Attacker Hides Malicious Activity in Emulated Linux Environment

Researchers at Securonix uncovered a novel campaign named CRON#TRAP where attackers deploy a QEMU-emulated Tiny Core Linux VM (PivotBox) via a large phishing ZIP; the VM contains a preconfigured Chisel-based backdoor that automatically connects to a hardcoded U.S. C2, enabling covert reconnaissance, tooling deployment, SSH key-based persistence, and data exfiltration. The report highlights the technique's novelty and stealth, outlines observed commands and behaviors from the emulated environment, and recommends user training, application whitelisting, endpoint monitoring, and detection of unconventional QEMU execution and persistent SSH connections as mitigations.