Linux variant of Qilin Ransomware targets Windows via remote management tools and BYOVD

The Qilin ransomware group has developed a Linux variant that targets Windows systems using remote management tools and BYOVD (Bring Your Own Vulnerable Driver) techniques. This cross-platform approach allows attackers to evade endpoint detection and steal backup credentials while disabling defenses. The group has been active since 2022 and claims over 40 victims monthly, utilizing fake Google CAPTCHA pages to gain initial access and deploying sophisticated methods for credential theft and lateral movement. The report emphasizes the need for enhanced security measures to address these evolving threats.