QEMU Virtualization Abuse for PayoutsKing Ransomware Delivery & Evasion

QEMU Virtualization Abuse for PayoutsKing Ransomware (TL-2026-0379), also tracked as PayoutsKing QEMU Campaign, is a high-severity malware campaign, first published 2026-04-16. It is attributed to PayoutsKing (Russia) with medium confidence, affects Microsoft Windows 10 / 11 / Server, maps to 36 MITRE ATT&CK techniques (T1003.001, T1003.003, T1005), and is covered by 9 detection rules and 30 indicators of compromise.

Key facts for TL-2026-0379

Threat ID
TL-2026-0379
Also known as
PayoutsKing QEMU Campaign, Operation Tapworm, paykng-qemu
Severity
HIGH
Status
ACTIVE
Category
MALWARE
First published
2026-04-16
Last reviewed
2026-04-16
Attribution
PayoutsKing
Attribution confidence
MEDIUM
Nation-state nexus
Russia
Motivation
FINANCIAL
Target sectors
manufacturing, healthcare, financial, legal, technology, government, education
Target regions
North America, Europe, Australia
Detection rules
9
Indicators of compromise
30

Malware and tooling in QEMU Virtualization Abuse for PayoutsKing Ransomware

Malware and tooling: paykng, payoutsking, Cobalt Strike, Mimikatz, Rclone - S1040, Rubeus - S1071, Sliver - S0633, impacket-secretsdump, qemu-system-x86_64

PayoutsKing, a BlackBasta-successor ransomware operation, deploys hidden QEMU virtual machines on compromised Windows endpoints to execute payloads, harvest credentials, and stage data exfiltration from inside an ephemeral Linux guest — rendering host-level EDR, AV, and file-integrity telemetry effectively blind. Sophos X-Ops confirmed active intrusions in Q1 2026 in which operators sideloaded a portable QEMU distribution, bridged the guest to the host network with a tap adapter, and ran ransomware encryption routines entirely from inside the VM against mounted host shares.

How QEMU Virtualization Abuse for PayoutsKing Ransomware works

Between January and April 2026, Sophos X-Ops documented a cluster of intrusions in which the PayoutsKing ransomware crew — the reconstituted BlackBasta affiliate set tracked since the 2024 Storm-1811 / Black Basta collapse — weaponized the open-source QEMU emulator as a living-off-the-land (LotL) execution environment. The novelty of the technique is that almost no malicious activity touches the host Windows process tree: only qemu-system-x86_64.exe, its signed helper binaries, and a user-mode network tap adapter appear on the endpoint. Everything else — credential theft, lateral movement staging, double-extortion exfiltration, and AES-256 encryption of host-mounted shares — happens inside a lightweight TinyCore or Alpine Linux guest that the operators ship pre-baked as a QCOW2 image.

The kill chain observed by Sophos begins with either (a) phishing-delivered DLL side-loading through a trojanized OneDriveStandaloneUpdater.exe variant, or (b) exploitation of an unpatched ScreenConnect relay (consistent with TL-2026-0342). After an initial Cobalt Strike or Sliver beacon lands on the host, the operator unpacks a 250-450 MB staging archive — typically disguised as "OneDriveBackup.zip" in %ProgramData% — containing a portable QEMU 8.x distribution, a 180 MB QCOW2 disk image named "svchost.qcow2", and a launcher batch file. QEMU is then launched with --enable-kvm (where Hyper-V is disabled) or TCG acceleration, 2-4 GB of RAM, a tap0 network adapter, and a -drive flag that exposes \\host\C$ read/write into the guest. Because the ransomware binary runs inside the guest's /tmp directory, host EDR only sees qemu-system-x86_64.exe reading a QCOW2 file — a signature no vendor currently flags.

