# Payouts King Ransomware Uses QEMU Virtual Machines to Bypass EDR and Endpoint Security Controls

> Payouts King ransomware operators are deploying encryption payloads inside lightweight QEMU virtual machines on compromised Windows hosts, executing the ransomware from within a guest VM that mounts the host filesystem to bypass EDR and host-based process introspection. The technique extends earlier Akira and Ragnar Locker VM-cloaking experiments into a reusable toolkit that has successfully impacted multiple enterprise victims in early 2026.

- **Published:** 2026-04-19T12:00:00Z
- **Last reviewed:** 2026-04-19T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0390
- **ID:** TL-2026-0390
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Payouts King (Russia)
- **Detections:** 9 · **IOCs:** 21 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2024-21762, CVE-2024-40711

## Description

Payouts King is a ransomware-as-a-service (RaaS) operation first observed in late 2025 that emerged from fragments of the disbanded LockBit and BlackCat affiliate networks. Throughout Q1-Q2 2026, affiliates began deploying a novel evasion technique in which the final encryption payload is not executed on the host at all — instead, affiliates stage a portable QEMU distribution on the victim host, boot a minimal Tiny Core or Alpine Linux guest image, mount the host's NTFS volumes into the guest via QEMU's virtio-9p shared folders or raw block device passthrough, and invoke the ELF-compiled Payouts King encryptor from within the guest kernel's userspace.

Because the encrypting process runs inside the VM, host-based EDR agents (CrowdStrike Falcon, SentinelOne, Microsoft Defender for Endpoint, Carbon Black) see only the parent qemu-system-x86_64.exe process performing what looks like benign virtualization I/O. File writes are funneled through a single legitimate QEMU process handle, which defeats process-based ransomware heuristics that rely on high-entropy bulk file modification by a single, non-allowlisted binary. Volume Shadow Copy deletion, boot configuration tampering, and ransom note dropping are also performed from inside the guest, invisible to host-side behavior monitors.

The initial access vectors observed include exploitation of exposed Fortinet FortiGate SSL-VPN appliances (CVE-2024-21762 residual exposure), Veeam Backup & Replication (CVE-2024-40711), and phishing with malicious MSI installers signed using stolen code-signing certificates. Once inside, operators use legitimate remote-management tools (AnyDesk, ScreenConnect, Atera) for persistence and hands-on-keyboard movement before staging the QEMU bundle. The QEMU bundle is delivered as a self-extracting 7z archive containing qemu-system-x86_64.exe, SeaBIOS firmware, a 280MB Alpine Linux qcow2 image, a shell bootstrap, and the encryptor binary.

Encryption uses ChaCha20 for file contents with per-file random 256-bit keys wrapped by an embedded Curve25519 public key. Ransom demands observed range from $450,000 USD to $8.5M USD in Bitcoin or Monero, with a leak site (payouts-king[.]onion) used for double-extortion. Victims to date include a North American healthcare network, two European manufacturing conglomerates, and a mid-market US law firm, with public leak-site postings confirming at least 14 successful encryption events between 2026-02-04 and 2026-04-15.

The VM-based approach is a direct evolution of the Akira ransomware TTP first documented by Sophos in 2024, where Akira affiliates used Microsoft Hyper-V and VMware ESXi hypervisors already present on victim infrastructure. Payouts King removes the dependency on pre-existing hypervisors by bringing its own portable hypervisor (QEMU for Windows), making the technique applicable to any Windows host with 1GB of free RAM and local administrator privileges. Defenders must pivot from process-level ransomware detection to guest-VM monitoring, filesystem-layer telemetry, and controlled-folder-access policies that block QEMU binaries from mounting business-critical paths.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1566.001 Phishing: Spearphishing Attachment
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1204.002 User Execution: Malicious File
- T1543.003 Create or Modify System Process: Windows Service
- T1219 Remote Access Tools
- T1548 Abuse Elevation Control Mechanism
- T1564.006 Hide Artifacts: Run Virtual Instance
- T1685 Disable or Modify Tools
- T1685.005 Clear Windows Event Logs
- T1553.002 Subvert Trust Controls: Code Signing
- T1027 Obfuscated Files or Information
- T1036.005 Match Legitimate Resource Name or Location
- T1003.001 OS Credential Dumping: LSASS Memory
- T1083 File and Directory Discovery
- T1082 System Information Discovery
- T1018 Remote System Discovery
- T1021.002 Remote Services: SMB/Windows Admin Shares
- T1021.001 Remote Services: Remote Desktop Protocol
- T1560 Archive Collected Data
- T1105 Ingress Tool Transfer
- T1071.001 Application Layer Protocol: Web Protocols
- T1567.002 Exfiltration to Cloud Storage
- T1486 Data Encrypted for Impact
- T1490 Inhibit System Recovery
- T1489 Service Stop

## Sources

- [Payouts King ransomware uses QEMU VMs to bypass endpoint security](https://www.bleepingcomputer.com/news/security/payouts-king-ransomware-uses-qemu-vms-to-bypass-endpoint-security/)
- [Akira Inside: Hypervisor-Level Ransomware Detection (precursor research)](https://news.sophos.com/en-us/2024/10/08/akira-ransomware-attacks-esxi-hypervisor/)
- [Ragnar Locker VirtualBox VM technique writeup](https://www.sophos.com/en-us/press-office/press-releases/2020/05/sophos-uncovers-new-ragnar-locker-ransomware-attack-hidden-in-virtual-machine)
- [CISA Advisory: #StopRansomware — Fast-Moving Ransomware Affiliates](https://www.cisa.gov/news-events/cybersecurity-advisories)
- [MITRE ATT&CK T1564.006 Run Virtual Instance](https://attack.mitre.org/techniques/T1564/006/)
- [CVE-2024-21762 Fortinet FortiOS SSL-VPN OOB Write](https://nvd.nist.gov/vuln/detail/CVE-2024-21762)
- [CVE-2024-40711 Veeam Backup & Replication Deserialization RCE](https://nvd.nist.gov/vuln/detail/CVE-2024-40711)
- [QEMU System Emulator Documentation — 9p filesystem sharing](https://www.qemu.org/docs/master/system/virtio-9p.html)
- [SentinelOne Labs: VM-Based Ransomware Evasion Analysis](https://www.sentinelone.com/labs/)
- [CrowdStrike 2026 Global Threat Report — RaaS Ecosystem Evolution](https://www.crowdstrike.com/global-threat-report/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0390