Ransomware hackers are now running Linux encryptors in Windows to stay undetected

Msn • November 5, 2025

Share: View original

Qilin ransomware uses WSL to run Linux encryptors stealthily on Windows systems; Attackers bypass Windows defenses by executing ELF binaries ...

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Qilin Ransomware Uses WSL to Deploy Linux Encryptors on Windows Systems Qilin ransomware has been identified using Windows Subsystem for Linux (WSL) to execute Linux encryptors on Windows systems. This method allows attackers to bypass traditional Windows defenses by running ELF binaries, making detection more difficult. Organizations using Windows may be at risk of ransomware attacks leveraging this technique. 2 sources 47

Extracted Entities

Attack Types (1)

Platforms (2)

Ransomware Groups (1)

Qilin Ransomware