Hiding in the Shadows Covert Tunnels via QEMU Virtualization

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://trustedsec.com/blog/hiding-in-the-shadows-covert-tunnels-via-qemu-virtualization
• Blog Title: Hiding in the Shadows: Covert Tunnels via QEMU Virtualization
• Suggested Section: generic-hacking/tunneling-and-port-forwarding.md (or create new virtualization-evading-tunnels.md)

🎯 Content Summary

Technical Engagement Summary

Attack Initiation

In this engagement, an attacker initiated a Microsoft Teams vishing call from an external tenant to trick a user into launching Windows Quick Assist (the built-in RDP-based RMM tool) and installing Zoho Meeting.

Remote Payload Deployment

Download and Extraction

Within the remote session, the attacker executed the following commands (captured in ConsoleHost_history.txt):

🔧 Technical Details
Covert VM Deployment via Social Engineering: By combining a Teams vishing call with Quick Assist, the attacker delivered a ZIP containing portable QEMU binaries (`stl.exe`, `tc.exe`) and configuration, avoiding direct malware installation and leveraging built-in RDP for initial foothold.
Automated VM Launch with VBS Scripts: Two VBScript files (`update.vbs`, `##_START_##.vbs`) executed QEMU with precise memory, disk (`tc.qcow2`) and user-mode networking...
🤖 Agent Actions
Added a new “Covert VM-based Tunnels with QEMU” section to tunneling-and-port-forwarding.md, covering:
• Portable QEMU deployment and hostfwd usage

• One-liner execution example for Windows targets

• VBScript stealth launcher sample

• Tiny Core persistence tweaks (bootlocal.sh, filetool.lst)

• Detection-evasion rationale and blue-team hunting tips
Also inserted a dedicated “References” section pointing to the TrustedSec blog.
No other files required updates.
✅ Review Checklist

 Content is technically accurate
 Formatting follows HackTricks style guidelines
 Links and references are working
 Content adds educational value
 No sensitive information is exposed


This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://trustedsec.com/blog/hiding-in-the-shadows-covert-tunnels-via-qemu-virtualization

Content Categories: Based on the analysis, this content was categorized under "generic-hacking/tunneling-and-port-forwarding.md (or create new virtualization-evading-tunnels.md)".

Repository Maintenance:

• MD Files Formatting: 854 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0

[carlospolop]

merge