If EDR is so great, why are these attacks still happening?
That is the question many business leaders are asking after researchers uncovered a new ransomware campaign where attackers are hiding malicious tools inside virtual machines to avoid endpoint detection.
This is not a lab experiment. This is happening right now.
And if your organization depends on traditional detection tools alone, this story deserves your attention.
According to BleepingComputer, researchers at Sophos uncovered a campaign tied to the Payouts King ransomware operation where attackers used QEMU to launch hidden virtual machines inside compromised systems.
Why does that matter?
Because many endpoint security tools monitor what happens on the host operating system, but they often have limited visibility into what happens inside a virtual machine.
That creates a blind spot.
Sophos observed attackers launching hidden Alpine Linux virtual machines, creating covert SSH tunnels, harvesting domain credentials, and preparing systems for ransomware deployment. In some cases, the attackers gained initial access through exposed VPN infrastructure and exploited vulnerable internet-facing systems.
This was not smash-and-grab malware.
This was stealthy, patient, and designed to stay invisible.
Modern attackers are no longer trying to "beat" security tools.
They are simply working around them.
Instead of dropping ransomware directly onto a monitored endpoint, they are:
This is what security teams often call living off the land.
And it works.
According to the 2025 Verizon Data Breach Investigations Report, credential abuse accounted for 22 percent of breaches, and vulnerability exploitation accounted for 20 percent. Verizon also found that exploitation of vulnerabilities increased by 34 percent year over year.
Attackers are moving faster, staying quieter, and using legitimate tools against legitimate businesses.
Yes.
That is exactly why this story matters.
EDR is designed around Detect and Respond.
That model assumes:
But what happens when attackers execute outside your visibility?
What happens when they run ransomware infrastructure inside a hidden virtual machine?
What happens when credentials are stolen before alerts ever trigger?
Detection cannot stop what it cannot see.
And ransomware does not wait for your SOC to catch up.
The business impact goes far beyond encrypted files.
A ransomware event can trigger:
Financial damage
The 2025 IBM Cost of a Data Breach Report found the global average breach cost reached $4.44 million. U.S. organizations averaged $10.22 million.
Operational downtime
IBM also reported that nearly all breached organizations experienced operational disruption, with many taking more than 100 days to recover.
Reputation damage
Customers lose confidence when systems go offline or sensitive information is exposed.
Legal and compliance exposure
Regulated industries may face breach notification obligations, audits, fines, and litigation.
Productivity loss
Employees cannot work if endpoints, servers, or cloud resources are unavailable.
This is no longer just an IT issue.
This is a business continuity issue.
Because ransomware operations have evolved.
Attackers now use:
In Verizon's 2025 report, ransomware appeared in 44 percent of breaches.
That means almost half of confirmed breaches now involve ransomware.
Detection alone is fighting yesterday's battle.
Forward-looking organizations are shifting from Detect and Respond to Isolation and Containment.
Why?
Because prevention changes the game.
Instead of waiting to identify malicious behavior after execution, Isolation and Containment focuses on:
This is where solutions like AppGuard fit into the conversation.
AppGuard is a proven endpoint protection solution with a 10-year track record focused on prevention through Isolation and Containment.
That is not about adding more alerts.
That is about removing attacker freedom.
If this attack tells us anything, it is this:
Assume detection will fail.
Business leaders should:
The organizations that recover fastest are usually the ones that planned for detection failure.
Business owners who want to better understand how prevention-first security can stop attacks before damage occurs should talk with CHIPS about how AppGuard can help prevent incidents like this through Isolation and Containment.
Like this article? Please share it with others!