> Similar frameworks targeting Windows servers have flourished for years. They are less common on Linux machines.

That's good for me, as I develop on a Linux laptop but I never really understood why that is the case. I know that most people are on Windows so B2C malware naturally runs on Windows. However basically all the Internet infrastructure is on Linux and B2B malware should have been targeting that since a long time.

Even slightly higher barriers greatly reduces attempts, and the developers have much more practice at it. Rootkits and such for unix/linux have been around forever, but with VMs and containers getting recycled and such and long term expectations around impermanence and thus programmatically recreated and verifiable configurations, it's a lot harder to get something to stick without being found.

On top of that is the user interactivity model and software distribution model. For most non-admins the various protection schemes on Windows are a choice between "use my computer" and "don't use my computer" and thus basically meaningless. Plus there are fewer centrally managed repos because so much Windows software is hostile to being managed that way and large companies all have to build their own, and small organizations generally give up trying. Quick, hands-off integrity checks on linux can happen in the background and generally won't explode things.

Logging is a factor too. Windows logging tends to be "nothing" or "tsunami" with not a lot in between, and when log monitoring solutions charge by volume and analysts have to comb through oceans of noise to identify potentially dangerous activity, the end result is much less effective watchdogs. I've seen a lot of "Windows -> low cost log monitor doing filtering -> high cost log monitor that people actually look at" due to this, which is obviously harder to manage and less effective.

Most of this can be made the case for Windows, of course, but often isn't because getting Windows into a desired state is such a pain in the ass that it trains people into the "don't touch it, it's working!" mindset. Microsoft was making real strides towards this 20 years ago but their current product management has been security counterproductive IMHO. Doing things in the OS that look a lot like malware turns out to not be a good idea.

When we were developing attacks for unix environments it was often easier to go after the application deployment or CI chains than try to root the box unless there was a juicy SSHD or bash or whatever bug, which have been highly publicized are usually rapidly fixed without needing major effort from endpoint managers.

Linux malware looks different usually. This kind of plugin based framework running as its own process is uncommon, but web shells with similar functionality have been around for a while. And bad guys like working in the shell on Linux too, just a simple binary that reads commands from a socket is often all they need, but doesn't make for very fascinating blog posts. Some just install cloudflared, nothing custom needed at all.

I think it's just that there's more bounty on the Windows side: more business users, more credentials to steal, etc.

cloud servers have devs/admins keeping an eye on them

cloud providers monitor internal traffic and can detect a lot of malware activity, so you need stealthier ones