Payouts King Uses Hidden QEMU Virtual Machines to Evade Endpoint Security
Summary
Sophos describes two campaigns using hidden Alpine Linux VMs in QEMU to evade host defenses, harvest credentials and enable remote access. One is linked to Payouts King; another exploits CitrixBleed 2. Zscaler says Payouts King is likely tied to former BlackBasta oper
Key points
- Sophos links campaign STAC4713 to Payouts King and associates it with GOLD ENCOUNTER. Attackers launch a hidden Alpine Linux 3.22 VM through a scheduled task running as SYSTEM.
- The attackers disguise virtual disk files as databases or DLLs and use QEMU port forwarding to establish reverse SSH tunnels.
- Sophos reports initial access through exposed SonicWall VPNs and, in later activity, a SolarWinds Web Help Desk vulnerability; other observed access included a Cisco VPN and Microsoft Teams social engineering leading to QuickAssist.
- In STAC4713 activity, attackers used VSS and copied NTDS.dit, SAM, and SYSTEM files. Sophos also observed Havoc C2 payload sideloading and Rclone exfiltration to SFTP.
- A second campaign, STAC3725, exploits CitrixBleed 2 (CVE-2025-5777) on NetScaler devices, then installs ScreenConnect and a hidden QEMU VM.
- Inside the STAC3725 VM, attackers installed tools including Impacket, BloodHound.py, and Metasploit; observed activity included credential harvesting and Active Directory reconnaissance.
- Sophos recommends investigating unauthorized QEMU installations, suspicious SYSTEM scheduled tasks, unusual SSH port forwarding, and outbound SSH tunnels on nonstandard ports.
Article Details
- Attack Vectors
- Initial access included exposed SonicWall VPNs and a Cisco SSL VPN.
- Attackers exploited CitrixBleed 2 (CVE-2025-5777) in NetScaler ADC and Gateway instances.
- Sophos observed exploitation of the SolarWinds Web Help Desk vulnerability CVE-2025-26399 in more recent attacks.
- Attackers impersonated IT staff in Microsoft Teams and persuaded employees to download and install QuickAssist.
- Attackers deployed hidden Alpine Linux virtual machines through QEMU, using port forwarding and reverse SSH tunnels for covert access.
- Attackers used scheduled tasks, DLL side-loading, and a ScreenConnect client to establish persistence and run payloads.
- Post-compromise activity included credential harvesting, Active Directory reconnaissance, and data exfiltration via Rclone, FTP, and SFTP.
- Defensive Notes
- Sophos recommends monitoring for unauthorized QEMU installations and suspicious scheduled tasks running with SYSTEM privileges.
- Monitor for unusual SSH port forwarding and outbound SSH tunnels on non-standard ports.
MITRE ATT&CK
T1003.002 · Security Account ManagerThe actors copied the SAM hive to temporary directories.T1003.003 · NTDSThe actors copied NTDS.dit and the SYSTEM hive to temporary directories after creating a shadow copy.T1048.002 · Exfiltration Over Asymmetric Encrypted Non-C2 ProtocolThe actors exfiltrated data to a remote SFTP location, including with Rclone.T1048.003 · Exfiltration Over Unencrypted Non-C2 ProtocolThe STAC3725 campaign staged data for exfiltration via FTP servers.T1053.005 · Scheduled TaskThe actors created scheduled tasks, including TPMProfiler, to launch QEMU with SYSTEM privileges and establish persistence.T1087.002 · Domain AccountThe actors performed Kerberos username enumeration and Active Directory reconnaissance.T1133 · External Remote ServicesInitial access included attacks through exposed SonicWall and Cisco VPNs.T1136.001 · Local AccountIn the STAC3725 campaign, attackers created a new local administrator account named CtxAppVCOMService.T1190 · Exploit Public-Facing ApplicationThe STAC3725 campaign exploited CitrixBleed 2 in NetScaler instances; Sophos also observed exploitation of CVE-2025-26399 in SolarWinds Web Help Desk.T1219 · Remote Access ToolsAttackers installed a ScreenConnect client that connected to a remote relay server and established a session with system privileges.T1543.003 · Windows ServiceIn the STAC3725 campaign, attackers installed a service named AppMgmt.T1562.001 · Disable or Modify ToolsPayouts King was reported to terminate security tools using low-level system calls.T1572 · Protocol TunnelingQEMU port forwarding was used to create reverse SSH tunnels for covert access and data exfiltration.T1574.002 · DLL Side-LoadingThe actors sideloaded a Havoc C2 payload, vcruntime140_1.dll, using the legitimate ADNotificationManager.exe binary.
CVE
Threat Actors
BlackBastaZscaler reported that Payouts King is likely tied to former BlackBasta affiliates, citing similar initial-access methods; this is a reported, uncertain association.Gold EncounterSophos researchers associated GOLD ENCOUNTER with the STAC4713 campaign, which was linked to the Payouts King ransomware operation. Sophos also attributed activity involving exposed Cisco VPN access and Microsoft Teams social engineering to the group.
