Loading story…
Threat actors are increasingly abusing QEMU to launch hidden virtual machines on compromised Windows hosts, allowing credential theft, reconnaissance, command-and-control, data staging, and ransomware preparation to occur outside the visibility of many endpoint security tools. Sophos linked one campaign, STAC4713, to GOLD ENCOUNTER and the PayoutsKing ransomware operation, where attackers gained access through exposed SonicWall VPNs without MFA and exploitation of SolarWinds Web Help Desk CVE-2025-26399, then created a SYSTEM-level scheduled task such as TPMProfiler to start qemu-system-x86_64.exe, boot a disguised Alpine Linux virtual disk, and establish reverse SSH tunnels for covert access. Researchers said the hidden VM hosted tooling including AdaptixC2, Chisel, Rclone, and wg-obfuscator, enabling stealthy persistence and exfiltration while leaving limited forensic evidence on the host.
A second campaign, STAC3725, exploited CitrixBleed2 CVE-2025-5777, installed a malicious ScreenConnect client, created a rogue local administrator account, and used a QEMU-based VM to assemble offensive tooling such as Impacket, BloodHound.py, Kerbrute, KrbRelayX, NetExec, and Metasploit for post-compromise operations. Reporting also noted broader initial-access methods, including phishing and fake Microsoft Teams IT-support lures, and warned that adversaries may shift between QEMU and other virtualization or sideloading techniques while keeping the same objective of stealthy intrusion and ransomware enablement. Defenders were urged to hunt for unauthorized QEMU installations, suspicious SYSTEM scheduled tasks, unusual SSH tunneling or port forwarding, disguised virtual disk images, and related indicators including the domain vtps.us, while prioritizing MFA and patching for CVE-2025-26399 and CVE-2025-5777.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
On April 22, 2026, Gurucul published a high-severity threat notice on QEMU abuse as a living-off-the-land technique. The notice included indicators of compromise such as the domain vtps.us, IP addresses, file hashes, and detection queries tied to the reported activity.
On April 16, 2026, Sophos published research describing a growing trend of threat actors abusing QEMU to run hidden virtual machines on compromised hosts. The report detailed the STAC4713 and STAC3725 campaigns, their tooling, access methods, and detection recommendations.
Sophos reported that the STAC3725 campaign was first seen in February 2026. The campaign used CitrixBleed2 (CVE-2025-5777) for initial access, deployed a malicious ScreenConnect client, and used a QEMU VM to build and run attacker tooling.
Sophos said the STAC4713 campaign was first observed in November 2025. The activity was linked to the PayoutsKing ransomware operation and involved using QEMU-based hidden virtual machines for stealthy post-compromise operations.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
community.gurucul.com
Open sourcescworld.com
Open sourcecybersecuritynews.com
Open sourcesecurityaffairs.com
Open sourcesophos.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Kaspersky reported an intrusion at a large enterprise in which attackers repurposed the open-source hypervisor **QEMU** as a stealthy tunneling tool to move traffic across segmented systems. The operators launched a minimal virtual machine with about **1 MB of RAM**, no disk image, and no graphical interface, then used QEMU to create virtual network interfaces and a socket-based network device that forwarded traffic from an internal host to attacker-controlled infrastructure. The tunnel linked a victim system without direct internet access to a pivot host that could reach the internet, and then on to a cloud server hosting a Kali Linux virtual machine. The activity stood out because defenders more commonly watch for tunneling utilities such as **FRP**, **ngrok**, and **Cloudflare Tunnel**, while QEMU can blend into legitimate virtualization activity and attract less scrutiny. In the same compromise, the attackers also used **Angry IP Scanner** for internal reconnaissance and **mimikatz** for credential theft, showing how legitimate administration and offensive tools were combined for lateral movement and persistence. The reporting highlights the need for layered detection across endpoints and networks, including monitoring for unusual QEMU execution, unexpected virtual interfaces, and traffic paths that bridge isolated network segments.
Jul 4, 2026
Researchers reported a phishing campaign dubbed **CRON#TRAP** that delivers ZIP archives containing a malicious `.lnk` file and a concealed QEMU package to Windows victims. When opened, the shortcut launches PowerShell to unpack hidden files, execute a renamed QEMU binary as `fontdiag.exe`, and boot a Tiny Core Linux virtual environment stored under `%HOME%\datax`. The lure also displays a fake server-error image to distract users while the emulated system starts, allowing the attackers to stage malware in a way that can evade traditional Windows-focused antivirus detection. Inside the QEMU guest, the attackers configured persistence and command-and-control by running `crondx`, a Go-based ELF binary assessed to be a customized **Chisel** client hard-coded to connect over WebSockets to `18.208.230[.]174`. The Linux environment included prebuilt SSH settings, modified scripts, and aliases such as `get-host-shell` and `get-host-user` to interact with the underlying Windows host, enabling covert access, tunneling, exfiltration, and delivery of additional payloads. Securonix said the activity was not confidently attributed, but telemetry pointed mainly to the US and Europe and highlighted the campaign as an unusual use of QEMU for malware staging beyond earlier cryptomining-related abuse.
Jun 29, 2026
Multiple early-2026 campaigns highlight increasingly **low-noise initial access** and **living-off-the-land** execution on Windows endpoints. CyStack reported activity attributed to **APT-Q-27 (GoldenEyeDog)** targeting financial institutions via a corporate support workflow: a user clicked a malicious link delivered through a **Zendesk ticket**, leading to download of an executable masquerading as an image/`.pif` file (aided by Windows’ hidden-extension defaults). The malware was signed with a **revoked certificate** that still appeared trusted due to a valid timestamp, and its modular backdoor/C2 infrastructure overlapped with prior APT-Q-27 activity, enabling stealthy persistence and control without triggering common endpoint alerts. Separately, Securonix described the **Dead#Vax** multistage campaign using phishing links to **VHD files hosted on IPFS**, where mounting/opening the VHD triggers **Windows Script Files**, obfuscated batch, and **PowerShell** loaders to support encrypted data theft and conceal execution logic, culminating in **AsyncRAT** deployment for credential theft, surveillance, and follow-on intrusion. In another targeted operation, Zscaler ThreatLabz linked **Operation Neusploit** to **APT28**, exploiting **CVE-2026-21509** (Microsoft Office/365 **OLE** bypass) via crafted **RTF** documents to drop payloads including **MiniDoor** (Outlook-focused collection and mailbox manipulation, including exfiltration to attacker-controlled email accounts) and **PixyNetLoader** (reported to use steganography). A separate “ThreatsDay” bulletin is a multi-story roundup and does not provide additional, specific corroboration on these same campaigns beyond mentioning adjacent themes (e.g., AsyncRAT/C2) in a broader news digest.
Jun 29, 2026