Loading story…
Kaspersky reported an intrusion at a large enterprise in which attackers repurposed the open-source hypervisor QEMU as a stealthy tunneling tool to move traffic across segmented systems. The operators launched a minimal virtual machine with about 1 MB of RAM, no disk image, and no graphical interface, then used QEMU to create virtual network interfaces and a socket-based network device that forwarded traffic from an internal host to attacker-controlled infrastructure. The tunnel linked a victim system without direct internet access to a pivot host that could reach the internet, and then on to a cloud server hosting a Kali Linux virtual machine.
The activity stood out because defenders more commonly watch for tunneling utilities such as FRP, ngrok, and Cloudflare Tunnel, while QEMU can blend into legitimate virtualization activity and attract less scrutiny. In the same compromise, the attackers also used Angry IP Scanner for internal reconnaissance and mimikatz for credential theft, showing how legitimate administration and offensive tools were combined for lateral movement and persistence. The reporting highlights the need for layered detection across endpoints and networks, including monitoring for unusual QEMU execution, unexpected virtual interfaces, and traffic paths that bridge isolated network segments.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Kaspersky publicly documented the unusual use of QEMU as a stealthy network tunneling tool, explaining how attackers launched a minimal VM to establish covert connectivity while blending in with legitimate virtualization activity. The report highlighted the technique as an alternative to more commonly scrutinized tunneling tools such as FRP, ngrok, and Cloudflare Tunnels.
During a cyberattack against a large company, threat actors abused the open-source hypervisor QEMU to create a covert tunnel between an internal host without internet access, a pivot host with internet access, and an attacker-controlled remote server. The intrusion also involved Angry IP Scanner for reconnaissance and mimikatz for credential theft.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors are increasingly abusing **QEMU** to launch hidden virtual machines on compromised Windows hosts, allowing credential theft, reconnaissance, command-and-control, data staging, and ransomware preparation to occur outside the visibility of many endpoint security tools. Sophos linked one campaign, **STAC4713**, to **GOLD ENCOUNTER** and the **PayoutsKing** ransomware operation, where attackers gained access through exposed SonicWall VPNs without MFA and exploitation of **SolarWinds Web Help Desk** `CVE-2025-26399`, then created a SYSTEM-level scheduled task such as **TPMProfiler** to start `qemu-system-x86_64.exe`, boot a disguised Alpine Linux virtual disk, and establish reverse SSH tunnels for covert access. Researchers said the hidden VM hosted tooling including **AdaptixC2**, **Chisel**, **Rclone**, and **wg-obfuscator**, enabling stealthy persistence and exfiltration while leaving limited forensic evidence on the host. A second campaign, **STAC3725**, exploited **CitrixBleed2** `CVE-2025-5777`, installed a malicious **ScreenConnect** client, created a rogue local administrator account, and used a QEMU-based VM to assemble offensive tooling such as **Impacket**, **BloodHound.py**, **Kerbrute**, **KrbRelayX**, **NetExec**, and **Metasploit** for post-compromise operations. Reporting also noted broader initial-access methods, including phishing and fake Microsoft Teams IT-support lures, and warned that adversaries may shift between QEMU and other virtualization or sideloading techniques while keeping the same objective of stealthy intrusion and ransomware enablement. Defenders were urged to hunt for unauthorized QEMU installations, suspicious SYSTEM scheduled tasks, unusual SSH tunneling or port forwarding, disguised virtual disk images, and related indicators including the domain **vtps.us**, while prioritizing MFA and patching for `CVE-2025-26399` and `CVE-2025-5777`.
Jun 29, 2026
Researchers reported a phishing campaign dubbed **CRON#TRAP** that delivers ZIP archives containing a malicious `.lnk` file and a concealed QEMU package to Windows victims. When opened, the shortcut launches PowerShell to unpack hidden files, execute a renamed QEMU binary as `fontdiag.exe`, and boot a Tiny Core Linux virtual environment stored under `%HOME%\datax`. The lure also displays a fake server-error image to distract users while the emulated system starts, allowing the attackers to stage malware in a way that can evade traditional Windows-focused antivirus detection. Inside the QEMU guest, the attackers configured persistence and command-and-control by running `crondx`, a Go-based ELF binary assessed to be a customized **Chisel** client hard-coded to connect over WebSockets to `18.208.230[.]174`. The Linux environment included prebuilt SSH settings, modified scripts, and aliases such as `get-host-shell` and `get-host-user` to interact with the underlying Windows host, enabling covert access, tunneling, exfiltration, and delivery of additional payloads. Securonix said the activity was not confidently attributed, but telemetry pointed mainly to the US and Europe and highlighted the campaign as an unusual use of QEMU for malware staging beyond earlier cryptomining-related abuse.
Jun 29, 2026
Trend Micro disclosed a previously undocumented Linux implant, **Quasar Linux RAT** (`QLNX`), that targets developer workstations and DevOps environments to steal credentials tied to software supply chains. The malware harvests secrets from assets including **npm**, **PyPI**, **Git**, **AWS**, **Kubernetes**, **Docker**, **Vault**, **Terraform**, **GitHub CLI**, `.env` files, SSH keys, browser data, and even `/etc/shadow`, creating a path to malicious package publication, cloud account compromise, and CI/CD abuse. Researchers said the implant combines backdoor, surveillance, credential theft, and lateral movement features, with a 58-command RAT core supporting shell execution, file management, screenshots, keylogging, clipboard theft, SOCKS proxying, TCP tunneling, and SSH-based movement across environments. The malware was built for stealth and long-term persistence on Linux systems. Trend Micro said `QLNX` runs filelessly from memory, deletes its original binary, wipes logs, spoofs process names as kernel threads, and uses multiple persistence methods including **`LD_PRELOAD`**, **systemd**, **crontab**, **init.d**, **XDG autostart**, and `.bashrc` injection. It also dynamically compiles rootkit and PAM credential-interception components on the victim host using `gcc`, then hides processes, files, and ports through a two-tier design that combines a userland `LD_PRELOAD` rootkit with an **eBPF** kernel component. Command-and-control traffic can flow over raw TCP, custom TLS, HTTP, or HTTPS, and at publication only a small number of security products reportedly detected the malware, while no actor attribution or confirmed intrusions had been publicly disclosed.
Jun 29, 2026