Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Endpoint Security Bypass. Show all posts
Virtual Machine Evasion
Active Directory Attacks Cyber Threat Intelligence Cyber Threats Endpoint Security Bypass Hypervisor Security QEMU Exploits Ransomware Attacks Sophos Report Virtual Machine Evasion

Ransomware Campaign Leverages QEMU to Slip Past Enterprise Defences


 

In an effort to circumvent traditional security controls, hackers are increasingly relying on virtualisation as a covert execution layer, embedding malicious operations within QEMU environments. As observed in observed incidents, adversaries deployed concealed virtual machines in which tooling and command execution occurred largely beyond the detection range of endpoint detection systems, leaving minimal forensic artifacts on the operating system. 

In most cases, these environments are introduced as virtual disk images disguised under atypical file extensions such as .db or .dll and triggered by scheduled tasks with SYSTEM level privileges to create a parallel runtime that blends with legitimate processes.

According to analysts at Sophos, such techniques take advantage of the trust associated with widely used virtualization software. This pattern extends to platforms such as Microsoft Hyper-V, Oracle VM VirtualBox, and VMware, among others. These tactics reflect a broader strategic shift in which legitimate infrastructure is used to create isolated, low-noise environments that allow ransomware deployment while retaining effective anonymity to host-based defenses. Based on this pattern, researchers at Sophos have highlighted that QEMU misuse is not a recent development, but its resurgence in recent operations signals a renewed tactical emphasis on the use of QEMU. 

In late 2025, analysts have identified two separate ransomware campaigns, STAC4713 and STAC3725, which use virtualised environments to avoid detection, and STAC4713 is specifically associated with the financial-motivated PayoutsKing cluster of ransomware activities. 

An attacker established persistence for this campaign by creating a scheduled task, “TPMProfiler,” which executed a concealed virtual machine with SYSTEM-level privileges. A disk image deployment was implemented in which benign assets were deliberately disguised as benign assets, initially appearing as database files, but later taking on the appearance of dynamic link libraries in order to blend seamlessly into routine system artifacts. 

Once active, the virtual instance initiated reverse SSH tunneling mechanisms and port-forwarding mechanisms, forming covert communication channels that enabled sustained remote access while remaining outside the scope of conventional monitoring tools. 

During this isolated Alpine Linux environment, adversaries employed a compact toolkit that enabled tunneling, obfuscation, and data exfiltration, facilitating credential harvesting, the extraction of Active Directory databases, as well as the lateral exploration of network shares, all by utilizing legitimate system utilities. 

By integrating trusted binaries and hidden virtual infrastructure, this intentional convergence highlights a refined intrusion model where malicious activity is woven into normal system behavior, increasing the difficulty of detecting and responding to intrusions. 

A further investigation of STAC4713 has revealed its origin dates are November 2025, when it has been associated with the GOLD ENCOUNTER threat group and directly associated with PayoutsKing ransomware, a ransomware operation that differs from the conventional ransomware-as-a-service environment by executing intrusions without the assistance of affiliates. 

After emergence in mid-2025, the group has demonstrated a focus on hypervisor-centric environments, developing customized encryption tools for platforms such as VMware and VMware ESXi, signaling a deliberate shift towards infrastructure-level disruption. 

Additionally, a second campaign, STAC3725, appeared in February 2026. This campaign accessed the system via the CVE-2025-5777 exploit chain before deploying a malicious instance of ConnectWise ScreenConnect to secure persistence. Using this foothold, attackers orchestrated credential harvesting against Active Directory environments using a concealed QEMU virtual machine. 

The intrusion sequence in STAC4713 is well-planned, beginning with the creation of the “TPMProfiler” scheduled task which executes qemu-system-x86_64.exe with SYSTEM privileges. As a result, the boot-up of a virtual hard drive image disguised as benign files  initially "vault.db" and later renamed "bisrv.dll" -- was used to evade scrutiny.

In addition to this obfuscation, network manipulation techniques are employed, including port forwarding from non-standard ports such as 32567 and 22022 to SSH port 22, while reverse tunnels involving AdaptixC2 or OpenSSH are used to maintain persistent and covert connectivity to attacker-controlled networks. Embedded virtual machines operate on Alpine Linux 3.22.0 images preconfigured to offer a compact but robust toolkit that enables the rapid transfer of data and execution of commands. 

