qemu used by attackers forensics - SERP Analysis

https://www.bleepingcomputer.com/news/security/hackers-abuse-qemu-to-covertly-tunnel-network-traffic-in-cyberattacks/

https://thehackernews.com/2024/03/cybercriminals-utilize-qemu-emulator-as.html

https://www.researchgate.net/publication/302246367_Forensic_Analysis_on_QEMU

https://securelist.com/network-tunneling-with-qemu/111803/

https://www.redhat.com/en/blog/hardening-qemu-through-continuous-security-testing

https://www.scworld.com/brief/data-breach-facilitated-by-qemu-emulator

https://www.infosecdefence.com/blogdetails/hackers-exploit-qemu

https://www.enterprisesecuritytech.com/post/how-attackers-are-using-emulated-linux-environments-to-stage-advanced-malware

https://www.securonix.com/blog/crontrap-emulated-linux-environments-as-the-latest-tactic-in-malware-staging/

https://www.linkedin.com/posts/a1l4m_using-emulated-linux-environments-as-an-anti-forensics-activity-7269055028491866112-XTL_

https://inria.hal.science/hal-02534598v1/document

https://www.darkreading.com/cyberattacks-data-breaches/attacker-hides-malicious-activity-emulated-linux-environment

https://qemu-project.gitlab.io/qemu/system/security.html

https://www.picussecurity.com/resource/virtualization/sandbox-evasion-how-attackers-avoid-malware-analysis

https://securityboulevard.com/2024/03/cyberattackers-exploit-qemu-for-stealthy-network-tunneling/

https://www.qemu.org/2018/01/04/spectre/

https://cyberpress.org/hackers-abuse-qemu-hardware/?amp=1

https://tsapps.nist.gov/publication/get_pdf.cfm?pub_id=927335

https://www.diva-portal.org/smash/get/diva2:1230900/FULLTEXT01.pdf

https://www.secpod.com/blog/caution-qemu-users-your-password-file-may-be-open-to-attackers/

https://www.usenix.org/system/files/usenixsecurity24-schwarz.pdf

https://etd.ohiolink.edu/acprod/odb_etd/ws/send_file/send?accession=wright1564840733498961&disposition=inline

https://www.enterprisesecuritytech.com/post/emulators-and-exploits-how-qemu-helped-researchers-uncover-critical-vulnerabilities-in-iot-devices

https://www.qemu.org/contribute/security-process/

https://www.sciencedirect.com/science/article/pii/S2666281723002093

https://www.linkedin.com/pulse/hackers-abuse-qemu-covertly-tunnel-network-traffic-imran-rasheed-yjpqe

https://www.bleepingcomputer.com/news/security/windows-infected-with-backdoored-linux-vms-in-new-phishing-attacks/

https://nsfocusglobal.com/qemu-vm-escape-vulnerability-cve-2020-14364-threat-alert/

https://www.securityweek.com/code-execution-flaw-qemu-mostly-impacts-development-test-vms/

https://cert.bournemouth.ac.uk/qemu-emulator-exploited-as-tunneling-tool-to-breach-company-network/

https://www.lumificyber.com/blog/venom-vulnerability-exposes-most-data-centers-to-cyber-attacks/

https://nvlpubs.nist.gov/nistpubs/ir/2019/NIST.IR.8221.pdf

https://cloud.google.com/blog/products/gcp/7-ways-we-harden-our-kvm-hypervisor-at-google-cloud-security-in-plaintext

https://tr.engineering.dartmouth.edu/reports/tr11-007.pdf

https://my.f5.com/manage/s/article/K04755144

https://gsec.hitb.org/sg2017/sessions/qemu-attack-surface-and-security-internals/

https://www.ibm.com/support/pages/security-bulletin-vulnerabilities-qemu-kvm-affect-ibm-smartcloud-entry

https://docs.openstack.org/security-guide/compute/hardening-the-virtualization-layers.html

https://www.qemu.org/docs/master/devel/multi-process.html

https://www.youtube.com/watch?v=O_NI61ADxjk

https://www.sciencedirect.com/science/article/abs/pii/S0167404820301450

https://citeseerx.ist.psu.edu/document?repid=rep1&type=pdf&doi=1c48d657a0ad2728aa5ce28d4f8ce2b08ccfe502

https://www.openeuler.org/en/blog/lijiajie128/2020-09-01-CVE-2020-14364-QEMU-USB-array-out-of-range.html

https://forum.proxmox.com/threads/qemu-escape-mitigations.98333/

https://vuir.vu.edu.au/38571/1/08382167.pdf

https://news.ycombinator.com/item?id=25797506

https://www.reddit.com/r/techsupport/comments/zgwppz/qemu_installed_on_my_pc_i_have_no_knowledge_of/

