The Invisible Guest: How QEMU Became a Ransomware Delivery Vehicle- 179

June 10, 2026

Ransomware operators have found a hiding place inside one of the most ordinary tools in the enterprise software stack. QEMU, the open-source machine emulator that IT teams deploy without a second thought, is now being used to run covert virtual machines inside compromised networks — creating a communication channel and payload delivery environment that standard endpoint security tools cannot see into, because they were never designed to look there.

QEMU is an open-source machine emulator that allows users to run a guest operating system on top of their existing one. It is a legitimate, widely used virtualization tool with obvious enterprise applications. It is also, as Sophos documented in spring 2026, increasingly being abused by ransomware operators to establish covert communication channels and deliver payloads inside a layer of virtualization that standard endpoint security tools are not designed to inspect.

Sophos observed two distinct campaigns using this technique. The first, tracked as STAC4713 and linked to the Gold Encounter group operating the PayoutsKing ransomware, began with initial access through exposed SonicWall VPN appliances lacking MFA, later switching to exploitation of CVE-2025-26399, a remote code execution vulnerability in SolarWinds Web Help Desk. Once inside, the attackers created a scheduled task running with System privileges to launch a QEMU virtual machine. The virtual hard disk image on that VM established a reverse SSH tunnel, providing the operators with direct access to the guest VM — a covert communication channel running inside a legitimate virtualization process that blends into enterprise environments where QEMU is already present or plausibly expected. From that position, the attackers created volume shadow copy snapshots, copied the Active Directory database and SAM/SYSTEM registry hives to temporary folders, and performed network share discovery using native Windows tools. The follow-on activity varied across intrusions, consistent with Sophos's assessment that initial access brokers had compromised the victims and sold the access to different downstream operators.

The second campaign, STAC3725, observed in February 2026, used exploitation of CVE-2025-5777 — CitrixBleed2 — for initial access and a malicious ScreenConnect client for persistence. Following the NetScaler exploitation, the attackers installed a remote access tool to retrieve QEMU and a virtual disk image, then manually executed the attack within the VM. The campaign deployed roughly a dozen tools and libraries, harvested credentials, enumerated Kerberos usernames, performed Active Directory reconnaissance, staged payloads, and exfiltrated data.

The common thread is the use of virtualization as an evasion layer. Endpoint detection tools are built to monitor processes, file system activity, network connections, and API calls on the host operating system. A QEMU guest running inside a scheduled task with System privileges creates a contained environment whose internal activity is opaque to host-level monitoring. The SSH tunnel established from within the guest appears from the outside as an outbound connection from a legitimate process. The technique does not require novel malware or sophisticated exploitation — it requires QEMU and a virtual disk image, both of which can be delivered after any conventional initial access technique. Organizations are advised to monitor for unauthorized QEMU installations, rogue scheduled tasks with System privileges, unusual port forwarding rules, and suspicious outbound SSH tunneling from virtualization processes.