Payouts King Ransomware Uses QEMU Virtual Machines to Bypass EDR and Endpoint Security Controls
Payouts King Ransomware Uses QEMU Virtual Machines to Bypass (TL-2026-0390), also tracked as Payouts King Ransomware, is a high-severity ransomware operation, first published 2026-04-19. It is attributed to Payouts King (Russia) with medium confidence, affects Microsoft Windows, maps to 27 MITRE ATT&CK techniques (T1003.001, T1018, T1021.001), and is covered by 9 detection rules and 21 indicators of compromise.
Key facts for TL-2026-0390
- Threat ID
- TL-2026-0390
- Also known as
- Payouts King Ransomware, PK Ransomware, QEMU-VM Ransomware Campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- 2026-04-19
- Last reviewed
- 2026-04-19
- Attribution
- Payouts King
- Attribution confidence
- MEDIUM
- Nation-state nexus
- Russia
- Motivation
- FINANCIAL
- Target sectors
- healthcare, manufacturing, legal, financial, critical-infrastructure, education
- Target regions
- North America, Europe, United Kingdom, Australia
- Detection rules
- 9
- Indicators of compromise
- 21
Malware and tooling in Payouts King Ransomware Uses QEMU Virtual Machines to Bypass
Malware and tooling: payoutsking, AnyDesk, Atera, ScreenConnect, Tor hidden service leak site, qemu-system-x86_64.exe
Payouts King ransomware operators are deploying encryption payloads inside lightweight QEMU virtual machines on compromised Windows hosts, executing the ransomware from within a guest VM that mounts the host filesystem to bypass EDR and host-based process introspection. The technique extends earlier Akira and Ragnar Locker VM-cloaking experiments into a reusable toolkit that has successfully impacted multiple enterprise victims in early 2026.
How Payouts King Ransomware Uses QEMU Virtual Machines to Bypass works
Payouts King is a ransomware-as-a-service (RaaS) operation first observed in late 2025 that emerged from fragments of the disbanded LockBit and BlackCat affiliate networks. Throughout Q1-Q2 2026, affiliates began deploying a novel evasion technique in which the final encryption payload is not executed on the host at all — instead, affiliates stage a portable QEMU distribution on the victim host, boot a minimal Tiny Core or Alpine Linux guest image, mount the host's NTFS volumes into the guest via QEMU's virtio-9p shared folders or raw block device passthrough, and invoke the ELF-compiled Payouts King encryptor from within the guest kernel's userspace.
Because the encrypting process runs inside the VM, host-based EDR agents (CrowdStrike Falcon, SentinelOne, Microsoft Defender for Endpoint, Carbon Black) see only the parent qemu-system-x86_64.exe process performing what looks like benign virtualization I/O. File writes are funneled through a single legitimate QEMU process handle, which defeats process-based ransomware heuristics that rely on high-entropy bulk file modification by a single, non-allowlisted binary. Volume Shadow Copy deletion, boot configuration tampering, and ransom note dropping are also performed from inside the guest, invisible to host-side behavior monitors.
The initial access vectors observed include exploitation of exposed Fortinet FortiGate SSL-VPN appliances (CVE-2024-21762 residual exposure), Veeam Backup & Replication (CVE-2024-40711), and phishing with malicious MSI installers signed using stolen code-signing certificates. Once inside, operators use legitimate remote-management tools (AnyDesk, ScreenConnect, Atera) for persistence and hands-on-keyboard movement before staging the QEMU bundle. The QEMU bundle is delivered as a self-extracting 7z archive containing qemu-system-x86_64.exe, SeaBIOS firmware, a 280MB Alpine Linux qcow2 image, a shell bootstrap, and the encryptor binary.
Encryption uses ChaCha20 for file contents with per-file random 256-bit keys wrapped by an embedded Curve25519 public key. Ransom demands observed range from $450,000 USD to $8.5M USD in Bitcoin or Monero, with a leak site (payouts-king[.]onion) used for double-extortion. Victims to date include a North American healthcare network, two European manufacturing conglomerates, and a mid-market US law firm, with public leak-site postings confirming at least 14 successful encryption events between 2026-02-04 and 2026-04-15.
