Attackers Abuse QEMU Hidden VMs to Evade Detection and Stage Ransomware

Threat actors are increasingly abusing QEMU to launch hidden virtual machines on compromised Windows hosts, allowing credential theft, reconnaissance, command-and-control, data staging, and ransomware preparation to occur outside the visibility of many endpoint security tools. Sophos linked one campaign, STAC4713, to GOLD ENCOUNTER and the PayoutsKing ransomware operation, where attackers gained access through exposed SonicWall VPNs without MFA and exploitation of SolarWinds Web Help Desk CVE-2025-26399, then created a SYSTEM-level scheduled task such as TPMProfiler to start qemu-system-x86_64.exe, boot a disguised Alpine Linux virtual disk, and establish reverse SSH tunnels for covert access. Researchers said the hidden VM hosted tooling including AdaptixC2, Chisel, Rclone, and wg-obfuscator, enabling stealthy persistence and exfiltration while leaving limited forensic evidence on the host.

A second campaign, STAC3725, exploited CitrixBleed2 CVE-2025-5777, installed a malicious ScreenConnect client, created a rogue local administrator account, and used a QEMU-based VM to assemble offensive tooling such as Impacket, BloodHound.py, Kerbrute, KrbRelayX, NetExec, and Metasploit for post-compromise operations. Reporting also noted broader initial-access methods, including phishing and fake Microsoft Teams IT-support lures, and warned that adversaries may shift between QEMU and other virtualization or sideloading techniques while keeping the same objective of stealthy intrusion and ransomware enablement. Defenders were urged to hunt for unauthorized QEMU installations, suspicious SYSTEM scheduled tasks, unusual SSH tunneling or port forwarding, disguised virtual disk images, and related indicators including the domain vtps.us, while prioritizing MFA and patching for CVE-2025-26399 and CVE-2025-5777.