Researchers recently identified threat actor campaigns leveraging QEMU, a free open-source virtual machine (VM) emulator, to evade endpoint security solutions. Since QEMU acts as a VM within the target environment, endpoint detection tools cannot scan inside the emulator or detect any malicious files or payloads QEMU contains. Although threat actors have been utilizing QEMU maliciously since 2020, recent activity is attributed to the Payouts King ransomware group and a cluster of threat actors believed to be initial access brokers who have also been exploiting the CitrixBleed2 vulnerability CVE-2025-5777.

What’s Notable and Unique

• Payouts King has been observed deploying QEMU since November and uses the VM to create a reverse SSH backdoor to evade detection and install various tools, including Rclone, Chisel, and BusyBox.

• In a separate campaign, threat actors are exploiting CVE-2025-5777, a Citrix NetScaler vulnerability that allows attackers to bypass authentication. Once they’ve gained initial access, the threat actors use QEMU to deploy tools inside the VM, which are then used to steal credentials, identify Kerberos usernames, perform Active Directory reconnaissance, and set up FTP servers for staging or data exfiltration.

Analyst Comments

Threat actors continue to focus their efforts on defense evasion, often leveraging legitimate, easily accessible tools such as QEMU. The continued use of QEMU by multiple threat actors highlights the effectiveness of these tactics and the difficulty in detecting and defending against them. To counter this campaign, organizations should proactively monitor for unauthorized QEMU installations, abnormal scheduled tasks, and port forwarding rules. 

 Sources

• QEMU abused to evade detection and enable ransomware delivery

Microsoft warns that threat actors are increasingly abusing Microsoft Teams and relying on legitimate tools to gain access and conduct lateral movement within enterprise networks. The threat actors impersonate IT or helpdesk staff to contact employees via cross-tenant chats and trick them into granting remote access for data theft. Microsoft has observed multiple intrusions with a similar attack chain that utilized commercial remote management software, like Quick Assist and the Rclone utility, to transfer files to an external cloud storage service. This tactic, notably associated with Black Basta and Cactus ransomware operations in late 2024 and early 2025, appears to have resurfaced, with similar activity more recently observed in intrusions linked to the Akira and Payouts King ransomware groups.

What’s Notable and Unique

• Initial access is achieved by leveraging external collaboration features in Microsoft Teams to allow impersonation of internal support personnel, tricking users into bypassing security warnings. This reflects abuse of legitimate functionality rather than exploitation of a Microsoft Teams vulnerability.

  
  

• Following initial access, attackers conduct rapid reconnaissance using Command Prompt and PowerShell to assess privileges, domain membership, and opportunities for lateral movement. Persistence is maintained through Windows Registry modifications, after which attackers leveraged WinRM for lateral movement, targeting domain-joined systems and high-value assets, including domain controllers.

  
  

• Malicious payloads were staged in user-writable directories and executed through DLL side-loading via trusted, signed applications, enabling covert code execution while blending with legitimate activity. Additional remote management tools were also deployed to support broader access, while Rclone or similar utilities were used to stage and exfiltrate sensitive data to external cloud storage. 

Analyst Comments

This activity highlights how modern threat actors can leverage trusted collaboration workflows, remote management tools, and stealthy exfiltration techniques to conduct intrusions through a combination of social engineering and misuse of legitimate functionality. Effective defense depends on layered mitigations that combine identity controls, restricted remote administration, endpoint hardening, network protections, and user awareness measures to disrupt attacker activity at multiple stages of the intrusion lifecycle. To mitigate the risk of this and similar campaigns, users should treat external Teams contacts as untrusted by default, and administrators should restrict or closely monitor remote assistance tools while limiting WinRM usage to controlled systems. 

Sources

• Cross‑tenant helpdesk impersonation to data exfiltration: A human-operated intrusion playbook

• Microsoft: Teams increasingly abused in helpdesk impersonation attacks

• Payouts King Takes Aim at the Ransomware Throne

“Whaling” has taken on a new meaning with a highly targeted phishing campaign active from November 2025 through March 2026, aimed exclusively at senior executives from more than 20 industries. The campaign, dubbed VENOM, is a phishing-as-a-service (PhaaS) platform that combines advanced evasion capabilities with immediate persistence of targeted executives. The initial phish impersonates an internal SharePoint document notification and uses embedded QR codes to convince victims to shift to unmanaged mobile devices to bypass corporate security controls. VENOM aims to establish persistence immediately by either registering a new MFA device or retaining long-lived refresh tokens, allowing threat actors to maintain access even after password resets or other base-level remediation efforts. 

