QEMU Emulator Exploited as Tunneling Tool to Breach Company Network

Kaspersky researchers observed threat actors using the QEMU open-source hardware emulator as a covert tunneling mechanism in an attack against a large unnamed company: attackers created virtual network and socket interfaces with QEMU to tunnel traffic from an internal, internet-restricted host to a pivot host with internet access, which then connected to an attacker-controlled cloud server. This novel use of legitimate software underscores adversaries' growing use of benign tools to blend malicious activity and highlights the need for layered detection beyond endpoint protection.