perfctl Malware Targeting Linux (Campaign)

perfctl is a stealthy Linux malware campaign that exploits misconfigurations and CVE-2021-4043 (Polkit) to escalate privileges, installs rootkits that hook libpcap and PAM to evade logging and monitoring, and uses process masquerading and trojanized system utilities (e.g., ldd, lsof, top) to hide. It deploys cryptominers (XMRIG), performs proxy-jacking, establishes TOR-based backdoors and Unix-socket internal communication, and hides activity by deleting initial binaries and suppressing noisy behavior when users are present, making detection and remediation difficult.