Hackers Exploit QEMU VMs to Evade Detection and Deploy Ransomware

• •Hackers are using QEMU to run hidden Linux VMs inside Windows, evading security tools.
• •The PayoutsKing ransomware is being deployed through these covert virtual machines.
• •Malicious activities within VMs are nearly invisible to traditional endpoint security solutions.

Hackers are utilizing QEMU, an open-source virtual machine emulator, to create hidden Linux environments within Windows systems, effectively evading endpoint security tools. This method allows for long-term access, credential theft, data exfiltration, and the deployment of ransomware, specifically the PayoutsKing variant. Sophos researchers have identified multiple threat actors, including STAC4713 and STAC3725, who are leveraging this technique to install a full suite of attack tools within the virtual machines. The attackers disguise the VM's disk image and use native Windows applications for reconnaissance and data access. This trend highlights a growing evasion strategy in cybercrime, with significant implications for enterprise security as malicious activities within VMs remain largely undetectable. The use of QEMU represents a critical shift in tactics among cybercriminals, emphasizing the need for enhanced detection capabilities. Current reports indicate active exploitation campaigns are ongoing.