwQueryInformationFile	0x806e69a7
ZwQueryInformationProcess	0x1993a634
ZwOpenProcess	0x58ad11ee
ZwTerminateProcess	0x469424d5
ZwOpenFile	0x28a29ebf
ZwQuerySystemInformation	0xa0595508

Persistence and privilege escalation are achieved through scheduled tasks created via indirect command execution. Instead of directly invoking system utilities, Payouts King spawns cmd.exe with redirected input/output pipes and programmatically issues schtasks commands.

After elevating privileges to SYSTEM, it deletes traces of the scheduled tasks to hinder forensic investigation, then terminates the original process to continue execution in a higher-privileged context.

To further evade detection, Payouts King avoids traditional API calls when terminating security tools. Instead, it dynamically resolves Zw* functions from ntdll by parsing the export table at runtime.

System call numbers are derived from sorted function addresses, and CRC checks are used to match target APIs such as ZwTerminateProcess.

This direct syscall technique bypasses user-mode hooks commonly deployed by EDR solutions, allowing the ransomware to terminate antivirus and monitoring processes stealthily.

File encryption behavior is optimized for speed and impact. Files under 10 MB are fully encrypted, while larger files are partially encrypted in segmented blocks, typically encrypting half of each block.

This strategy accelerates encryption across large datasets while maintaining file unusability. The ransomware also skips critical system directories and file types to avoid destabilizing the system before ransom execution.

Additional anti-forensic actions include deletion of shadow copies using vssadmin, clearing event logs via EvtClearLog, and emptying the recycle bin.

Interestingly, the ransom note is only dropped if explicitly triggered via a command-line parameter, suggesting flexible deployment configurations depending on the attack scenario.

Zscaler detects this threat under signatures such as Win64.Ransom.PayoutsKing, highlighting its growing presence in enterprise environments.

The continued evolution of Payouts King underscores how former ransomware operators rapidly regroup and adapt, reusing proven access techniques while integrating more advanced evasion mechanisms.

This campaign reinforces the need for layered defenses, including monitoring abuse of legitimate remote tools, enforcing strong authentication controls, and deploying behavioral detection capable of identifying low-level syscall abuse and anomalous process activity.

Indicators Of Compromise (IOCs)

Indicator	Description
335ad12a950f885073acdfebb250c93fb28ca3f374bbba5189986d9234dcbff4	Payouts King ransomware sample SHA256
d68ce82e82801cd487f9cd2d24f7b30e353cafd0704dcdf0bb8f12822d4227c2	Payouts King ransomware sample SHA256

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.