Skip to content

Back to the catalog

The Evolving Linux Threat Landscape
huntress.comarticle

The Evolving Linux Threat Landscape

Huntress's 2026 threat-landscape overview argues Linux is closing the threat gap with Windows, citing rapid mass exploitation of the React2Shell vulnerability (leading to PeerBlight malware and XMRig cryptomining), growing multi-OS ransomware campaigns hitting Windows/Linux/ESXi simultaneously, and WSL as an emerging attack surface for credential theft and Windows Defender Application Control bypass via Linux ELF binaries. It also covers LLM-assisted vulnerability research (CVE-2025-37899 found via OpenAI's o3) and profiles Linux-targeting threat actors including LockBit 5.0, Akira, Qilin, Gunra, BlackCat/ALPHV, Volt Typhoon (KV-botnet), and Lazarus Group.

TL;DR Huntress threat-landscape report on Linux: React2Shell mass exploitation, WSL as a new attack surface, and a rundown of ransomware/nation-state actors now targeting Linux and ESXi.
Open original ↗

Organisations named here

  • ALPHV
  • Shai-Hulud

CVEs named here

  • CVE-2025-37899

Technologies named here

  • Huntress Managed EDR for Linux
  • Linux
  • Windows
  • OpenAI's o3 model
  • Windows Subsystem for Linux
  • VMware ESXi
  • React2Shell
  • npm packages
  • Windows Defender Application Control
  • Network edge devices
  • WSL
  • XMRig
  • npm

Techniques named here

  • Cross-OS/multi-OS ransomware encryption
  • WSL installation post-privilege escalation
  • Credential theft via WSL
  • WDAC bypass via WSL
  • Automated mass exploitation
  • Cryptomining post-exploitation
  • Supply chain compromise via NPM packages
  • Social engineering via fake job interviews
  • LLM-assisted vulnerability research

Threat actors named here

  • Lockbit 5.0
  • Akira
  • Qilin
  • Gunra Ransomware
  • BlackCat
  • Volt Typhoon
  • Lazarus Group
  • PeerBlight
  • XMRig
  • Shai Halud worms
  • KV-botnet
  • Wolfsbane
  • Drovorub

Related in Threat Intel