Payouts King/BlackBasta QEMU Abuse for Covert VM and SSH Tunneling

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

This rule detects the execution of QEMU binaries from non-standard locations on Windows endpoints, or the use of port-forwarding command-line flags. Adversaries, including Payouts King and BlackBasta affiliates, leverage QEMU to establish hidden virtual machines for persistent access, credential theft, and to create covert reverse SSH tunnels to bypass network security controls.