Weaponized Linux virtual machines are used for offensive cybersecurity purposes, such as “penetration testing” or “exploiting vulnerabilities.”
These setups often use the tools and frameworks that are designed for ethical hacking.
Securonix researchers recently detected CRON#TRAP campaign that has been attacking Windows machines with weaponized Linux virtual machines.
Technical analysis
CRON#TRAP is a sophisticated cyber attack campaign that begins with a “phishing email” containing a malicious shortcut (‘.lnk’) file disguised as “OneAmerica Survey.”
When executed, this file launches a “hidden 285MB package” that deploys a legitimate virtualization tool, QEMU (Quick Emulator), which is renamed “fontdiag.exe” to avoid detection.
Build an in-house SOC or outsource SOC-as-a-Service -> Calculate Costs
The attack creates a hidden Linux environment running “Tiny Core Linux,” complete with a pre-configured backdoor that automatically establishes a connection to a “C2” server.
This environment is dubbed “PivotBox” and contains custom commands like “get-host-shell” and “get-host-user” for host-system interaction by using “SSH keys” for persistent access.
The threat actors employed several tools, including vim, openssh, and 7zip, to manipulate the system while maintaining persistence via modified “boot local.sh” scripts and backed-up configurations via “file tool. sh. “
This campaign’s primary targets are “North America” and “Europe.” This is concerning as it uses QEMU and operates within a hidden virtual environment, which makes it extremely difficult for traditional AV solutions to detect.
While the sophisticated infrastructure of the malware contains:-
- Network testing capabilities.
- Payload manipulation through a file called ‘crondx.’
- Data exfiltration channels using free file-sharing services.
This highlights a well-planned multi-stage attack methodology designed for “long-term stealth” and “system compromise.”
The analysis of “crondx” (Chisel) reveals a sophisticated cyber attack component found within the “CRON#TRAP campaign,” where a pre-configured “64-bit ELF” executable serves as a critical backdoor mechanism.
This ELF executable is located at “/home/tc/crondx” in a Linux “QEMU” instance.
While this Golang-compiled binary is mainly engineered to establish “covert communication channels” with a C2 server at IP address “18.208.230[.]174” by using “websocket protocols” for data transmission.
The attack sequence initiates via a phishing email containing a malicious “ZIP” file with a “.lnk” shortcut that triggers a “PowerShell script” to launch an emulated Linux environment via ‘QEMU.’
This effectively helps to evade traditional Windows-based AV detection systems. The threat actors modified the open-source “Chisel tunneling” tool for legitimate “TCP/UDP” tunneling over HTTP with SSH security.
It’s done by hardcoding connection parameters directly into the binary instead of requiring command-line configurations, which helps enhance its “stealth capabilities.”
This customized implementation enables persistent remote access via “encrypted channels,” that allow threat actors to deploy additional payloads to execute commands and exfiltrate data while remaining undetected.
Various persistence mechanisms, such as “modified startup scripts” and “SSH key implementations,” further support the system’s compromise.
Here, custom command aliases like ‘get-host-shell’ and ‘get-host-user’ facilitate direct interaction with the host machine within the isolated QEMU environment.
The “.ash_history” file documents the threat actor’s activities, such as “tool installation,” “system reconnaissance,” and “payload deployment.”
It shows a modular approach to system infiltration that uses legitimate software tools (‘QEMU’ and ‘Chisel’) to maintain persistent access while evading security controls.
Recommendations
Here below we have mentioned all the recommendations:-
- Avoid downloading unsolicited files or attachments.
- Treat external download links as potential threats.
- Monitor common malware staging directories, especially for scripts.
- Watch for legitimate software running from unusual locations.
- Enable robust endpoint logging for better detection.
Run private, Real-time Malware Analysis in both Windows & Linux VMs. Get a 14-day free trial with ANY.RUN!