2 posts
Payouts King is a sophisticated ransomware family operated by former BlackBasta affiliates. It gains initial access via social engineering tactics like spam bombing and Quick Assist, then deploys ransomware that utilizes direct system calls, custom API hashing, and robust RSA/AES encryption while actively evading EDR detection.
Threat actor TeamPCP orchestrated a cascading supply chain attack by exploiting a misconfigured GitHub Actions workflow in Aqua Security's Trivy, harvesting credentials to compromise subsequent repositories including Checkmarx, LiteLLM, and Telnyx. The malicious packages deploy sophisticated, OS-specific remote access trojans (RATs) that utilize steganography, process hollowing, and ETW patching to evade detection while exfiltrating sensitive data.
