Hidden VMs: how hackers leverage QEMU to stealthily steal data and spread malware

Multiple security developments: attackers increasingly hide malware inside QEMU virtual machines to evade detection and deploy ransomware; a Mirai variant called Nexcorium exploits a TBK DVR flaw (and end-of-life TP‑Link routers) to build IoT botnets for DDoS; three Microsoft Defender zero‑days (BlueHammer, RedSun, UnDefend) are being exploited for privilege escalation, with two still unpatched; Kyrgyz crypto exchange Grinex halted operations after a $13.7M theft it blames on foreign intelligence; a DraftKings credential‑stuffing perpetrator was sentenced to 30 months and ordered to pay ~$1.4M