Attackers Turn QEMU Into a Stealth Backdoor for Credential Theft and Ransomware

Sophos analysts report two active campaigns (STAC4713 and STAC3725) that abuse QEMU to run hidden virtual machines under the SYSTEM account to evade endpoint defenses, harvest Active Directory credentials, and stage ransomware—STAC4713 is tied to PayoutsKing/GOLD ENCOUNTER and uses scheduled tasks, disguised virtual disk files, and SSH tunneling, while STAC3725 exploits CitrixBleed2 to install ScreenConnect and compile tools inside a QEMU VM for credential theft and reconnaissance.