The toolkit includes Linker2, AdaptixC2, WireGuard's WireGuard Obfuscation Layer (wg-obfuscator), BusyBox, Chisel, and Rclone. In contrast, STAC3725 utilizes a more adaptive approach, compiling its toolset within a virtual environment in situ, including frameworks such as Impacket, KrbRelayX, Coercer, BloodHound.py, NetExec, Kerbrute, and Metasploit, as well as Python, Rust, Ruby, and C dependencies. 

Post-compromise activities include credential extraction, Kerberos user enumeration via Kerbrute, Active Directory reconnaissance via BloodHound, and payload staging over FTP channels, demonstrating a methodical and deeply embedded attack model in which virtualization serves not only as a concealment mechanism, but also as a platform for sustained intrusion. 

In sum, STAC4713 and STAC3725's activity indicate a calculated evolution in adversary tradecraft where virtualisation is no longer just a peripheral tactic for evasion but rather a critical component of adversary operations. A malicious workflow may be embedded within QEMU instances and aligned with trusted system processes, thus decoupling attackers' activities from the host environment. 

As a result, conventional endpoint controls will be unable to detect the attacker's activities while maintaining persistent, low-noise access. By employing disguised storage artifacts, executing tasks at the SYSTEM level, and utilizing encrypted communication channels, a disciplined approach to stealth is demonstrated, while the integration of credential harvesting, Active Directory reconnaissance, and lateral movement capabilities highlights the end-to-end nature of the intrusion. 

Sophos has observed that the resurgence of such campaigns indicates a broader industry challenge, in which legitimate infrastructure and administrative tools are increasingly repurposed to undermine defensive assumptions. 

Virtualised attack frameworks, with their convergence of concealment, persistence, and operational depth, provide a formidable vector for modern ransomware operations, requiring an extension of detection strategies beyond the host to virtual layers where adversaries are actively exploiting these vulnerabilities.
Read more »
QEMU Virtualisation Abuse
Advanced Persistent Threats CitrixBleed Vulnerability Credential Harvesting Attacks Cyber Threat Intelligence Endpoint Security Bypass malware Payouts King Ransomware QEMU Virtualisation Abuse

Security Researchers Uncover QEMU-Powered Evasion in Payouts King Ransomware


 

Several recent incidents of ransomware activity attributed to the Payouts King operation have highlighted a systematic shift toward virtualization-assisted intrusions, with attackers embedding QEMU as an execution layer within compromised systems. 

QEMU instances can be configured as reverse SSH backdoors, enabling operators to create concealed virtual machines, which operate independently of a host system, effectively running malicious payloads and maintaining persistence outside the visibility of conventional endpoint security measures. 

In the course of the investigation, it has been revealed that at least two parallel campaigns have been identified, one directly connected with Payouts King and the other as a result of the exploitation of CitrixBleed 2 flaw. Both of the campaigns are leveraging the power of virtualization, not only for the purpose of evasion, but also for the purpose of staging post-exploitation campaigns. 

As part of their intrusion into these isolated environments, attackers use tools such as Rclone, Chisel, and BusyBox to obtain credential information, investigate Active Directory, enumerate Kerberos, and stage data via temporary FTP servers. 

In addition to this evolution, a broader operational trend is being observed in which ransomware actors, including suspected initial access brokers, are moving from traditional encrypt-and-extort models to layered intrusion strategies that emphasize stealth, extended access, and pre-encryption intelligence gathering, which reduces detection windows and challenges reliance on only file-based security indicators. 

In essence, QEMU is an open-source emulator and virtualizing framework that enables the running of full operating systems as virtual machines on a host, a capability that is increasingly being exploited by cyber criminals for malicious purposes. Due to the fact that host-based security controls do not provide visibility into processes executed within these isolated environments, attackers can leverage QEMU instances in order to deploy payloads, store tooling, and set up covert remote access channels using SSH without causing any disruption. 

There is precedent for using this technique, as it has been used in previous operations linked to the 3AM ransomware group, the LoudMiner campaign, and the CRON#TRAP activity cluster. The analysis conducted by Sophos in recent months provides an in-depth understanding of its operationalization across two distinct intrusion sets, including the Payouts King ransomware. This was observed since November 2025 and has been attributed to the Payouts King ransomware operation. 

It overlaps with activity associated with GOLD ENCOUNTER, which is known to target hypervisors and deploy encryptors within VMware and ESXi environments. Attackers create a scheduled task called TPMProfiler in this campaign that initiates a hidden QEMU virtual machine with SYSTEM privileges by using virtual disk images disguised as benign databases and DLLs as virtual disk images. 

