Hidden VMs: Attackers' New Stealth Tactic

Attackers are actively employing hidden virtual machines as a sophisticated method to circumvent security measures and maintain undetected access. This technique leverages trusted virtualization software, such as QEMU, to create concealed environments where malicious activities can be executed with significantly reduced visibility to endpoint defenses. This approach has seen a resurgence, with notable campaigns like STAC4713 and STAC3725 identified since late 2025.

In the STAC4713 campaign, attackers established hidden QEMU virtual machines using scheduled tasks, disguising their disk images as legitimate files. These hidden environments facilitated the creation of covert remote access channels, enabling the deployment of tools and the extraction of credentials without triggering alarms. Concurrently, attackers in STAC3725 exploited vulnerabilities like CitrixBleed2 before assembling their attack toolsets within a QEMU virtual machine after gaining initial access.

These evolving tactics, including the compilation of custom toolsets within virtual machines, allow for tailored attacks and a lower detection rate by signature-based defenses. Sophos links these campaigns to activities such as PayoutsKing ransomware deployment, which specifically targets virtualized environments and hypervisors. The growing trend underscores the critical need for advanced endpoint protection, vigilant network monitoring, and prompt patching of vulnerable systems to mitigate these threats.