CRON#TRAP Uses QEMU-Emulated Linux to Backdoor Windows Hosts

Researchers reported a phishing campaign dubbed CRON#TRAP that delivers ZIP archives containing a malicious .lnk file and a concealed QEMU package to Windows victims. When opened, the shortcut launches PowerShell to unpack hidden files, execute a renamed QEMU binary as fontdiag.exe, and boot a Tiny Core Linux virtual environment stored under %HOME%\datax. The lure also displays a fake server-error image to distract users while the emulated system starts, allowing the attackers to stage malware in a way that can evade traditional Windows-focused antivirus detection.

Inside the QEMU guest, the attackers configured persistence and command-and-control by running crondx, a Go-based ELF binary assessed to be a customized Chisel client hard-coded to connect over WebSockets to 18.208.230[.]174. The Linux environment included prebuilt SSH settings, modified scripts, and aliases such as get-host-shell and get-host-user to interact with the underlying Windows host, enabling covert access, tunneling, exfiltration, and delivery of additional payloads. Securonix said the activity was not confidently attributed, but telemetry pointed mainly to the US and Europe and highlighted the campaign as an unusual use of QEMU for malware staging beyond earlier cryptomining-related abuse.