Inside the guest, the operators run the Rust-based PayoutsKing encryptor (internal name "paykng", ELF SHA-256 a6f8c4...). The encryptor enumerates 9p or SMB-mounted host paths, applies AES-256-CTR with a ChaCha20-wrapped per-file key, renames files with the .paykng extension, and drops a README_PAYKNG.txt ransom note pointing to a TOR .onion negotiation portal. Before encryption, the guest exfiltrates up to 50 GB of selected data to rclone-configured Backblaze B2 and Mega.nz endpoints. Credential harvesting is performed by a Linux-native Impacket secretsdump invocation against the host's mounted NTDS.dit and SYSTEM hive, after which Kerberoasting and DCSync are attempted via Rubeus staged back out to the host. Persistence is achieved by registering qemu-system-x86_64.exe as a Windows service ("WindowsVirtualizationHost") and a scheduled task that re-launches the VM with the same QCOW2 image on reboot.

Defensive implications are significant. Traditional EDR ships little to no telemetry for 9p/virtio-blk syscalls, VM-contained Linux processes, or QEMU guest memory; YARA scans of the host filesystem cannot reach the guest disk because the QCOW2 image stores data in a proprietary compressed format; and file-access auditing on host shares reports the QEMU process as the accessing principal, which is not inherently suspicious on engineering workstations. Mitigations require: (1) blocking unsigned QEMU binaries via Windows Defender Application Control (WDAC), (2) alerting on qemu-system-*.exe creation outside approved virtualization tooling, (3) monitoring for tap adapter creation (tap-windows6), (4) constraining SMB share exposure to VM processes via SMB signing and per-process firewall rules, and (5) deploying the Sophos-published Sigma rule that correlates qemu-system-x86_64.exe execution with large QCOW2 file reads and subsequent host share writes from the QEMU PID.

MITRE ATT&CK techniques used in TL-2026-0379

Credential Access

T1003.001 LSASS Memory; T1003.003 NTDS; T1558.003 Kerberoasting

Collection

T1005 Data from Local System; T1560.001 Archive via Utility

Lateral Movement

T1021.001 Remote Desktop Protocol; T1021.002 SMB/Windows Admin Shares; T1550.002 Pass the Hash

Defense Evasion

T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1070.004 File Deletion; T1564.006 Run Virtual Instance; T1574.001 DLL

Exfiltration

T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol; T1567.002 Exfiltration to Cloud Storage

Persistence

T1053.005 Scheduled Task; T1543.003 Windows Service; T1547.001 Registry Run Keys / Startup Folder

Privilege Escalation

T1055 Process Injection

Execution

T1059.001 PowerShell; T1059.003 Windows Command Shell; T1204.002 Malicious File; T1569.002 Service Execution

Command and Control

T1071.001 Web Protocols; T1090 Proxy; T1572 Protocol Tunneling

Discovery

T1082 System Information Discovery; T1135 Network Share Discovery; T1518.001 Security Software Discovery

Initial Access

T1133 External Remote Services; T1190 Exploit Public-Facing Application; T1566 Phishing

Impact

T1486 Data Encrypted for Impact; T1489 Service Stop; T1490 Inhibit System Recovery

defense-impairment

T1685 Disable or Modify Tools

Affected products and versions in QEMU Virtualization Abuse for PayoutsKing Ransomware

  • Microsoft — Windows 10 / 11 / Server
    Vulnerable versions: Windows 10 1809+; Windows 11 all; Server 2016+
  • QEMU Project — QEMU
    Vulnerable versions: 6.x; 7.x; 8.x
  • ConnectWise — ScreenConnect
    Vulnerable versions: <24.2.0
    Fixed in: 24.2.0+

Remediation for QEMU Virtualization Abuse for PayoutsKing Ransomware

Patches

  • Apply Sophos Central policy update 2026.04.15 which adds behavioral detection for the QEMU-in-ransomware pattern.
  • Update Windows Defender signatures to 1.415.1234.0 or later (includes PayoutsKing encryptor ELF signature).
  • Patch ScreenConnect to 24.2.0 or later to close the initial access vector consistent with TL-2026-0342.

