GOLD ENCOUNTER QEMU TPMProfiler Scheduled Task Persistence

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects the creation of scheduled tasks using schtasks.exe that reference specific QEMU binaries, the 'TPMProfiler' task name, or suspicious disk image file extensions (vault.db, bisrv.dll, custom.qcow2). This activity is associated with GOLD ENCOUNTER, STAC4713, and STAC3725, who use QEMU-based virtual environments for defense evasion and persistence.