Hidden VMs: how hackers leverage QEMU to stealthily steal data and spread malware

Collection of mid-April 2026 security incidents and research: Sophos warns attackers are abusing QEMU to run hidden VMs for stealthy malware, data theft and ransomware deployment; Fortinet reports a Nexcorium Mirai variant exploiting TBK DVR flaws and EOL TP-Link routers for DDoS botnets; three Microsoft Defender zero‑days (BlueHammer, RedSun, UnDefend) are being exploited to gain elevated access (two still unpatched); Kyrgyz exchange Grinex halted operations after a $13.7M theft; ZionSiphon malware targets Israeli water systems; CISA added Apache ActiveMQ CVE-2026-34197 (CVSS 8.8) to its KEV;