Malware attacks Windows machines through Windows Subsystem for Linux for the first time

Date:
Fri, 17 Sep 2021 11:02:24 +0000

Description:
New malware sneaks past the usual defenses by hiding inside malicious Linux binaries meant for WSL.

FULL STORY ======================================================================

Cybersecurity researchers have chanced upon a novel, and perhaps unique, attack vector to compromise Windows machines , which involves malicious Linux binaries created for the Windows Subsystem for Linux ( WSL ).

Sharing details about their find, Black Lotus Labs says it recently identified several malicious files that were written primarily in Python and compiled in the Linux binary format ELF (Executable and Linkable Format) for the Debian distro.

While this approach was not particularly sophisticated, the novelty of using an ELF loader designed for the WSL environment gave the technique a detection rate of one or zero in Virus Total, depending on the sample, as of the time
of this writing, share Black Lotus. TechRadar needs you!

We're looking at how our readers use VPNs with streaming sites like Netflix
so we can improve our content and offer better advice. This survey won't take more than 60 seconds of your time, and we'd hugely appreciate if you'd share your experiences with us.

Click here to start the survey in a new window << Protect your devices

with these best antivirus software Here's our choice of the best malware removal software on the market These are the best ransomware protection tools

The researchers add that theyve only identified a limited number of files
thus far, which perhaps indicates that either the activity is limited in scope, or more worryingly, is still under development. Abusing WSL

Black Lotus believes that this is perhaps the first instance of threat actors abusing WSL to sneak malicious payloads into Windows installations.

The researchers first spotted the malicious binaries in early May, and they continued to appear every two to three weeks until August 22.

Analyzing the samples revealed that the Python code acted as a loader and
used various Windows APIs to retrieve a remote file and then inject it into a running process.

Since most endpoint agents designed for Windows systems dont ship with signatures to analyze ELF files, this attack vector couldve allowed the
threat actors to infect a target without any resistance.

As the once distinct boundaries between operating systems continue to become more nebulous, threat actors will take advantage of new attack surfaces. We advise defenders whove enabled WSL ensure proper logging in order to detect this type of tradecraft, conclude the researchers. These are the best
endpoint protection tools



======================================================================
Link to news story: https://www.techradar.com/news/in-a-first-malware-attacks-windows-machines-thr ough-windows-subsystem-for-linux/


--- Mystic BBS v1.12 A47 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)