GOLD ENCOUNTER Scheduled Task Referencing QEMU Binary or VM Image

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

Detects the creation of scheduled tasks that involve QEMU virtualization binaries or virtual disk images. This activity is associated with the GOLD ENCOUNTER threat group and campaigns STAC4713/STAC3725, which utilize QEMU to facilitate persistence and infrastructure defense evasion by maintaining virtualized environments across system reboots.