QEMU VMs – Payouts King leverages QEMU hidden VMs and reverse SSH tunnels to evade endpoint scanning, harvest credentials, and stage data before encryption.
Ransomware operators are getting more creative about one problem: how to run malicious code without being caught.
Misryoum reports that the Payouts King ransomware operation has been observed using QEMU—an open-source CPU emulator and virtualization tool—as part of a stealthy “inside-the-VM” execution path.. The goal isn’t just to virtualize payloads; it’s to create a blind spot for endpoint defenses that mainly inspect what’s happening on the host operating system.
QEMU as a reverse SSH backdoor
QEMU can run guest operating systems in a virtual machine while sharing the host’s hardware resources.. In this case. attackers use that setup to launch hidden virtual machines and then route access through covert network tunneling. including reverse SSH techniques.. Because many host-based security tools struggle to peer into the contents and runtime behavior of nested environments. the malware gains a practical advantage: it can execute tooling. store artifacts. and maintain remote access with less visibility.
Misryoum’s synthesis of the observed behavior shows why this tactic is so effective for attackers.. When security tooling can’t reliably scan inside a VM. attackers can treat the guest OS as a staging ground—one where credential dumping tools. data collection utilities. and remote tooling can operate with fewer chances of interception.. It also gives ransomware crews a way to blend their activity into normal system behavior: the host looks like it’s running a virtualization process. while the real work happens in a separate. less-monitored layer.
Hidden Alpine Linux tooling and credential theft
Researchers documented two campaigns where QEMU showed up as an operational component.. One campaign, tracked as STAC4713, has been linked to the Payouts King ransomware effort and was first seen in November 2025.. The other, STAC3725, emerged around February and targets Citrix NetScaler ADC and Gateway instances using the CitrixBleed 2 issue (CVE‑2025‑5777).
In the STAC4713 flow. Misryoum notes that the attackers create a scheduled task named “TPMProfiler” to launch a hidden QEMU VM running as SYSTEM.. The guest environment uses Alpine Linux 3.22.0 and includes attacker tools such as AdaptixC2, Chisel, BusyBox, and Rclone.. That toolset matters: it points to a workflow built for command-and-control flexibility (via tunneling) and for practical data movement (via file staging and exfiltration utilities).
Misryoum also highlights the operational pattern after initial access.. The campaign used exposed network services such as SonicWall VPNs in at least early observed activity. with later intrusions also involving exploitation of the SolarWinds Web Help Desk vulnerability (CVE‑2025‑26399).. After foothold and privilege escalation, the attackers used Windows built-in mechanisms to create shadow copies via VSS (vssuirun.exe).. From there. they leveraged SMB-based “print” behavior to copy sensitive registry hives (NTDS.dit. SAM. and SYSTEM) into temporary directories—classic preparation for offline credential extraction.
What makes the QEMU angle especially concerning is how it complements those steps.. Credential theft and recon workflows often rely on specialized tooling and repeatable execution.. If that tooling runs inside a VM that isn’t deeply inspected. defenders lose one of their key controls: visibility into what tools are being launched and how they’re used.
STAC3725 chains NetScaler access to VM-based staging
The STAC3725 campaign shows a different entry point but a similar “execution shelter” approach.. After compromising NetScaler devices. attackers deploy a ZIP archive that installs a service called “AppMgmt. ” creates a new local admin user (“CtxAppVCOMService”). and sets up ScreenConnect for persistence.. From there, a ScreenConnect client establishes a session with elevated privileges and later delivers a QEMU package.
Instead of relying on a prebuilt toolkit. Misryoum reports the attackers manually install and compile tools inside a hidden Alpine Linux VM using a custom disk image (custom.qcow2).. Observed tooling included Impacket. KrbRelayx. Coercer. BloodHound.py. NetExec. Kerbrute. and Metasploit—an unusually complete reconnaissance and credential workflow for a ransomware-associated campaign.. The activity includes credential harvesting, Kerberos username enumeration, Active Directory reconnaissance, and staging data for exfiltration via FTP servers.
For defenders, the practical takeaway is that QEMU isn’t just a side effect; it becomes an operational platform.. It supports a broader end-to-end playbook: initial access. privilege and persistence. credential extraction preparation. and then follow-on staging for exfiltration—before encryption and extortion.
Why this changes the defense conversation
If host security tools can’t see inside the guest environment. teams may need to rethink where they place their detection effort.. Misryoum’s reading of the described activity suggests defenders should treat “unexpected virtualization behavior” as a first-class signal.. That includes looking for unauthorized QEMU installations. suspicious scheduled tasks running with SYSTEM privileges. and evidence of unusual SSH port forwarding.
There’s also a network angle.. Reverse SSH tunnels and outbound SSH connections over non-standard ports can act like a lifeline for the VM.. That kind of traffic can be noisy in the wrong way. but it’s often distinctive enough to build detections around—especially when combined with host indicators like task creation and QEMU process lineage.
Just as importantly. this pattern shows how ransomware groups increasingly borrow from intrusion ecosystems associated with hypervisor targeting and advanced “encryptor” operations.. Misryoum interprets this as an evolution in tradecraft: attackers are not only stealing data and encrypting files. they’re optimizing their execution environment to reduce the odds of stopping mid-attack.
What organizations can watch for next
Misryoum recommends focusing on a short list of high-signal indicators tied directly to the observed campaigns: unauthorized QEMU installations; scheduled tasks that launch virtualization components under SYSTEM; QEMU-related disk artifacts (including disk images used to boot guests); and unusual SSH port forwarding or reverse SSH tunnels.. Teams should also consider how their monitoring coverage behaves when an organization is running nested or “hidden” virtualization—particularly if endpoint tools primarily focus on the host OS.
If Payouts King-style operations continue to mature. defenders will likely need tighter cross-layer visibility: endpoint telemetry (process and task creation). identity telemetry (abnormal credential harvesting sequences). and network telemetry (tunneling and non-standard egress patterns).. In other words. the battle won’t be won by endpoint scanning alone—it will be won by understanding how attackers structure time. tools. and visibility across both host and guest environments.
Making a Bronze Mirror in 2026: Can Modern Tools Beat the Old Craft?
Agent AI Won’t Work Without HR-Grade Governance
Train-to-Test scaling: optimize AI compute for cheaper inference