John Z Black

Payouts King Ransomware Built Their Own Room Inside Your Machine

John Z Black Apr 21, 2026

Ransomware & Cybercrime #ransomware #qemu #living-off-the-land #edr-evasion #payouts-king #reverse-ssh

The Payouts King ransomware group is running TinyCore Linux VMs inside QEMU on compromised Windows hosts, creating an EDR-invisible enclave for C2 and pre-encryption operations. Here's how it works and what to hunt for.

Read More

Attacker Scale in 2026: Botnets, EDR Killers, and Phishing-as-Operations

John Z Black Mar 20, 2026

Threat Intelligence #byovd #edr-evasion #phishing #botnets #threat-operations #malware-economics

From BYOVD-based EDR suppression to tax-season phishing pipelines and botnet disruption, attacker scale now comes from operational integration, not one breakthrough trick.

Read More