[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fNjg8dadvXZ2XoaumHooUVP6XLhvERWR1gt1l66JAtsU":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"status":18,"created_at":19,"published_at":20,"article":21,"tags":25,"podcasts":38},"2cdb51a3-cfcf-458d-acf6-5a30f0e50d38","payouts-king-ransomware-exploits-virtualization-to-evade-detection","0ab4fce8-cdb3-484f-a47e-85a98fba9e15","Payouts King Ransomware Exploits Virtualization to Evade Detection","The Payouts King ransomware demonstrates sophisticated evasion techniques by running hidden QEMU virtual machines on compromised systems to bypass endpoint security tools. Initial compromise occurred through multiple attack vectors including exposed VPNs, phishing campaigns, and exploitation of the CitrixBleed 2 vulnerability (CVE-2025-5777). This attack highlights the critical importance of timely vulnerability patching and proper configuration of virtualization controls. Organizations must recognize that traditional endpoint security may not detect threats operating within nested virtualization environments.","**Immediate actions:**\n- Patch CVE-2025-5777 (CitrixBleed 2) on all Citrix systems immediately\n- Audit and secure all VPN endpoints with multi-factor authentication\n- Configure endpoint detection tools to monitor virtualization software like QEMU\n\n**Long-term improvements:**\n- Implement application whitelisting to prevent unauthorized virtualization software installation\n- Deploy network segmentation to limit lateral movement from compromised endpoints\n- Establish regular vulnerability scanning for all internet-facing services\n\n**Detection measures:**\n- Monitor for unusual process creation patterns and virtualization software execution\n- Enable logging for scheduled task creation and modification activities\n- Deploy behavioral analysis tools that can detect nested virtualization environments",[12,13,14,15,16,17],"CIS Control 7","CIS Control 11","NIST CM-2","NIST SI-3","NIST AC-6","ISO 27001 A.12.6.1","published","2026-04-18T17:08:25.484164+00:00","2026-04-18T17:08:25.363+00:00",{"id":7,"url":22,"slug":23,"title":24},"https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fpayouts-king-ransomware-uses-qemu-vms-to-bypass-endpoint-security\u002F","payouts-king-ransomware-uses-qemu-vms-to-bypass-endpoint-security-427525","Payouts King ransomware uses QEMU VMs to bypass endpoint security",[26,32],{"id":27,"name":28,"slug":29,"description":30,"color":31},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":33,"name":34,"slug":35,"description":36,"color":37},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",[39],{"id":40,"date":41,"edition":42,"title":43,"audio_url":44},"3b6c1bef-cfaf-4500-a344-40695f5c3032","2026-04-19","morning","ThreatNoir Weekend Brief — April 19","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-04-19\u002Fthreatnoir-morning-brief-2026-04-19.mp3"]