Loading story…
Researchers reported that Windows Subsystem for Linux 2 (WSL2) can be abused to stage malware payloads while evading much of the visibility provided by Windows-native telemetry. Unlike WSL1, which maps Linux activity into the Windows process model, WSL2 runs a full Linux kernel inside a lightweight Hyper-V VM with its own process space, filesystem, and network stack. As a result, network activity initiated inside WSL2 may not appear in Windows tools such as Sysmon, creating a gap for defenders trying to reconstruct attacker behavior.
The reporting shows that when a process inside WSL2 writes files into the Windows filesystem through /mnt/c/, the resulting activity is attributed on the Windows side to DllHost.exe via the Plan 9 (9P) proxy layer and vp9fs.dll, rather than to the originating Linux process. That split obscures the attack chain and turns payload staging into an indirect execution problem, although launching Windows binaries from WSL remains visible because normal Windows processes are created with wsl.exe as the parent. Defenders were advised to use outcome-based detections, including monitoring for unexpected wsl.exe execution and suspicious DllHost.exe creation of executable or script files in user-writable paths such as Users\Public, ProgramData, and Windows\Temp.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
An article described how WSL2 can be abused for payload staging in ways that evade normal Windows-native telemetry, including network activity invisible to Sysmon and Windows file writes attributed to DllHost.exe via the 9P layer. The write-up also discussed defender-visible artifacts and proposed outcome-based detection, including a Sigma rule for suspicious DllHost.exe file creation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SpecterOps research highlighted that **Windows Subsystem for Linux 2 (WSL2)** can be abused as a stealthy execution and persistence layer on Windows endpoints because each WSL2 distribution runs as its own **Hyper-V VM** with a separate Linux filesystem and processes. Attackers can inject a beacon object file into an installed WSL2 distro to execute arbitrary commands, read files, and pivot into a Linux environment while many endpoint tools primarily observe only a short-lived `wsl.exe` process on the Windows side. The research also noted that the `$WSL` share and in-guest activity may not be scanned or instrumented by multiple security products, degrading common alerting rules and enabling longer dwell time and harder incident investigations. Operationally, this tradecraft allows intruders to run Linux utilities “out of sight” of traditional Windows-focused telemetry, potentially supporting internal reconnaissance, lateral movement, credential access, and data staging from within the WSL2 guest while maintaining access to corporate resources. The reporting recommends expanding defensive coverage to include **WSL2 activity monitoring and logging** (beyond `wsl.exe` process starts) to reduce blind spots created by the Windows/Linux boundary and to improve detection of malicious tooling and persistence inside WSL2 distributions.
Jun 29, 2026
Fortinet/FortiGuard researchers reported a **multi-stage Windows malware campaign** that relies on *social engineering rather than exploiting a software vulnerability*, using business-themed lures delivered in compressed archives. The initial file is a **malicious `.LNK` shortcut** crafted to look like a benign document; when opened it launches **PowerShell** with execution-policy bypasses to fetch a first-stage loader from cloud services (notably **GitHub** and **Dropbox**) while displaying decoy content to reduce user suspicion. Reporting indicates the chain includes staged scripts (e.g., obfuscated/encrypted VBScript reconstructed in memory) and “phone-home” signaling (including **Telegram bot** notifications) to confirm execution and continue payload delivery. A key characteristic of the campaign is **systematic defense evasion**, including disabling or neutralizing **Microsoft Defender** and other Windows security controls and impairing recovery options, enabling follow-on actions such as data theft, remote access, and in some cases **file encryption**. Separate reporting in this set describes other, unrelated activity (FortiGate SSO bypass exploitation, a general weekly threat bulletin, Iran/Starlink connectivity issues, a watering-hole targeting EmEditor users, a China-linked espionage campaign targeting India, and generic “common threats” guidance) and does not materially change the technical picture of the FortiGuard-described Windows LNK/PowerShell multi-stage malware chain.
Jun 29, 2026
Multiple Windows-focused malware campaigns were reported leveraging *trusted distribution and execution paths* rather than exploiting software vulnerabilities. One campaign attributed to **Larva-25012** disguised proxyware as legitimate *Notepad++* installers distributed via fake cracked-software portals and deceptive ads, primarily impacting South Korea. The payloads were hosted on GitHub and delivered as MSI/ZIP packages containing legitimate components plus malicious DLLs, using **DLL side-loading** and process injection into **Windows Explorer** to deploy proxyware (e.g., **Infatica** and **DigitalPulse**) for **proxyjacking**—monetizing victims’ internet bandwidth by reselling access through their networks. A separate multi-stage Windows malware operation used business-themed lures and weaponized archives containing **LNK** shortcuts to run hidden **PowerShell** with execution-policy bypass, pulling an obfuscated loader from GitHub and using legitimate services (e.g., **Dropbox**) to blend into normal traffic. Fortinet-reported tradecraft included persistence, decoy document generation, and beaconing via the **Telegram Bot API**, followed by defense evasion through abuse of **Defendnot** to disable Microsoft Defender before dropping follow-on payloads such as ransomware, banking trojans, and surveillance tooling. Additional reporting highlighted a broader trend of attackers abusing legitimate infrastructure and admin tooling (including **RMM** software after credential theft) to establish persistent access, while generic “common threats” content provided no incident-specific intelligence.
Jun 29, 2026