Hackers Abuse QEMU for Defense Evasion (opens in new tab)

Hackers have begun to abuse QEMU to hide malicious activity. Threat actors have increasingly abused the QEMU machine emulator to hide malicious activity and deploy ransomware or remote access tools. Sophos observed campaigns since late 2025 in which attackers used QEMU virtual machines to establish covert reverse SSH tunnels, harvest credentials, and maintain persistence. Initial […] The post Hackers Abuse QEMU for Defense Evasion appeared first on OODAloop.