Enterprise Security Weekly (Audio) Year of the (Clandestine) Linux Desktop, topic, and the news - Rob Allen - ESW #433
10 snips
Nov 17, 2025 Rob Allen, Chief Product Officer at ThreatLocker, joins to discuss the emerging threat of attackers using tiny Linux VMs on Windows systems to evade detection. He explains how tools like Hyper-V and WSL facilitate this covert technique. With insights on how attackers disable management tools and exploit admin privileges, Rob emphasizes practical mitigations like restricting admin rights. The conversation shifts to the security risks of humanoid robots, highlighting vulnerabilities and the implications for safety and privacy in an increasingly automated world.
AI Snips
Chapters
Transcript
Episode notes
Linux VMs As Stealthy Attack Surfaces
- Attackers run tiny Linux VMs (Hyper-V/WSL) on Windows to hide from host security tools.
- VMs/WSL are often invisible to AV/EDR and let attackers host reverse shells and proxies stealthily.
Malvertising Led To Nevada Ransomware
- The Nevada ransomware case began with malvertising that served a malware-laced installer for admin tools.
- AV removed the installer later, but attackers already had persistence and moved on.
WSL Offers Direct Host Access
- WSL is more dangerous than typical VMs because it has bidirectional filesystem access to the Windows host.
- Attackers can run native Linux tooling and easily create reverse shells or data-exfiltration scripts inside WSL.