https://nsfocusglobal.com/qemu-vm-escape-vulnerability-cve-2019-14378-threat-alert/

https://www.qemu.org/docs/master/system/confidential-guest-support.html

https://www.youtube.com/watch?v=cVOVCAIeeyY

https://www.researchgate.net/figure/AI-speaker-QEMU-emulation-specification_tbl2_346011290

https://www.youtube.com/watch?v=YAdRf_hwxU8

https://www.qemu.org/2018/02/14/qemu-2-11-1-and-spectre-update/

https://www.reddit.com/r/archlinux/comments/payao9/is_qemukvm_safe_and_secure_to_use/

https://news.ycombinator.com/item?id=25797348

https://www.qemu.org/docs/master/system/qemu-block-drivers.html

https://www.youtube.com/watch?v=fcoBt4he8-Y

https://www.linuxquestions.org/questions/linux-newbie-8/kvm-qemu-for-bulletproof-security-and-privacy-4175722980/

https://www.qemu.org/docs/master/about/index.html

https://detection.fyi/sigmahq/sigma/windows/process_creation/proc_creation_win_qemu_suspicious_execution/

https://qemu.readthedocs.io/en/v8.2.8/system/security.html

https://forum.qubes-os.org/t/is-linux-with-qemu-kvm-more-secure-than-qubes-os-on-a-modern-laptop-which-isnt-qubes-certified/32184

https://security.stackexchange.com/questions/90857/how-secure-is-qemu-kvm

https://dfrws.org/wp-content/uploads/2024/03/Hypervisor-based-data-synthesis-On-its-potential-_2024_Forensic-Science-Int.pdf

https://diablohorn.com/2017/12/12/attacking-encrypted-systems-with-qemu-and-volatility/

https://www.eecis.udel.edu/~hnw/paper/icac16.pdf

https://vmsplice.net/~stefan/stefanha-kvm-forum-2018.pdf

https://www.hackingarticles.in/convert-virtual-machine-raw-images-forensics-qemu-img/

https://securityboulevard.com/2024/05/securing-virtual-machines-in-qemu-on-linux/

https://arcpointforensics.medium.com/working-with-virtual-machines-4a8d4f2886d1

https://www.cybersecurity-review.com/network-tunneling-with-qemu/

https://cyberdefenseadvisors.com/qemu-emulator-exploited-as-tunneling-tool-to-breach-company-network/

https://brentk.io/thoughts/qemu-and-kvm/making-sense-of-qemu-cpu-types.html

https://latesthackingnews.com/2019/08/30/vm-escape-vulnerability-discovered-in-qemu-quick-emulator-which-allowed-for-code-execution/

https://qemu.readthedocs.io/en/v9.1.2/system/security.html

https://stack.watch/product/qemu/

https://social.cyware.com/news/hackers-abuse-qemu-to-covertly-tunnel-network-traffic-in-cyberattacks-2bfdc95d

https://news.sophos.com/en-us/2025/05/20/a-familiar-playbook-with-a-twist-3am-ransomware-actors-dropped-virtual-machine-with-vishing-and-quick-assist/

https://libvirt.org/kbase/qemu-passthrough-security.html

https://www.cybersecurity-help.cz/vdb/SB2024042936

https://irjaeh.com/index.php/journal/article/download/65/58

https://www.flyn.org/notes/forensic/

https://thesai.org/Downloads/Volume12No2/Paper_99-Disposable_Virtual_Machines_and_Challenges.pdf

https://www.qemu.org/docs/master/system/qemu-manpage.html

https://www.osti.gov/servlets/purl/1378159

https://www.sisainfosec.com/weekly-threat-watch/windows-systems-compromised-by-backdoored-linux-vms/

https://www.tenable.com/plugins/nessus/201286

https://security.snyk.io/vuln/SNYK-CENTOS9-QEMUKVM-5530058

https://northwave-cybersecurity.com/whitepapers-articles/investigating-a-possible-ivanti-compromise

https://www.group-ib.com/blog/bootkits/

https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=qemu-kvm

https://github.com/mikeroyal/Digital-Forensics-Guide

https://wiki.archlinux.org/title/QEMU

https://news.hitb.org/content/hackers-abuse-qemu-covertly-tunnel-network-traffic-cyberattacks

https://lolcads.github.io/posts/2023/12/bpf_memory_forensics_with_volatility3/

https://www.youtube.com/watch?v=dHZSAiLKvSY

https://www.kicksecure.com/wiki/Anti-Forensics_Precautions

https://i.blackhat.com/asia-20/Thursday/asia-20-Shao-3D-Red-Pill-A-Guest-To-Host-Escape-On-QEMUKVM-Virtio-Device.pdf

https://security-tracker.debian.org/tracker/source-package/qemu

https://www.foi.se/rest-api/report/FOI-R--4576--SE