---
title: MSP cybersecurity news digest, November 3, 2025
description: Qilin ransomware abuses Windows Subsystem for Linux to deploy Linux encryptors on Windows, Atroposia malware includes built-in vulnerability scanner for targeted exploitation, and more. Here are the latest threats to MSP security.
canonical_url: https://www.acronis.com/en/tru/posts/msp-cybersecurity-news-digest-november-3-2025/
locale: en
last_updated: 2026-10-27
---

*   [Home](https://www.acronis.com/en/tru/)
*   [Articles](https://www.acronis.com/en/tru/posts/)
*   [Acronis Threat Research Unit](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/)

07 November 2025

# MSP cybersecurity news digest, November 3, 2025

Qilin ransomware abuses Windows Subsystem for Linux to deploy Linux encryptors on Windows, Atroposia malware includes built-in vulnerability scanner for targeted exploitation, and more. Here are the latest threats to MSP security.

Author: **[Acronis Threat Research Unit](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/)**

## PhantomRaven campaign uploads over 100 poisoned libraries infecting developer environments

Researchers identified multiple [malicious npm packages](https://www.bleepingcomputer.com/news/security/malicious-npm-packages-fetch-infostealer-for-windows-linux-macos/) that delivered infostealers targeting Windows, Linux and macOS systems, exfiltrating browser, keyring and CI/CD credentials.

Attackers used typosquatted libraries and obfuscated payloads, with some campaigns (e.g., [PhantomRaven](https://www.bleepingcomputer.com/news/security/phantomraven-attack-floods-npm-with-credential-stealing-packages/)) uploading over 100 packages and infecting tens of thousands of developer environments.

Supply chain abuse of developer ecosystems compromises build pipelines and source-control tokens, enabling large-scale lateral breaches through poisoned dependencies.

## Dentsu subsidiary Merkle reports data breach exposing client and employee information

Global advertising conglomerate Dentsu disclosed that U.S.-based subsidiary Merkle [suffered a cyber incident](https://www.bleepingcomputer.com/news/security/advertising-giant-dentsu-reports-data-breach-at-subsidiary-merkle/) exposing client and employee information, prompting system shutdowns and forensic review.

Exfiltrated data may include personal identifiers, payroll and customer records, impacting marketing workflows and downstream service providers.

This highlights third-party and supply chain exposure risks within data-driven industries handling high volumes of PII.

## Qilin ransomware abuses Windows Subsystem for Linux to deploy Linux encryptors on Windows

The Qilin group [deployed a new technique](https://www.bleepingcomputer.com/news/security/qilin-ransomware-abuses-wsl-to-run-linux-encryptors-in-windows/) leveraging Windows Subsystem for Linux (WSL) to execute ELF-based Linux encryptors on Windows hosts, bypassing many traditional EDR engines.

This cross-platform method allows ransomware to evade Windows-specific detections and encrypt files through Linux binaries.

Organizations running mixed Windows and Linux environments face expanded attack surfaces as threat actors exploit legitimate OS features for persistence.

## Atroposia malware includes built-in vulnerability scanner for targeted exploitation

Security analysts discovered “Atroposia,” a modular malware family with [a local vulnerability-scanning component](https://www.bleepingcomputer.com/news/security/new-atroposia-malware-comes-with-a-local-vulnerability-scanner/) that profiles host weaknesses before exploitation.

The scanner ranks patch gaps and insecure configurations, enabling attackers to prioritize privilege escalation and payload deployment.

Such adaptive targeting reduces noise and improves attack success rates against unpatched enterprise assets.

## SideWinder APT leverages Microsoft ClickOnce installers for South Asian espionage operations

The [SideWinder group](https://www.acronis.com/en/tru/posts/from-banks-to-battalions-sidewinders-attacks-on-south-asias-public-sector/) adopted Microsoft ClickOnce installers delivered through spear-phishing PDF lures to deploy .NET stealer payloads [targeting diplomatic and government entities in South Asia](https://thehackernews.com/2025/10/sidewinder-adopts-new-clickonce-based.html).

The infection chain uses legitimate installer mechanisms to bypass user suspicion and install persistent implants capable of data exfiltration and surveillance.

This campaign illustrates ongoing APT innovation in abusing trusted software distribution features for espionage.

Related articles

[The Gentlemen: A closer look at a not-so-gentle ransomware-as-a- service operation](https://www.acronis.com/en/tru/posts/the-gentlemen-a-closer-look-at-a-not-so-gentle-ransomware-as-a-service-operation/)  
[Acronis AI Copilot: Adoption is high and growing among MSPs](https://www.acronis.com/en/tru/posts/acronis-ai-copilot-adoption-is-high-and-growing-among-msps/)  
[Acronis Cyberthreats Update, October 2026](https://www.acronis.com/en/tru/posts/acronis-cyberthreats-update-october-2026/)  
[AI agents at work: What Acronis endpoint data reveals about MSP and SMB usage](https://www.acronis.com/en/tru/posts/ai-agents-at-work-what-acronis-endpoint-data-reveals-about-msp-and-smb-usage/)