Qilin ransomware abuses WSL to run Linux encryptors in Windows

Qilin (formerly Agenda) is a large, active ransomware operation observed deploying Linux ELF encryptors on compromised Windows hosts by enabling or using Windows Subsystem for Linux (WSL) to execute Linux payloads, while using BYOVD, signed vulnerable drivers, DLL sideloading, and remote-access tools to disable security, steal data, and encrypt VMware ESXi VMs; vendors report over 700 victims across 62 countries and ongoing high-volume activity.