What’s Notable and Unique

•  This campaign is unique in its targeted nature of the PhaaS platform rather than broad, sweeping attempts. The threat actors behind VENOM create convincing phishing emails that impersonate SharePoint activity using the victim’s own domain, company name, and even fabricated email threads. These convincing social engineering tactics, combined with the specific targeting of executives, make this an effective capability for cybercriminals.

•  VENOM operates as a closed-access system, with full adversarial support, but has no public visibility on the dark web or from security researchers. The service likely operates on an invite-only basis, unlike most PhaaS platforms, which typically seek to have as many paying customers as possible. This, among other items such as the sophisticated evasion techniques, indicates a higher degree of sophistication than most other PhaaS offerings.

• Either through MFA enrollment or Microsoft Device Code abuse, the threat actor forces the victim to aid them in establishing persistence early in the attack lifecycle. These tactics result in either valid tokens or an additional MFA login method controlled by the threat actor, meaning typical password resets alone are not effective against this technique. Administrators would be required to explicitly revoke sessions and token grants to mitigate the threat actors’ persistence.

Analyst Comments

Oftentimes, MFA is viewed as a one-stop shop to cybersecurity, but tactics such as this show how threat actors can bypass MFA, or worse, use it to establish persistence. Ultimately, this campaign highlights how modern attacks increasingly abuse legitimate authentication workflows rather than attempting to defeat them outright. Defenses that rely solely on MFA without other security posturing, such as continuous session monitoring, token revocation, and identity logging, can leave organizations vulnerable. As attackers shift toward token theft and device trust abuse, incident response and identity security strategies must evolve accordingly.

Sources

• Meet VENOM: The PhaaS Platform That Neutralizes MFA

Multiple ransomware operations have recently been observed leveraging the Bring Your Own Vulnerable Driver (BYOVD) technique to disable endpoint security controls prior to ransomware deployment. Notably, the Qilin ransomware group commonly leverages a malicious msimg32.dll file loaded via DLL side-loading, along with vulnerable drivers including rwdrv.sys and hlpdrv.sys, to gain kernel-level access and disable security processes. Similarly, Warlock ransomware has been observed exploiting the vulnerable NSecKrnl.sys driver to bypass security controls. The use of BYOVD has also been observed across ransomware campaigns associated with Akira, INC, Medusa, and other threat actors. 

What’s Notable and Unique 

• The Qilin ransomware group employs a sophisticated multi-stage infection chain, leveraging DLL side-loading (msimg32.dll) to execute malicious payloads directly in memory and evade traditional file-based detection. In DLL side-loading, a threat actor tricks a program into loading a malicious dynamic link library. The malware escalates privileges and uses signed but vulnerable drivers (rwdrv.sys and hlpdrv.sys) to bypass security controls, access system memory, and systematically disable endpoint defenses by terminating security processes and disabling monitoring callbacks at the kernel level. 

• Akira ransomware operators have also exploited the rwdrv.sys and hlpdrv.sys drivers. Additionally, Arete has observed threat actors leveraging multiple other drivers, including the vulnerable TrueSight.sys, to bypass security controls. 

• Meanwhile, Warlock ransomware operators disguised malicious activity by renaming rclone.exe to TrendSecurity.exe to appear legitimate. The file functioned as a loader, exploiting the vulnerable NSecKrnl.sys driver to disable security processes, while Group Policy Objects (GPOs) were leveraged to systematically disable security controls across the environment. 

Analyst Comments 

The BYOVD technique, employed by multiple known ransomware operators, reflects a broader shift toward pre-encryption defense evasion, including suppression of Windows telemetry, removal of monitoring callbacks, and abuse of legitimately signed but vulnerable drivers. This technique enables threat actors to evade detection, maintain persistence for extended periods, and maximize the operational impact of ransomware deployment across compromised environments. Organizations should implement strict driver control policies, such as Microsoft’s Vulnerable Driver Blocklist and application control mechanisms. Additionally, enforcing least privilege access, enabling multi-factor authentication (MFA), maintaining up-to-date patching, and continuously monitoring for anomalous driver and kernel-level activity can further reduce the risk of such attacks. 

Sources 

• Qilin EDR killer infection chain

• Web Shells, Tunnels, and Ransomware: Dissecting a Warlock Attack