Linux is useful, ubiquitous, and exposed (for criminals).
Linux has built‑in tools that cyber attackers love:
sshnetcatnmapiptables- Python preinstalled
- Bash scripting
They also bask in not having forced updates, or telemetry.
Cyber Criminals can "customize it", run it headless, embed malware into appliances, and make tiny distros for botnets.
Linux users hate to admit Linux’s culture of:
- "Run this random script from GitHub"
- "Disable AppArmor, it’s annoying"
- "Just compile it yourself"
- "Security through obscurity is bad, but also we don’t need antivirus"
- "The AUR/Flakes make Arch/Nix great!"
-making them vulnerable to attackers (ideal and ignorant victims).
Large criminal organizations, drug cartels, trafficking networks, money‑laundering rings have repeatedly been found running self‑hosted Linux email servers, Linux‑based encrypted messaging appliances, custom Linux routers for “dark” networks, Linux‑based VOIP servers. -Traditional criminals using Linux to avoid commercial surveillance.
Extremist groups using Linux for propaganda infrastructure. They weren’t “hackers.” They were using Linux because it’s the default OS for running a website without leaving a corporate trail.
Cults, and extremists have been found hosting internal communication systems, surveillance systems, file servers, and CCTV storage on Linux boxes because it doesn't require licensing and can be locked down or isolated. Btw, the “tech guy” who installs Debian once becomes the sysadmin for life.
Surveillance‑obsessed individuals (Epstein types) use it to control others, hide information, compartmentalize, and avoid commercial footprints. (Even though Epstein proved Windows is sufficiently private)
Financial criminals, fraudsters, and corrupt officials have been caught using Linux encrypted containers, laptops with custom partitions, Tails/Whonix for anonymous communication, and servers for offshore data storage
