TPMProfiler Scheduled Task SSH Reverse Tunnel via QEMU (GOLD ENCOUNTER)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•2

Detects suspicious activities related to the execution of qemu-system-x86_64, including scheduled task creation referencing 'TPMProfiler', execution under the SYSTEM account, and outbound network communication to known malicious IP addresses on specific ports (22, 32567, 22022).