Payouts King Ransomware Encrypted File Extension .ZWIAAW or Ransom Note Creation

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•2

Detects Payouts King ransomware activity by identifying file rename events to the .ZWIAAW extension or the creation of the 'readme_locker.txt' ransom note on any disk path. The rule specifically accounts for file operations that might utilize techniques like SetFileInformationByHandle for evasion.