Immediate actions

  • Block execution of qemu-system-x86_64.exe and qemu-system-i386.exe via Windows Defender Application Control (WDAC) or AppLocker unless explicitly whitelisted for virtualization engineers.
  • Alert on creation of tap-windows6 network adapters on non-virtualization workstations.
  • Hunt for QCOW2 files (>100 MB) in %ProgramData%, %APPDATA%, and C:\Users\Public directories.
  • Block outbound connections to Backblaze B2 and Mega.nz from endpoints that do not have a documented business need.
  • Review Windows service creation events (Event ID 7045) in the last 90 days for services named 'WindowsVirtualizationHost', 'HostEmulator', or similar decoy names pointing to qemu-system-*.exe.

Workarounds

  • Disable Hyper-V and VT-x in BIOS on endpoints that do not require virtualization, forcing QEMU into slow TCG mode where user perception of the compromise increases.
  • Restrict Win32_Service WMI object creation to privileged users via WMI security descriptors.
  • Disable tap-windows6.sys driver loading via Group Policy on standard user endpoints.

Longer-term hardening

  • Deploy Sophos-published Sigma rule for QEMU-in-ransomware kill chain; subscribe to Sophos X-Ops feed for IOC updates.
  • Enable SMB signing cluster-wide and enforce per-process firewall rules so non-Explorer processes cannot mount administrative shares.
  • Deploy EDR with kernel-mode hypervisor introspection (Sophos Intercept X with XDR, CrowdStrike Falcon Overwatch, Microsoft Defender for Endpoint with Virtualization Based Security integration).
  • Implement egress filtering that denies rclone user-agents and known cloud-storage exfil destinations by default.
  • Segment engineering workstations with legitimate QEMU need onto isolated VLANs with no SMB access to production file servers.

Weaknesses (CWE) in QEMU Virtualization Abuse for PayoutsKing Ransomware

CWE-506, CWE-829, CWE-693

Timeline of QEMU Virtualization Abuse for PayoutsKing Ransomware

  • CISA/FBI issue joint advisory AA24-131A on Black Basta ransomware — the operator set that would later reconstitute as PayoutsKing.
  • First PayoutsKing intrusion observed by Sophos MDR against a US manufacturing target; no QEMU component in this incident.
  • Sophos X-Ops observes the first PayoutsKing intrusion using a portable QEMU VM to conceal ransomware execution on a Dutch logistics firm.
  • QEMU-based PayoutsKing attack against a Canadian healthcare provider; 12 GB of PHI exfiltrated to Backblaze B2 before host-side encryption.
  • Sophos identifies a reusable QCOW2 'svchost.qcow2' image shared across three unrelated PayoutsKing victims, indicating tooling industrialization.
  • Palo Alto Unit 42 publishes tracking of Black Basta successor activity consistent with PayoutsKing infrastructure overlaps.
  • At least two PayoutsKing QEMU intrusions chain through unpatched ScreenConnect instances, linking to TL-2026-0342.
  • Sophos Central pushes policy update 2026.04.15 adding behavioral detection for QEMU-in-ransomware pattern.
  • Sophos X-Ops publishes public advisory and IOC set for the PayoutsKing QEMU campaign.
  • As of 2026-05-29, PayoutsKing (GOLD ENCOUNTER, BlackBasta successor) remains an active double-extortion ransomware operation with leak-site victim claims as recently as 30 Apr 2026 and no takedown/arrests reported. The QEMU/hidden-VM evasion TTP is real and viable, though the group has been observed pivoting some ops to Teams/QuickAssist social engineering and CitrixBleed2 access.

Sources cited for QEMU Virtualization Abuse for PayoutsKing Ransomware

Threats related to QEMU Virtualization Abuse for PayoutsKing Ransomware

Detection coverage for TL-2026-0379

As of 2026-04-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0379 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats