CRON#TRAP

CRON#TRAP is a malware campaign identified by Securonix Threat Research in November 2024 that infects Windows systems by deploying a hidden QEMU-based Tiny Core Linux virtual machine containing a preconfigured backdoor for remote access and persistence. The campaign was reportedly delivered via phishing emails, likely survey-themed, that led victims to download a roughly 285 MB ZIP archive containing a malicious .lnk file and a hidden data directory with a full QEMU installation. The shortcut used PowerShell to extract files into %HOMEPATH%\datax and execute start.bat, which displayed a fake server-error image and then silently launched the renamed, legitimately signed QEMU binary (qemu.exe renamed to fontdiag.exe) with the -nographic option so the Linux guest ran in the background.

Inside the guest, the attackers used Tiny Core Linux customized with a PivotBox MOTD and modified shell configuration. The environment included aliases such as get-host-shell and get-host-user intended to interact with the host context, including an SSH-based attempt to spawn an interactive shell on the host using data from /sys/firmware/qemu_fw_cfg/by_name/opt/usercontext/raw and referencing 10.0.2.2 for host-guest communication. Attacker command history preserved in .ash_history showed installation of tools such as vim, file, and openssh; repeated download and execution attempts of a Go-based ELF binary named crondx; persistence changes to /opt/bootlocal.sh; use of filetool.sh -b to preserve Tiny Core changes across reboots; SSH key generation and public-key upload; and handling of additional archives including resolvd.zip and ch.zip.

Securonix assessed /home/tc/crondx, a 64-bit Go ELF, to be a customized Chisel client hard-coded to connect over WebSockets to command-and-control server 18.208.230[.]174. The campaign therefore used protocol tunneling and a Linux guest backdoor to provide stealthy remote access from an infected Windows host. Reported infrastructure and artifacts include 18.208.230[.]174, 192.168.160.143, forum.hestiacp[.]com/uploads/default/original/2X/9/9aae76309a614c85f880512d8fe7df158fec52cc.png, %HOMEPATH%\datax, fontdiag.exe, tc.img, start.bat, and crondx. Securonix stated it could not confidently attribute the campaign to a threat actor, though telemetry suggested activity mainly from the US and Europe, with low-to-medium confidence that North America may have been a primary target. The campaign has been described as a novel persistence and evasion technique using a Linux VM on Windows.