Loading malware…
QEMU is an open-source machine emulator and virtualization tool that attackers have abused as part of intrusion activity to run hidden virtual machines on compromised systems. In the reported campaigns, adversaries used QEMU to execute malicious tooling inside isolated guest environments that were largely invisible to host-based endpoint defenses, enabling stealthy post-compromise operations with minimal evidence on the host.
Sophos documented two campaigns using this technique. In STAC4713, linked to the Payouts King ransomware operation and associated with the GOLD ENCOUNTER threat group, attackers created a scheduled task named TPMProfiler to launch a hidden QEMU virtual machine as SYSTEM. The VM used disguised virtual disk images masquerading as database files and later DLL files, ran Alpine Linux 3.22.0, and contained tools including AdaptixC2, Chisel, BusyBox, and Rclone. The attackers established reverse SSH tunnels and port forwarding for covert remote access, collected domain credentials, used built-in Windows utilities for file access and network discovery, created shadow copies via vssuirun.exe, copied NTDS.dit, SAM, and SYSTEM hives over SMB, and exfiltrated data with Rclone to a remote SFTP location. Initial access observed in this campaign included exposed SonicWall VPNs without MFA, exploitation of SolarWinds Web Help Desk CVE-2025-26399, exposed Cisco SSL VPNs, and Microsoft Teams social engineering that abused Quick Assist. Sophos linked this activity to Payouts King, which appears to target hypervisors and deploy tooling across VMware and ESXi systems; Zscaler assessed Payouts King is likely tied to former BlackBasta affiliates.
In STAC3725, attackers exploited CitrixBleed2 / CVE-2025-5777 against NetScaler ADC and Gateway devices, then installed remote access software including ScreenConnect and deployed QEMU to launch a hidden Alpine Linux VM from a custom.qcow2 disk image. The intrusion also involved a malicious executable that installed a service named AppMgmt and created a local administrator account named CtxAppVCOMService. Inside the VM, the attackers manually installed and compiled post-exploitation tools including Impacket, KrbRelayx, Coercer, BloodHound.py, NetExec, Kerbrute, and Metasploit. Observed activity included credential harvesting, Kerberos username enumeration, Active Directory reconnaissance, and staging data for exfiltration via FTP servers.
Across both campaigns, QEMU was used as an evasion mechanism to bypass endpoint security, facilitate covert persistence and remote access, and support credential theft, reconnaissance, data staging, and exfiltration. High-confidence indicators and behaviors mentioned in the reporting include unauthorized QEMU instances, the TPMProfiler scheduled task, disguised VM disk images, reverse SSH tunnels, unusual SSH port forwarding, outbound SSH tunnels on non-standard ports, the AppMgmt service, the CtxAppVCOMService account, and custom.qcow2 VM disk usage.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
The Payouts King ransomware operation is leveraging the QEMU emulator to create hidden virtual machines and establish reverse SSH backdoors on compromised systems, allowing them to bypass endpoint security measures.
15 distinct techniques documented for this family, organized by ATT&CK tactic.
Organizations should implement robust monitoring for unauthorized QEMU instances, suspicious scheduled tasks, and unusual SSH activity.
SCHTASKS /CREATE /V1 /RU SYSTEM /SC ONSTART /F /TN "TPMProfiler" /TR "C:\Users\<user>\tmp\qemu-system-x86_64.exe ..."
The batch file start.bat accomplishes two tasks... Second, the script executes the QEMU process and command line to start the emulated Linux environment.
and the execution of a QEMU instance to run a virtual hard disk image containing attacker tooling.
Organizations should implement robust monitoring for unauthorized QEMU instances, suspicious scheduled tasks, and unusual SSH activity.
SCHTASKS /CREATE /V1 /RU SYSTEM /SC ONSTART /F /TN "TPMProfiler" /TR "C:\Users\<user>\tmp\qemu-system-x86_64.exe ..."
Organizations should implement robust monitoring for unauthorized QEMU instances, suspicious scheduled tasks, and unusual SSH activity.
SCHTASKS /CREATE /V1 /RU SYSTEM /SC ONSTART /F /TN "TPMProfiler" /TR "C:\Users\<user>\tmp\qemu-system-x86_64.exe ..."
The process qemu.exe was renamed to fontdiag.exe by the attacker prior to delivery of the phishing lure.
MITRE ATT&CK Matrix ... Defense Evasion ... T1218: System Binary Proxy Execution
Researchers assess with high confidence that the PayoutsKing group is leveraging the legitimate QEMU emulator to deploy hidden, Alpine Linux-based virtual machines on compromised hosts. Because security solutions often lack visibility inside virtualized environments, the threat actors use this technique to evade detection.
attackers deploy a custom-made emulated QEMU Linux box to persist on endpoints... The use of the “-nographic” parameter means that the Linux virtual environment will run silently in the background.
Sophos analysts are actively investigating the abuse of QEMU by threat actors who are running hidden VMs to conceal their operations, harvest domain credentials...
Researchers assess with high confidence that the PayoutsKing group is leveraging the legitimate QEMU emulator to deploy hidden, Alpine Linux-based virtual machines on compromised hosts. Because security solutions often lack visibility inside virtualized environments, the threat actors use this technique to evade detection.
The Payouts King ransomware operation is leveraging the QEMU emulator to create hidden virtual machines and establish reverse SSH backdoors on compromised systems...
...subsequently deploying a QEMU VM with manually installed tools for reconnaissance and data staging.
Once the scheduled task runs, it also sets up port forwarding from custom ports (32567 and 22022) to port 22 for SSH access.
Once launched, the virtual machine established reverse SSH tunnels that created covert remote access channels, allowing attackers to run tools and collect domain credentials without exposing activity to traditional security tools.
PowerShell downloads rclone from downloads.rclone[.]org via WindowsPowerShell/5.1 UA; placed in C:\ProgramData\Rclone\
QEMU was then used to establish an SSH connection, facilitating continued access to the compromised system.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.