The Detection & Response Chronicles: Covert Operations Through QEMU

This NVISO report describes how adversaries abused QEMU virtualization to run malicious tooling (Adaptix C2) inside guest VMs and use SSH and QEMU networking features to tunnel C2 traffic and access internal networks while evading host-based detections; the write-up includes command examples, persistence via cron, tunneling configurations, and recommended detection/hunting KQL queries for identifying suspicious QEMU use.