When using linked servers, I believe, all processing occurs on the calling server. For processing to occur on the linked server you would use OpenQuery.

Attackers are hacking into poorly secured and Interned-exposed Microsoft SQL (MS-SQL) servers to deploy Trigona ransomware payloads and encrypt all files. The MS-SQL servers are being breached via ...