Sophos Reports Threat Actors Abusing QEMU to Deploy Ransomware and Remote-Access Tools
Summary
Sophos reports two campaigns abusing QEMU for covert access, credential harvesting and payload delivery. The campaigns involved exploitation of SolarWinds Web Help Desk and Citrix NetScaler vulnerabilities.
Key points
- Sophos reports increased QEMU abuse since late 2025, including campaign STAC4713, which it says may be linked to PayoutsKing ransomware.
- STAC4713 actors initially targeted exposed SonicWall VPNs without MFA, then exploited CVE-2025-26399 in SolarWinds Web Help Desk.
- Attackers used a scheduled task to run a QEMU VM with System privileges; its virtual disk image created a reverse SSH tunnel.
- Sophos observed copying of the Active Directory database and SAM and SYSTEM hives, along with network-share discovery and file access.
- A second campaign, STAC3725, observed in February 2026, exploited CVE-2025-5777 in Citrix NetScaler and used a malicious ScreenConnect client for persistence.
- Sophos observed credential harvesting, Kerberos username enumeration, Active Directory reconnaissance, payload staging and data exfiltration in the second campaign.
- Sophos recommends looking for unauthorized QEMU installations, rogue scheduled tasks, unusual port-forwarding rules and outbound SSH tunnels.
Article Details
- Event Type
- Sophos reported two campaigns in which threat actors abused QEMU for covert access, persistence, and deployment of ransomware and remote access tools.
- Impact
- The observed activity included reverse SSH access, payload delivery, credential harvesting, Active Directory reconnaissance, and data exfiltration. The source does not quantify the number of affected organizations or the amount of data taken.
MITRE ATT&CK
T1003.002 · Security Account ManagerSophos observed attackers copying the SAM and SYSTEM hives to temporary folders.T1003.003 · NTDSSophos observed attackers copying the Active Directory database, consistent with credential access involving NTDS.T1053.005 · Scheduled TaskIn the first campaign, attackers created a scheduled task to launch a QEMU VM and establish persistence.T1087.002 · Domain AccountIn the second campaign, attackers enumerated Kerberos usernames, consistent with domain account discovery.T1135 · Network Share DiscoverySophos observed network share discovery during the first campaign.T1190 · Exploit Public-Facing ApplicationSophos reported exploitation of exposed SonicWall VPNs and vulnerabilities in SolarWinds Web Help Desk and Citrix NetScaler for initial access.T1572 · Protocol TunnelingThe QEMU virtual disk image established a reverse SSH tunnel, described as providing attackers access to the VM.
CVE
CVE-2025-26399SolarWinds · Web Help DeskAt first, the hackers targeted exposed SonicWall VPNs that lacked MFA for initial access, but later switched to exploiting CVE-2025-26399, a remote code execution (RCE) vulnerability in SolarWinds Web Help Desk.CVE-2025-5777NetScaler · ADC; NetScaler · GatewayTracked as STAC3725, it has been relying on the exploitation of CVE-2025-5777 (the infamous CitrixBleed2 bug) for initial access and on a malicious ScreenConnect client to achieve persistence.
Threat Actors
Malware
Products
ESXiThe gang is known to target VMware and ESXi environments for encryption.NetScalerFollowing the NetScaler exploitation, the attackers created a start service, installed the remote access tool to retrieve QEMU and a virtual disk image, and manually executed the attack within the VM.QEMUThreat actors have been abusing QEMU in campaigns leading to the deployment of ransomware and remote access tools, Sophos reports.ScreenConnectTracked as STAC3725, it has been relying on the exploitation of CVE-2025-5777 (the infamous CitrixBleed2 bug) for initial access and on a malicious ScreenConnect client to achieve persistence.SolarWinds Web Help DeskAt first, the hackers targeted exposed SonicWall VPNs that lacked MFA for initial access, but later switched to exploiting CVE-2025-26399, a remote code execution (RCE) vulnerability in SolarWinds Web Help Desk.