perfctl campaign targeting Docker API (Campaign)

Attackers are scanning for exposed Docker Remote API servers and creating privileged containers to deploy a new cryptomining malware named "perfctl." Once executed inside containers, perfctl disables security tooling, modifies system configurations to persist, and uses host resources for cryptocurrency mining, degrading performance and posing a security risk to systems with exposed Docker APIs.