Loading story…
SpecterOps research highlighted that Windows Subsystem for Linux 2 (WSL2) can be abused as a stealthy execution and persistence layer on Windows endpoints because each WSL2 distribution runs as its own Hyper-V VM with a separate Linux filesystem and processes. Attackers can inject a beacon object file into an installed WSL2 distro to execute arbitrary commands, read files, and pivot into a Linux environment while many endpoint tools primarily observe only a short-lived wsl.exe process on the Windows side. The research also noted that the $WSL share and in-guest activity may not be scanned or instrumented by multiple security products, degrading common alerting rules and enabling longer dwell time and harder incident investigations.
Operationally, this tradecraft allows intruders to run Linux utilities “out of sight” of traditional Windows-focused telemetry, potentially supporting internal reconnaissance, lateral movement, credential access, and data staging from within the WSL2 guest while maintaining access to corporate resources. The reporting recommends expanding defensive coverage to include WSL2 activity monitoring and logging (beyond wsl.exe process starts) to reduce blind spots created by the Windows/Linux boundary and to improve detection of malicious tooling and persistence inside WSL2 distributions.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
The research highlighted that many security tools only capture the initial wsl.exe launch and may not inspect activity inside the Linux guest or the $WSL share. This gap can allow attackers to use Linux tools for credential theft, data staging, and lateral movement while increasing dwell time and complicating incident response.
SpecterOps researchers reported that attackers can abuse Windows Subsystem for Linux 2 as a low-visibility execution environment on Windows systems. They showed that a beacon object file could run arbitrary commands, access files in installed WSL2 distributions, and help intruders evade many Windows-focused security controls.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that **Windows Subsystem for Linux 2 (WSL2)** can be abused to stage malware payloads while evading much of the visibility provided by Windows-native telemetry. Unlike WSL1, which maps Linux activity into the Windows process model, WSL2 runs a full Linux kernel inside a lightweight Hyper-V VM with its own process space, filesystem, and network stack. As a result, network activity initiated inside WSL2 may not appear in Windows tools such as Sysmon, creating a gap for defenders trying to reconstruct attacker behavior. The reporting shows that when a process inside WSL2 writes files into the Windows filesystem through `/mnt/c/`, the resulting activity is attributed on the Windows side to **`DllHost.exe`** via the Plan 9 (`9P`) proxy layer and `vp9fs.dll`, rather than to the originating Linux process. That split obscures the attack chain and turns payload staging into an indirect execution problem, although launching Windows binaries from WSL remains visible because normal Windows processes are created with **`wsl.exe`** as the parent. Defenders were advised to use outcome-based detections, including monitoring for unexpected **`wsl.exe`** execution and suspicious **`DllHost.exe`** creation of executable or script files in user-writable paths such as `Users\Public`, `ProgramData`, and `Windows\Temp`.
Jun 29, 2026
Threat actors are increasingly abusing **QEMU** to launch hidden virtual machines on compromised Windows hosts, allowing credential theft, reconnaissance, command-and-control, data staging, and ransomware preparation to occur outside the visibility of many endpoint security tools. Sophos linked one campaign, **STAC4713**, to **GOLD ENCOUNTER** and the **PayoutsKing** ransomware operation, where attackers gained access through exposed SonicWall VPNs without MFA and exploitation of **SolarWinds Web Help Desk** `CVE-2025-26399`, then created a SYSTEM-level scheduled task such as **TPMProfiler** to start `qemu-system-x86_64.exe`, boot a disguised Alpine Linux virtual disk, and establish reverse SSH tunnels for covert access. Researchers said the hidden VM hosted tooling including **AdaptixC2**, **Chisel**, **Rclone**, and **wg-obfuscator**, enabling stealthy persistence and exfiltration while leaving limited forensic evidence on the host. A second campaign, **STAC3725**, exploited **CitrixBleed2** `CVE-2025-5777`, installed a malicious **ScreenConnect** client, created a rogue local administrator account, and used a QEMU-based VM to assemble offensive tooling such as **Impacket**, **BloodHound.py**, **Kerbrute**, **KrbRelayX**, **NetExec**, and **Metasploit** for post-compromise operations. Reporting also noted broader initial-access methods, including phishing and fake Microsoft Teams IT-support lures, and warned that adversaries may shift between QEMU and other virtualization or sideloading techniques while keeping the same objective of stealthy intrusion and ransomware enablement. Defenders were urged to hunt for unauthorized QEMU installations, suspicious SYSTEM scheduled tasks, unusual SSH tunneling or port forwarding, disguised virtual disk images, and related indicators including the domain **vtps.us**, while prioritizing MFA and patching for `CVE-2025-26399` and `CVE-2025-5777`.
Jun 29, 2026
Cyble Research & Intelligence Labs reported a new **Linux** intrusion chain dubbed **ShadowHS** that uses a highly obfuscated, multi-stage *fileless* loader to decrypt and execute payloads entirely in memory, minimizing disk artifacts and complicating forensic recovery. The loader reconstructs payloads via techniques including high-entropy encrypted blobs, runtime dependency checks, marker/offset manipulation, credential-based **AES** decryption, and `gzip` decompression, then executes from anonymous file descriptors while hiding via process/`argv` spoofing (often masquerading as `python3`). Once established, ShadowHS deploys a weaponized variant of the open-source post-exploitation tool **hackshell**, adapted into an interactive operator-controlled framework. Reported capabilities include host and security-control fingerprinting (including discovery of defensive tools/EDR), credential theft, privilege escalation, lateral movement, and data exfiltration, with an emphasis on stealthy persistence and evasion of endpoint monitoring and network controls.
Jun 29, 2026