Malware attacks Windows machines through Windows Subsystem for Linux for the first time

Trojan
(Image credit: wk1003mike / Shutterstock)

Cybersecurity researchers have chanced upon a novel, and perhaps unique, attack vector to compromise Windows machines, which involves malicious Linux binaries created for the Windows Subsystem for Linux (WSL). 

Sharing details about their find, Black Lotus Labs says it recently identified several malicious files that were written primarily in Python and compiled in the Linux binary format ELF (Executable and Linkable Format) for the Debian distro.

“While this approach was not particularly sophisticated, the novelty of using an ELF loader designed for the WSL environment gave the technique a detection rate of one or zero in Virus Total, depending on the sample, as of the time of this writing,” share Black Lotus.

TechRadar needs you!

We're looking at how our readers use VPNs with streaming sites like Netflix so we can improve our content and offer better advice. This survey won't take more than 60 seconds of your time, and we'd hugely appreciate if you'd share your experiences with us.

>> Click here to start the survey in a new window <<

The researchers add that they’ve only identified a limited number of files thus far, which perhaps indicates that either the activity is limited in scope, or more worryingly, is still under development.

Abusing WSL

Black Lotus believes that this is perhaps the first instance of threat actors abusing WSL to sneak malicious payloads into Windows installations.

The researchers first spotted the malicious binaries in early May, and they continued to appear every two to three weeks until August 22. 

Analyzing the samples revealed that the Python code acted as a loader and used various Windows APIs to retrieve a remote file and then inject it into a running process. 

Since most endpoint agents designed for Windows systems don’t ship with signatures to analyze ELF files, this attack vector could’ve allowed the threat actors to infect a target without any resistance. 

“As the once distinct boundaries between operating systems continue to become more nebulous, threat actors will take advantage of new attack surfaces. We advise defenders who’ve enabled WSL ensure proper logging in order to detect this type of tradecraft,” conclude the researchers.

TOPICS
Mayank Sharma

With almost two decades of writing and reporting on Linux, Mayank Sharma would like everyone to think he’s TechRadar Pro’s expert on the topic. Of course, he’s just as interested in other computing topics, particularly cybersecurity, cloud, containers, and coding.

Read more
Close up of the Linux penguin.
A new Linux backdoor is hitting US universities and governments
A digital representation of a lock
Security experts are being targeted with fake malware discoveries
A concept image of someone typing on a computer. A red flashing danger sign is above the keyboard and nymbers and symbols also in glowing red surround it.
Microsoft Teams and other Windows tools hijacked to hack corporate networks
Representational image of a cybercriminal
Microsoft discovers five potentially damaging attacks against its own software
A computer being guarded by cybersecurity.
Huge cyberattack found hitting vulnerable Microsoft-signed legacy drivers to get past security
Mustang Panda
Chinese hackers abuse Microsoft tool to get past antivirus and cause havoc
Latest in Security
URL phishing
HaveIBeenPwned owner suffers phishing attack that stole his Mailchimp mailing list
Ransomware
Cl0p resurgence drives ransomware attacks to new highs in 2025
cybersecurity
Chinese government hackers allegedly spent years undetected in foreign phone networks
Data leak
A major Keenetic router data leak could put a million households at risk
Code Skull
Interpol operation arrests 300 suspects linked to African cybercrime rings
Insecure network with several red platforms connected through glowing data lines and a black hat hacker symbol
Multiple routers hit by new critical severity remote command injection vulnerability, with no fix in sight
Latest in News
Microsoft Surface Laptop and Surface Pro devices on a table.
Hate Windows 11’s search? Microsoft is fixing it with AI, and that almost makes me want to buy a Copilot+ PC
Oura Ring 4
Activity tracking on Oura Ring is about to get a whole lot better, but I've got bad news about your step count
Google Pixel Buds Pro 2
Cleaned your Pixel Buds Pro 2 recently? If not, you might be getting worse sound
Google Maps on a phone being held in someone&#039;s hand
Google Maps is getting two key upgrades, for easier route planning and quicker access to Gemini AI
URL phishing
HaveIBeenPwned owner suffers phishing attack that stole his Mailchimp mailing list
Gemini on a smartphone.
Gemini 2.5 is now available for Advanced users and it seriously improves Google’s AI reasoning