PayoutsKING is a profit-driven ransomware group that emerged in April 2025, linked to former affiliates of the BlackBasta operation which disbanded in February 2025. This group is known for its sophisticated evasion techniques, including obfuscation, the use of direct system calls to bypass endpoint detection and response (EDR) solutions, and a unique method of hiding malicious activity inside a QEMU virtual machine to avoid detection. PayoutsKING primarily employs double extortion tactics, involving data theft before encryption and subsequently posting victim data on dark web leak sites to pressure payments. While some reports indicate the group claims not to operate as a Ransomware-as-a-Service (RaaS) and performs attacks directly, evidence suggests a continuation of the BlackBasta affiliate playbook, with former BlackBasta affiliates aligning with PayoutsKING to carry out campaigns.

This profile is generated from the same canonical actor-card record used by the Threat Actor Cards directory, so aliases, targeting fields, activity notes, and source links stay aligned as the database is enriched.