Loading story…
Researchers reported a phishing campaign dubbed CRON#TRAP that delivers ZIP archives containing a malicious .lnk file and a concealed QEMU package to Windows victims. When opened, the shortcut launches PowerShell to unpack hidden files, execute a renamed QEMU binary as fontdiag.exe, and boot a Tiny Core Linux virtual environment stored under %HOME%\datax. The lure also displays a fake server-error image to distract users while the emulated system starts, allowing the attackers to stage malware in a way that can evade traditional Windows-focused antivirus detection.
Inside the QEMU guest, the attackers configured persistence and command-and-control by running crondx, a Go-based ELF binary assessed to be a customized Chisel client hard-coded to connect over WebSockets to 18.208.230[.]174. The Linux environment included prebuilt SSH settings, modified scripts, and aliases such as get-host-shell and get-host-user to interact with the underlying Windows host, enabling covert access, tunneling, exfiltration, and delivery of additional payloads. Securonix said the activity was not confidently attributed, but telemetry pointed mainly to the US and Europe and highlighted the campaign as an unusual use of QEMU for malware staging beyond earlier cryptomining-related abuse.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Sophos disclosed two active campaigns, STAC4713 and STAC3725, in which attackers used hidden QEMU virtual machines on Windows to evade endpoint defenses, steal credentials, and conduct reconnaissance. The report linked STAC4713 to PayoutsKing ransomware and said initial access came via exposed VPNs without MFA, SolarWinds Web Help Desk CVE-2025-26399, and CitrixBleed2 exploitation.
Securonix Threat Research published findings on the CRON#TRAP campaign, describing the use of QEMU-emulated Linux environments as a malware staging method and noting likely targeting in the US and Europe. The report said attribution remained unconfirmed and highlighted the novelty of this staging approach outside earlier cryptomining-related abuse.
Within the emulated Tiny Core Linux environment, the attackers established persistence and command-and-control by running a Go-based ELF binary named crondx, assessed as a customized Chisel client. It used encrypted WebSocket communications to connect to C2 infrastructure and enabled host interaction, exfiltration, and additional payload delivery.
In November 2024, attackers conducted a phishing campaign delivering ZIP archives with a malicious .lnk file that unpacked a concealed QEMU installation and booted a Tiny Core Linux environment on victim Windows systems. The technique used renamed legitimate software such as fontdiag.exe and hid artifacts in user directories to evade detection.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
techradar.com
Open sourcesecuronix.com
Open sourcecontagiodump.blogspot.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors are increasingly abusing **QEMU** to launch hidden virtual machines on compromised Windows hosts, allowing credential theft, reconnaissance, command-and-control, data staging, and ransomware preparation to occur outside the visibility of many endpoint security tools. Sophos linked one campaign, **STAC4713**, to **GOLD ENCOUNTER** and the **PayoutsKing** ransomware operation, where attackers gained access through exposed SonicWall VPNs without MFA and exploitation of **SolarWinds Web Help Desk** `CVE-2025-26399`, then created a SYSTEM-level scheduled task such as **TPMProfiler** to start `qemu-system-x86_64.exe`, boot a disguised Alpine Linux virtual disk, and establish reverse SSH tunnels for covert access. Researchers said the hidden VM hosted tooling including **AdaptixC2**, **Chisel**, **Rclone**, and **wg-obfuscator**, enabling stealthy persistence and exfiltration while leaving limited forensic evidence on the host. A second campaign, **STAC3725**, exploited **CitrixBleed2** `CVE-2025-5777`, installed a malicious **ScreenConnect** client, created a rogue local administrator account, and used a QEMU-based VM to assemble offensive tooling such as **Impacket**, **BloodHound.py**, **Kerbrute**, **KrbRelayX**, **NetExec**, and **Metasploit** for post-compromise operations. Reporting also noted broader initial-access methods, including phishing and fake Microsoft Teams IT-support lures, and warned that adversaries may shift between QEMU and other virtualization or sideloading techniques while keeping the same objective of stealthy intrusion and ransomware enablement. Defenders were urged to hunt for unauthorized QEMU installations, suspicious SYSTEM scheduled tasks, unusual SSH tunneling or port forwarding, disguised virtual disk images, and related indicators including the domain **vtps.us**, while prioritizing MFA and patching for `CVE-2025-26399` and `CVE-2025-5777`.
Jun 29, 2026
Researchers reported multiple **Remcos RAT** campaigns using phishing emails and trusted infrastructure to infect victims while evading detection. In one intrusion chain, a ZIP attachment named `MV MERKET COOPER SPECIFICATION.zip` delivered an obfuscated JavaScript file that fetched a PowerShell loader from `almacensantangel[.]com`; the loader then reconstructed and decrypted payloads in memory, including `ALTERNATE.dll` and `Cqeqpvzeia.exe`. The malware injected into the legitimate Microsoft .NET utility `aspnet_compiler.exe`, communicated with `192[.]3[.]27[.]141:8087`, and stored captured keystrokes and other data in `C:\ProgramData\remcos\logs.dat`, leaving few disk artifacts. A separate campaign used phishing emails that linked to a fake Google Drive sharing page hosted through **Google Cloud Storage** and the trusted `googleapis.com` domain, helping the attack bypass email and web filtering. After user interaction, the infection chain used staged JavaScript redirects or downloads, followed by VBScript or PowerShell execution to retrieve the final Remcos payload, which was then injected into a legitimate Windows process through **process hollowing**, persisted via Windows Registry entries, and opened encrypted command-and-control channels. The activity underscores how attackers are combining living-off-the-land techniques, trusted cloud services, obfuscated scripting, and legitimate Windows binaries to deploy Remcos for surveillance and data theft.
Jun 29, 2026
Kaspersky reported an intrusion at a large enterprise in which attackers repurposed the open-source hypervisor **QEMU** as a stealthy tunneling tool to move traffic across segmented systems. The operators launched a minimal virtual machine with about **1 MB of RAM**, no disk image, and no graphical interface, then used QEMU to create virtual network interfaces and a socket-based network device that forwarded traffic from an internal host to attacker-controlled infrastructure. The tunnel linked a victim system without direct internet access to a pivot host that could reach the internet, and then on to a cloud server hosting a Kali Linux virtual machine. The activity stood out because defenders more commonly watch for tunneling utilities such as **FRP**, **ngrok**, and **Cloudflare Tunnel**, while QEMU can blend into legitimate virtualization activity and attract less scrutiny. In the same compromise, the attackers also used **Angry IP Scanner** for internal reconnaissance and **mimikatz** for credential theft, showing how legitimate administration and offensive tools were combined for lateral movement and persistence. The reporting highlights the need for layered detection across endpoints and networks, including monitoring for unusual QEMU execution, unexpected virtual interfaces, and traffic paths that bridge isolated network segments.
Jul 5, 2026