Near-'perfctl' Fileless Malware Targets Millions of Linux Servers

Aqua Nautilus analysis reveals 'perfctl' (aka perfcc), a persistent, multipurpose Linux dropper actively compromising Internet-facing servers worldwide to deploy cryptominers, proxyjacking tools, credential-stealing utilities and backdoors. The actor leverages a vast catalogue of misconfiguration checks and known CVEs (including Apache RocketMQ RCE) to gain access, employs user- and kernel-level rootkits, process masquerading, Tor-based command channels and fileless persistence to evade detection, and likely compromised thousands of systems with millions at risk; recommended mitigations include patching, restricting execution on writable dirs, disabling unused services, strict privilege management, network segmentation and runtime protection.