Through carefully configured port forwarding, the adversary maintains isolation within the virtual layer while enabling reverse SSH access into the compromised host. Alpine Linux 3.22.0 is typically deployed in this environment, preloaded with offensive tools such as AdaptixC2, Chisel, BusyBox, and Rclone that facilitate communication, reconnaissance, and data movement between the various components of the system. This parallel campaign, identified in February as STAC3725, exploits CitrixBleed 2 (CVE20255777) flaw in NetScaler ADC and Gateway appliances in an attempt to gain initial access. 

Once credentials have been harvested and domain-level reconnaissance has been conducted, QEMU-based virtual environments can be employed to perform similar functions, strengthening virtualization’s role as a stealth-oriented, persistent attack substrate. 

An attacker initiates post-compromise activity by delivering a staged archive (an.zip) into systems breached through NetScaler as part of the STAC3725 intrusion chain. In this case, the embedded executable (an.exe) provisioned an AppMgmt service, created a privileged local account (CtxAppVCOMService), and established a persistent remote access channel through ScreenConnect's MSI package client application.

In the context of SYSTEM privileges, ScreenConnect establishes a connection to the relay infrastructure and orchestrates the delivery of a secondary archive containing the concealed QEMU environment. When unpacked with 7-Zip and executed by qemu-system-x86_64.exe, the Alpine Linux virtual machine can be booted from a custom disk image using the qcow2 driver. 

A separate layer of isolation allows adversaries to deliberately build their attack frameworks in situ instead of relying on pre-configured toolsets, including Impacket, KrbRelayx, Coercer, BloodHound.py, NetExec, Kerbrute, and Metasploit, as well as multi-language dependencies spanning Python, Rust, Ruby, and C++, within which they compile tools. 

A modular approach to postexploitation provides a variety of post-exploitation activities, including credential harvesting, Kerberos enumeration, Active Directory mapping, and data staging by using lightweight FTP services. As a result of these auxiliary actions, host-level manipulation continues, including enabling WDigest credential storage, installing forensic utilities to alter Microsoft Defender exclusions, executing reconnaissance commands, and loading vulnerable kernel drivers to weaken system defenses. 

Following-on activity varies from incident to incident, which further suggests a division of labor consistent with initial access broker ecosystems. Persistence mechanisms include enterprise deployment tools and peer-to-peer networking frameworks such as NetBird, along with attempts to extract browser session information and disable endpoint protection via scripting. 

Together, these operations reinforce the increasing use of virtualization-supported evasion, where malicious activity is effectively dispersed into transient, attacker-controlled environments that can be hidden from traditional monitoring techniques. 

In accordance with defensive guidance, it is imperative that anomalous QEMU deployments, unauthorized privilege-level scheduled tasks, irregular SSH tunneling behavior, and atypical virtual disk artifacts be detected, especially since Zscaler's intelligence indicates that this ransomware cluster is associated with tactics historically associated with BlackBasta affiliates, such as phishing via Microsoft Teams and the abuse of remote assistance tools. 

All in all, these findings indicate an increased level of operational maturity among the Payouts King ecosystem, which integrates stealth infrastructure, flexible access vectors, and virtualization-based execution into a cohesive attack model that extends far beyond conventional ransomware techniques. 

A Zscaler attribution report also confirms this trajectory, pointing to overlapping tradecraft such as spam-driven intrusion attempts, social engineering deployments via Microsoft Teams, and abuse of remote access utilities by former BlackBasta affiliates. 

It is important to note that the ransomware itself reflects this sophistication, consisting of high levels of obfuscation, anti-analysis safeguards, and persistence mechanisms embedded in scheduled tasks so as to actively terminate security processes through low-level system calls. Its encryption protocol, which uses AES-256 in CTR mode combined with RSA-4096 intermittent encryption for large files, demonstrates a calculated balance between speed and impact. 

As a result, extortion workflows direct victims to leak portals on the dark web. Due to increasing virtualization abuse blurring traditional endpoint visibility boundaries, defenders must shift their focus toward behavioral correlation, privilege anomaly detection, and deep examinations of orchestration patterns at the system level, as these campaigns reflect a broader shift towards ransomware operations that are designed to remain persistent, precise, and invisibly invisible within organizations.
Read more »
Subscribe to: Posts (Atom)