Network tunneling with… QEMU?

Kaspersky researchers describe how adversaries abused QEMU virtualization to create a socket-based network tunnel between a compromised internal host and an attacker-controlled server, enabling remote access to otherwise isolated systems (demonstrated by successful RDP to an internal host). The report documents the QEMU command-line options used (-netdev user/socket/hubport, -nographic, -m 1M), analyzes the unencrypted encapsulated traffic and a method to extract tunneled PCAPs (editcap), reproduces the technique in a lab, and notes IDS detection with the signature Backdoor.Agent.QEMU.C&C.