Enterprise Security Weekly (Audio) Year of the (Clandestine) Linux Desktop, topic, and the news - Rob Allen - ESW #433
10 snips
Nov 17, 2025 
Rob Allen, Chief Product Officer at ThreatLocker, joins to discuss the emerging threat of attackers using tiny Linux VMs on Windows systems to evade detection. He explains how tools like Hyper-V and WSL facilitate this covert technique. With insights on how attackers disable management tools and exploit admin privileges, Rob emphasizes practical mitigations like restricting admin rights. The conversation shifts to the security risks of humanoid robots, highlighting vulnerabilities and the implications for safety and privacy in an increasingly automated world.
AI Snips
Chapters
Transcript
Episode notes
Malvertising Led To Nevada Ransomware
- The Nevada ransomware case began with malvertising that served a malware-laced installer for admin tools.
- AV removed the installer later, but attackers already had persistence and moved on.
WSL Offers Direct Host Access
- WSL is more dangerous than typical VMs because it has bidirectional filesystem access to the Windows host.
- Attackers can run native Linux tooling and easily create reverse shells or data-exfiltration scripts inside WSL.
Use Zero Trust To Limit Lateral Moves
- Apply Zero Trust network segmentation so only approved device groups can reach sensitive services.
- Deny unknown devices (including VMs) from connecting to SMB/SQL to stop remote encryption and lateral moves.