Malware
Vendors
CiscoInitial access vectors include exposed SonicWall/Cisco VPNs, CitrixBleed 2 exploitation, Microsoft Teams phishing, and QuickAssist abuse.MicrosoftBlackBasta affiliates, with initial access achieved via exposed VPNs, CitrixBleed 2 exploitation, Microsoft Teams phishing, and QuickAssist abuse.SolarWindsSophos notes that initial access was achieved via exposed SonicWall VPNs, while exploitation of the SolarWinds Web Help Desk vulnerability CVE-2025-26399 was observed in more recent attacks.SonicWallInitial access vectors include exposed SonicWall/Cisco VPNs, CitrixBleed 2 exploitation, Microsoft Teams phishing, and QuickAssist abuse.
Products
Alpine LinuxPayouts King ransomware operators are abusing the QEMU emulator to run hidden Alpine Linux virtual machines on compromised hosts, using port forwarding and reverse SSH tunnels to execute payloads, harvest credentials,ESXiResearchers note that the threat actors behind the STAC4713 campaign are associated with the GOLD ENCOUNTER threat group, which is known to target hypervisors and encryptors for VMware and ESXi environments.Microsoft TeamsBlackBasta affiliates, with initial access achieved via exposed VPNs, CitrixBleed 2 exploitation, Microsoft Teams phishing, and QuickAssist abuse.NetScaler ADCThe other, tracked as STAC3725, has been spotted in February this year and exploits the CitrixBleed 2 (CVEâ2025â5777) vulnerability in NetScaler ADC and Gateway instances.QEMUPayouts King ransomware operators are abusing the QEMU emulator to run hidden Alpine Linux virtual machines on compromised hosts, using port forwarding and reverse SSH tunnels to execute payloads, harvest credentials,QuickAssistinitial access achieved via exposed VPNs, CitrixBleed 2 exploitation, Microsoft Teams phishing, and QuickAssist abuse.ScreenConnecta service named ‘AppMgmt,’ creates a new local admin user (CtxAppVCOMService), and installs a ScreenConnect client for persistence.SolarWinds Web Help DeskSophos notes that initial access was achieved via exposed SonicWall VPNs, while exploitation of the SolarWinds Web Help Desk vulnerability CVE-2025-26399 was observed in more recent attacks.
Tools
AdaptixC2The VM runs Alpine Linux version 3.22.0 that includes attacker tools such as AdaptixC2, Chisel, BusyBox, and Rclone.BloodHound.pyInstead of using a pre-built toolkit, the attackers manually install and compile their tools, including Impacket, KrbRelayx, Coercer, BloodHound.py, NetExec, Kerbrute, and Metasploit, inside the VM.BusyBoxThe VM runs Alpine Linux version 3.22.0 that includes attacker tools such as AdaptixC2, Chisel, BusyBox, and Rclone.ChiselThe VM runs Alpine Linux version 3.22.0 that includes attacker tools such as AdaptixC2, Chisel, BusyBox, and Rclone.CoercerInstead of using a pre-built toolkit, the attackers manually install and compile their tools, including Impacket, KrbRelayx, Coercer, BloodHound.py, NetExec, Kerbrute, and Metasploit, inside the VM.Havoc“In both instances, the threat actors used the legitimate ADNotificationManager.exe binary to sideload a Havoc C2 payload (vcruntime140_1.dll) and then leveraged Rclone to exfiltrate data to a remote SFTP location” –ImpacketInstead of using a pre-built toolkit, the attackers manually install and compile their tools, including Impacket, KrbRelayx, Coercer, BloodHound.py, NetExec, Kerbrute, and Metasploit, inside the VM.KerbruteInstead of using a pre-built toolkit, the attackers manually install and compile their tools, including Impacket, KrbRelayx, Coercer, BloodHound.py, NetExec, Kerbrute, and Metasploit, inside the VM.KrbRelayxInstead of using a pre-built toolkit, the attackers manually install and compile their tools, including Impacket, KrbRelayx, Coercer, BloodHound.py, NetExec, Kerbrute, and Metasploit, inside the VM.Metasploit FrameworkInstead of using a pre-built toolkit, the attackers manually install and compile their tools, including Impacket, KrbRelayx, Coercer, BloodHound.py, NetExec, Kerbrute, and Metasploit, inside the VM.NetExecInstead of using a pre-built toolkit, the attackers manually install and compile their tools, including Impacket, KrbRelayx, Coercer, BloodHound.py, NetExec, Kerbrute, and Metasploit, inside the VM.RCloneThreat actors harvest credentials, perform Active Directory reconnaissance, and exfiltrate data using Rclone, FTP, and SFTP.