CRON#TRAP Campaign Attacking Windows Machine With Weaponized Linux VMs

CRON#TRAP is a sophisticated phishing-led campaign that deploys a concealed QEMU-based Tiny Core Linux VM on compromised Windows machines to evade AV and provide long-term, persistent access; the threat uses a Go-based chisel-like backdoor ('crondx') with a hardcoded C2 (18.208.230.174), custom command aliases for host interaction, and multiple persistence and exfiltration mechanisms, targeting North America and Europe while recommending tighter endpoint logging, cautious handling of unsolicited files, and monitoring of staging directories.