Perhaps antivirus deployment on Linux is low enough that they simply didn't encounter the Linux version. One fairly telltale thing would be if there were indications of a platform abstraction layer, but the report does not mention anything like that.