Payouts King ransomware uses QEMU VMs to bypass endpoint security.

Payouts King ransomware uses QEMU VMs to bypass endpoint security.

Information

   QEMU or Quick Emulator is a virtualized computing environment created within a physical computer using QEMU, a software tool capable of both hardware emulation and virtualization. In essence, QEMU allows a system to simulate an entirely separate computer within the same physical device.

   Inside this virtual machine, users can install and run operating systems such as Linux or Windows just as they would on a physical machine. The guest operating system runs independently from the host system, ensuring that processes within the VM do not directly interfere with the main environment.

Incident

  A recent report by BleepingComputer highlights a concerning evolution in ransomware tactics, as the Payouts King group adopts virtualization-based evasion techniques to bypass endpoint security controls. By leveraging the open-source emulator QEMU, attackers deploy hidden virtual machines (VMs) directly on compromised systems, creating an isolated execution environment for malicious operations.

   This approach allows threat actors to run their payloads, command-and-control (C2) communications, and data exfiltration activities entirely within the VM, effectively shielding them from host-based security tools such as EDR and antivirus solutions. Because these defenses typically lack deep visibility into virtualized environments running locally, the attackers can operate with minimal risk of detection over extended periods.

Picture 1 Payouts King ransomware extortion portal.

Incident

  The attack chain often begins with initial access through vulnerabilities in enterprise infrastructure, including VPN appliances and remote management tools, or through social engineering campaigns targeting employees. Once inside, the attackers install QEMU and deploy lightweight Linux-based virtual machines, commonly using Alpine Linux, preloaded with a suite of offensive tools such as tunneling utilities, remote access frameworks, and data harvesting scripts.

  A key component of this technique is the use of reverse SSH tunneling, which enables the VM to establish outbound connections to attacker-controlled servers, allowing remote control without requiring inbound connections that could raise suspicion. Additionally, attackers create scheduled tasks to ensure the VM is executed with SYSTEM-level privileges, maintaining persistence and resilience against system reboots or user intervention.

  Following successful deployment, attackers escalate privileges and access sensitive system data, including credential stores like NTDS.dit and SAM databases. The stolen data is then exfiltrated, after which the ransomware payload is executed to encrypt files using strong cryptographic algorithms such as AES-256 and RSA-4096, culminating in ransom demands.

Recommendation

1. Detect and alert on the installation or execution of virtualization tools like QEMU on endpoints where such tools are not expected.
2. Monitor for unusual outbound connections, especially reverse SSH tunnels or connections to unknown external servers. Analyze anomalies in ports, protocols, and traffic patterns.
3. Monitor for unauthorized scheduled tasks, services, or registry changes that could indicate persistence

The important things is Security systems. We must concern and monitor as usual.
For more information please contact
Email :sales@inetms.co.th
065 149 2822 (Ms.Suphatson )
063 204 4534 (Ms.Atsamaphorn)
065 929 6330 (Ms.Kansinee)
092 257 6902 (Ms.Narusorn)
063 197 7510 (Mr.Yanotai)
065 725 7405 (Ms.Nattharini)
065 725 7405 (Ms.Donraya)

References

• https://www.bleepingcomputer.com/news/security/payouts-king-ransomware-uses-qemu-vms-to-bypass-endpoint-security/
• https://www.sophos.com/en-us/blog/qemu-abused-to-evade-detection-and-enable-ransomware-delivery

Weekly Interesting CVE

Malware News or Campaign IOC/IOA | EN

Ref:https://www.scworld.com/brief/android-banking-trojan-linked-to-forced-labor-scam-compounds