Ooops

The cruder the malware, the better your chances of running successfully in Wine.

Because throwing together some simple executable using inbuild windows functions is much easier than programming something well-build and hidden based on deeper system layers. So your random “I just encrypted all your files because you clicked this .exe, now send me bitcoin to get it back”-bullshit might work well on wine (which is why wine should be run as it’s own user with no priviledges to access anything but your Windows programs).

Also there is no incentive for companies to fix an exploit quickly. They will only release the fix with some scheduled update anyway or else people might notice that there was something worth fixing and that’s bad for your stock price.

Malware for desktop users is the low hanging fruit with little rewards. You just hear about it because it’s so rediculous easy.

The real money is on servers, so that’s were real money/work is invested to develop malware for much higher gains. How successful are they again?