“Essentially invisible:” How hackers 'trojan-horsed' QEMU virtual machines to bypass security and drop ransomware

QEMU abused for malware.

• Hidden virtual machines allow attackers to bypass endpoint security and remain undetected
• Attackers used trusted virtualization tools and built-in software to disguise malicious activity
• Sophos links campaigns using QEMU to ransomware deployment and long-term network access

Attackers are increasingly hiding malicious tools inside virtual machines to slip past security controls.