Payouts King/BlackBasta QEMU VM Disguise and SSH Tunneling

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects adversary activity associated with Payouts King and Black Basta affiliates utilizing QEMU for malicious activity. The rule monitors for the creation of virtual machine disk image files in non-standard directories, the execution of QEMU using disk images with misleading file extensions such as .db or .dll, and outbound SSH connections originating from the QEMU process to tunnel traffic through a guest VM.