# QEMU Virtualization Abuse for PayoutsKing Ransomware Delivery & Evasion

> PayoutsKing, a BlackBasta-successor ransomware operation, deploys hidden QEMU virtual machines on compromised Windows endpoints to execute payloads, harvest credentials, and stage data exfiltration from inside an ephemeral Linux guest — rendering host-level EDR, AV, and file-integrity telemetry effectively blind. Sophos X-Ops confirmed active intrusions in Q1 2026 in which operators sideloaded a portable QEMU distribution, bridged the guest to the host network with a tap adapter, and ran ransomware encryption routines entirely from inside the VM against mounted host shares.

- **Published:** 2026-04-16T12:00:00Z
- **Last reviewed:** 2026-04-16T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0379
- **ID:** TL-2026-0379
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** PayoutsKing (Russia)
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Between January and April 2026, Sophos X-Ops documented a cluster of intrusions in which the PayoutsKing ransomware crew — the reconstituted BlackBasta affiliate set tracked since the 2024 Storm-1811 / Black Basta collapse — weaponized the open-source QEMU emulator as a living-off-the-land (LotL) execution environment. The novelty of the technique is that almost no malicious activity touches the host Windows process tree: only qemu-system-x86_64.exe, its signed helper binaries, and a user-mode network tap adapter appear on the endpoint. Everything else — credential theft, lateral movement staging, double-extortion exfiltration, and AES-256 encryption of host-mounted shares — happens inside a lightweight TinyCore or Alpine Linux guest that the operators ship pre-baked as a QCOW2 image.

The kill chain observed by Sophos begins with either (a) phishing-delivered DLL side-loading through a trojanized OneDriveStandaloneUpdater.exe variant, or (b) exploitation of an unpatched ScreenConnect relay (consistent with TL-2026-0342). After an initial Cobalt Strike or Sliver beacon lands on the host, the operator unpacks a 250-450 MB staging archive — typically disguised as "OneDriveBackup.zip" in %ProgramData% — containing a portable QEMU 8.x distribution, a 180 MB QCOW2 disk image named "svchost.qcow2", and a launcher batch file. QEMU is then launched with --enable-kvm (where Hyper-V is disabled) or TCG acceleration, 2-4 GB of RAM, a tap0 network adapter, and a -drive flag that exposes \\host\C$ read/write into the guest. Because the ransomware binary runs inside the guest's /tmp directory, host EDR only sees qemu-system-x86_64.exe reading a QCOW2 file — a signature no vendor currently flags.

Inside the guest, the operators run the Rust-based PayoutsKing encryptor (internal name "paykng", ELF SHA-256 a6f8c4...). The encryptor enumerates 9p or SMB-mounted host paths, applies AES-256-CTR with a ChaCha20-wrapped per-file key, renames files with the .paykng extension, and drops a README_PAYKNG.txt ransom note pointing to a TOR .onion negotiation portal. Before encryption, the guest exfiltrates up to 50 GB of selected data to rclone-configured Backblaze B2 and Mega.nz endpoints. Credential harvesting is performed by a Linux-native Impacket secretsdump invocation against the host's mounted NTDS.dit and SYSTEM hive, after which Kerberoasting and DCSync are attempted via Rubeus staged back out to the host. Persistence is achieved by registering qemu-system-x86_64.exe as a Windows service ("WindowsVirtualizationHost") and a scheduled task that re-launches the VM with the same QCOW2 image on reboot.

Defensive implications are significant. Traditional EDR ships little to no telemetry for 9p/virtio-blk syscalls, VM-contained Linux processes, or QEMU guest memory; YARA scans of the host filesystem cannot reach the guest disk because the QCOW2 image stores data in a proprietary compressed format; and file-access auditing on host shares reports the QEMU process as the accessing principal, which is not inherently suspicious on engineering workstations. Mitigations require: (1) blocking unsigned QEMU binaries via Windows Defender Application Control (WDAC), (2) alerting on qemu-system-*.exe creation outside approved virtualization tooling, (3) monitoring for tap adapter creation (tap-windows6), (4) constraining SMB share exposure to VM processes via SMB signing and per-process firewall rules, and (5) deploying the Sophos-published Sigma rule that correlates qemu-system-x86_64.exe execution with large QCOW2 file reads and subsequent host share writes from the QEMU PID.

## MITRE ATT&CK

- T1566 Phishing
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1204.002 Malicious File
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1569.002 Service Execution
- T1543.003 Windows Service
- T1053.005 Scheduled Task
- T1547.001 Registry Run Keys / Startup Folder
- T1055 Process Injection
- T1564.006 Run Virtual Instance
- T1574.001 DLL
- T1036.005 Match Legitimate Resource Name or Location
- T1685 Disable or Modify Tools
- T1027 Obfuscated Files or Information
- T1070.004 File Deletion
- T1003.001 LSASS Memory
- T1003.003 NTDS
- T1558.003 Kerberoasting
- T1082 System Information Discovery
- T1518.001 Security Software Discovery
- T1135 Network Share Discovery
- T1021.002 SMB/Windows Admin Shares
- T1021.001 Remote Desktop Protocol
- T1550.002 Pass the Hash
- T1005 Data from Local System
- T1560.001 Archive via Utility
- T1071.001 Web Protocols
- T1572 Protocol Tunneling
- T1090 Proxy
- T1567.002 Exfiltration to Cloud Storage
- T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol
- T1486 Data Encrypted for Impact
- T1490 Inhibit System Recovery
- T1489 Service Stop

## Sources

- [Sophos X-Ops: PayoutsKing ransomware abuses QEMU for evasion](https://news.sophos.com/en-us/)
- [Sophos X-Ops GitHub: paykng-qemu IOCs](https://github.com/sophoslabs/IoCs)
- [MITRE ATT&CK T1564.006 Run Virtual Instance](https://attack.mitre.org/techniques/T1564/006/)
- [CISA Advisory: Black Basta Ransomware (historical)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-131a)
- [Sophos News: Ragnar Locker abuses VirtualBox (prior art)](https://news.sophos.com/en-us/2020/05/21/ragnar-locker-ransomware-deploys-virtual-machine-to-dodge-security/)
- [Palo Alto Unit 42: Black Basta successor tracking](https://unit42.paloaltonetworks.com/)
- [QEMU Project — portable binary distribution](https://www.qemu.org/download/)
- [Sigma Rule Repository: QEMU Ransomware Detection](https://github.com/SigmaHQ/sigma)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0379