Back News.Sophos

QEMU abused to evade detection and enable ransomware delivery

News.Sophos • April 16, 2026

The use of hidden virtual machines (VMs) enables long-term access, credential harvesting, data exfiltration, and PayoutsKing ransomware deployment Categories: Threat Research Tags: virtual machine, QEMU, PayoutsKing, GOLD ENCOUNTER, CitrixBleed2

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Hackers Exploit QEMU VMs to Evade Detection and Deploy Ransomware Hackers are utilizing QEMU, an open-source virtual machine emulator, to create hidden Linux environments within Windows systems, effectively evading endpoint security tools. This method allows for long-term access, credential theft, data exfiltration, and the deployment of ransomware, specifically the PayoutsKing variant. Sophos researchers have identified multiple threat actors, including STAC4713 and STAC3725, who are leveraging this technique to install a full suite of attack tools within the virtual machines. The attackers disguise the VM's disk image and use native Windows applications for reconnaissance and data access. This trend highlights a growing evasion strategy in cybercrime, with significant implications for enterprise security as malicious activities within VMs remain largely undetectable. The use of QEMU represents a critical shift in tactics among cybercriminals, emphasizing the need for enhanced detection capabilities. Current reports indicate active exploitation campaigns are ongoing. 7 sources 67

Extracted Entities

QEMU abused to evade detection and enable ransomware delivery

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

MITRE ATT&CK (2)

Platforms (1)

Ransomware Groups (1)

Vulnerabilities (1)