The VM-based approach is a direct evolution of the Akira ransomware TTP first documented by Sophos in 2024, where Akira affiliates used Microsoft Hyper-V and VMware ESXi hypervisors already present on victim infrastructure. Payouts King removes the dependency on pre-existing hypervisors by bringing its own portable hypervisor (QEMU for Windows), making the technique applicable to any Windows host with 1GB of free RAM and local administrator privileges. Defenders must pivot from process-level ransomware detection to guest-VM monitoring, filesystem-layer telemetry, and controlled-folder-access policies that block QEMU binaries from mounting business-critical paths.
MITRE ATT&CK techniques used in TL-2026-0390
Credential Access
T1003.001 OS Credential Dumping: LSASS Memory
Discovery
T1018 Remote System Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery
Lateral Movement
T1021.001 Remote Services: Remote Desktop Protocol; T1021.002 Remote Services: SMB/Windows Admin Shares
Defense Evasion
T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1564.006 Hide Artifacts: Run Virtual Instance
Execution
T1059.001 Command and Scripting Interpreter: PowerShell; T1204.002 User Execution: Malicious File
Command and Control
T1071.001 Application Layer Protocol: Web Protocols; T1105 Ingress Tool Transfer
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application; T1566.001 Phishing: Spearphishing Attachment
command-and-control
Impact
T1486 Data Encrypted for Impact; T1489 Service Stop; T1490 Inhibit System Recovery
Persistence
T1543.003 Create or Modify System Process: Windows Service
Privilege Escalation
T1548 Abuse Elevation Control Mechanism
defense-impairment
T1553.002 Subvert Trust Controls: Code Signing; T1685 Disable or Modify Tools; T1685.005 Clear Windows Event Logs
Collection
Exfiltration
Affected products and versions in Payouts King Ransomware Uses QEMU Virtual Machines to Bypass
- Microsoft — Windows
Vulnerable versions: Windows 10 1809+; Windows 11; Windows Server 2016; Windows Server 2019; Windows Server 2022 - Fortinet — FortiGate SSL-VPN
Vulnerable versions: <7.4.3; <7.2.7
Fixed in: 7.4.3; 7.2.7 - Veeam — Backup & Replication
Vulnerable versions: <12.1.2.172
Fixed in: 12.1.2.172 - QEMU Project — QEMU for Windows (weaponized)
Vulnerable versions: 8.0+ portable builds abused
Remediation for Payouts King Ransomware Uses QEMU Virtual Machines to Bypass
Patches
- Ensure FortiGate SSL-VPN appliances are patched to 7.4.3+ / 7.2.7+ (CVE-2024-21762)
- Patch Veeam Backup & Replication to 12.1.2.172+ (CVE-2024-40711)
- Apply latest Microsoft Defender for Endpoint cloud-delivered protection signatures
Immediate actions
- Block execution of qemu-system-x86_64.exe and related QEMU binaries via WDAC or AppLocker on all production Windows servers and workstations
- Alert on any process creation of qemu-system*.exe, qemu-img.exe, or qemu-kvm where the parent process is not a sanctioned virtualization management tool
- Review and tighten Controlled Folder Access (Microsoft Defender) or EDR ransomware-protection policies to include file-share and backup directories
- Hunt for self-extracting 7z archives dropping qcow2, qemu-system, or seabios files on endpoints in the last 30 days
- Patch exposed Fortinet FortiGate SSL-VPN and Veeam Backup & Replication immediately if not already remediated
- Audit for unauthorized AnyDesk, ScreenConnect, and Atera installs across fleet
Workarounds
- Disable or block execution of portable virtualization tools via GPO Software Restriction Policies if allowlisting is not feasible
- Create a Sysmon rule set that flags mountvol.exe usage by non-admin processes and any 9p/virtio-fs driver activity
- Require admin approval for any process creation of qemu-system-x86_64.exe through JIT prompts
Longer-term hardening
- Deploy EDR tooling with filesystem-layer ransomware detection (canary files, mass-write heuristics at the NTFS driver level) that operates independently of process attribution
- Enforce application allowlisting with default-deny on servers, limiting virtualization binaries to known admin workstations only
- Segment backup infrastructure from production Active Directory and enforce immutable backups with air-gapped copies
- Deploy endpoint isolation automation that can triggered by anomalous 9p/virtio-fs mount activity
- Implement just-in-time (JIT) administration for local admin rights to reduce the blast radius of credential theft
- Build detections for unsigned or unknown-publisher executables within qcow2/vmdk/vhdx virtual disk files via filesystem scanning
Weaknesses (CWE) in Payouts King Ransomware Uses QEMU Virtual Machines to Bypass
CWE-506, CWE-693
Timeline of Payouts King Ransomware Uses QEMU Virtual Machines to Bypass
- Sophos documents Ragnar Locker ransomware using VirtualBox VMs to cloak encryption activity — first public record of VM-based evasion.
