Malware attacks Windows machines through Windows Subsystem for Linux for the first time
Attackers are possibily testing the waters with new malware, researchers believe
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
Cybersecurityresearchers have chanced upon a novel, and perhaps unique, attack vector to compromiseWindows machines, which involves maliciousLinuxbinaries created for the Windows Subsystem for Linux (WSL).
Sharing detailsabout their find, Black Lotus Labs says it recently identified several malicious files that were written primarily inPythonand compiled in the Linux binary format ELF (Executable and Linkable Format) for the Debian distro.
“While this approach was not particularly sophisticated, the novelty of using an ELF loader designed for the WSL environment gave the technique a detection rate of one or zero in Virus Total, depending on the sample, as of the time of this writing,” share Black Lotus.
We’re looking at how our readers use VPNs with streaming sites like Netflix so we can improve our content and offer better advice. This survey won’t take more than 60 seconds of your time, and we’d hugely appreciate if you’d share your experiences with us.
Click here to start the survey in a new window«
The researchers add that they’ve only identified a limited number of files thus far, which perhaps indicates that either the activity is limited in scope, or more worryingly, is still under development.
Abusing WSL
Black Lotus believes that this is perhaps the first instance of threat actors abusing WSL to sneak malicious payloads into Windows installations.
The researchers first spotted the malicious binaries in early May, and they continued to appear every two to three weeks until August 22.
Analyzing the samples revealed that the Python code acted as a loader and used various Windows APIs to retrieve a remote file and then inject it into a running process.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
Since most endpoint agents designed for Windows systems don’t ship with signatures to analyze ELF files, this attack vector could’ve allowed the threat actors to infect a target without any resistance.
“As the once distinct boundaries betweenoperating systemscontinue to become more nebulous, threat actors will take advantage of new attack surfaces. We advise defenders who’ve enabled WSL ensure proper logging in order to detect this type of tradecraft,” conclude the researchers.
With almost two decades of writing and reporting on Linux, Mayank Sharma would like everyone to think he’sTechRadar Pro’sexpert on the topic. Of course, he’s just as interested in other computing topics, particularly cybersecurity, cloud, containers, and coding.
Cisco issues patch to fix serious flaw allowing possible industrial systems takeover
Washington state court systems taken offline following cyberattack
I’ve used Genmoji and now I’m convinced Apple Intelligence will be a huge success
