QEMU Virtualized SSH Backdoor via Scheduled Task

nomit vyas@xoxo

•updated Jun 22, 2026•0•0•6

Detects a specific persistence mechanism where a scheduled task named 'TPMProfiler' is used to run QEMU, establishing an SSH backdoor. This technique was identified by Huntress in post-exploitation activity related to SolarWinds WHD exploitation.