- Sophos publishes analysis of Akira affiliates abusing existing VMware ESXi and Hyper-V hypervisors to encrypt from inside guests.
- Payouts King ransomware leak site (payouts-king.onion) first observed online; initial victim postings begin.
- Incident responders observe the first Payouts King intrusion using a portable QEMU distribution to run the encryptor in-guest against a US healthcare provider.
- European manufacturing conglomerate listed on payouts-king.onion leak site following successful QEMU-VM encryption event.
- Second European manufacturer disclosed on leak site with ransom demand of $8.5M USD.
- Mid-market US law firm added to leak site; total public victims now exceed 14 organizations.
- BleepingComputer publishes public analysis of Payouts King's QEMU VM-based evasion technique.
- CISA issues StopRansomware bulletin referencing VM-based encryption tradecraft and recommending QEMU binary blocking.
- Threadlinqs Intelligence opens threat record TL-2026-0390 tracking Payouts King campaign and related QEMU-abuse TTPs.
- As of 2026-05-29, Payouts King (Sophos GOLD ENCOUNTER, STAC4713/STAC3725) remains a live RaaS threat: its leak site is still posting victims (NTN Bearing on 2026-05-13, ~100 total) with no takedown or arrests. The QEMU VM-cloaking EDR-evasion TTP stays viable and is actively evolving, confirmed by Sophos and BleepingComputer through 2026.
Sources cited for Payouts King Ransomware Uses QEMU Virtual Machines to Bypass
- Payouts King ransomware uses QEMU VMs to bypass endpoint security
- Akira Inside: Hypervisor-Level Ransomware Detection (precursor research)
- Ragnar Locker VirtualBox VM technique writeup
- CISA Advisory: #StopRansomware — Fast-Moving Ransomware Affiliates
- MITRE ATT&CK T1564.006 Run Virtual Instance
- CVE-2024-21762 Fortinet FortiOS SSL-VPN OOB Write
- CVE-2024-40711 Veeam Backup & Replication Deserialization RCE
- QEMU System Emulator Documentation — 9p filesystem sharing
- SentinelOne Labs: VM-Based Ransomware Evasion Analysis
- CrowdStrike 2026 Global Threat Report — RaaS Ecosystem Evolution
Threats related to Payouts King Ransomware Uses QEMU Virtual Machines to Bypass
- QEMU Virtualization Abuse for PayoutsKing Ransomware Delivery & Evasion
- Payouts King Ransomware — BlackBasta Successor Operation Targeting US Manufacturing, Healthcare, and Construction Sectors
- Kyber Ransomware: Post-Quantum Hybrid Encryption Operation Targeting Windows & VMware ESXi
- Payouts King Ransomware — BlackBasta-Affiliate RaaS Evades EDR via Direct System Calls, ntdll Export-Table Walking, and SetFileInformationByHandle Rename Evasion (Zscaler ThreatLabz)
- Qilin Ransomware Group Claims Cyberattack on ATF (DOJ) — Standalone Investigation-Target System Breached, Attribution Unconfirmed
- Ransomware Groups Exploit Citrix Bleed 2 (CVE-2025-5777) and Kontron Driver BYOVD for Access and Privilege Escalation
Detection coverage for TL-2026-0390
As of 2026-04-19, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0390 across Splunk SPL, Microsoft KQL and Sigma, covering 21 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.