QEMU Abuse for Defense Evasion and Ransomware

Sophos analysts have identified an increasing trend of threat actors, notably the GOLD ENCOUNTER group and campaigns STAC4713 and STAC3725, abusing the open-source QEMU emulator for defense evasion. By running malicious payloads within a virtual machine (VM), attackers effectively bypass host-based endpoint security controls, as the VM activity remains invisible to the host operating system. This technique has been leveraged to deliver PayoutsKing and 3AM ransomware.

The attack chain typically involves establishing initial access via vulnerabilities like CVE-2025-26399 (SolarWinds) or CVE-2025-5777 (Citrix), followed by the deployment of a QEMU VM. These VMs host Linux-based toolkits (Alpine Linux) containing backdoors like AdaptixC2, QDoor, or various offensive security tools. The actors use these hidden environments for credential harvesting, lateral movement, and data exfiltration while maintaining a persistent, covert presence.

This trend represents a significant shift in adversary tradecraft aimed at neutralizing EDR/XDR effectiveness. Organizations face increased risk of long-term residence and high-impact ransomware incidents if virtualization software is not strictly monitored and governed within their environments.