Adversaries Use QEMU VMs to Hide C2 and Evade EDR Detection
NVISO discovered threat actors deploying QEMU virtual machines to run malicious payloads, creating a covert command‑and‑control channel that bypasses traditional AV/EDR defenses. The blog details the QEMU command line, persistence via cron jobs, and offers hunting guidance to spot these hidden VMs.