New Linux Malware ‘Perfctl’ Targets Millions by Mimicking System Files

Aqua Nautilus researchers report on "Perfctl", a stealthy Linux malware campaign that mimics system files and employs rootkits, deceptive filenames, Unix sockets and Tor to evade detection and maintain persistence; it targets misconfigurations (and attempts to abuse CVE-2021-4043) to gain privileges and is primarily used for cryptomining, proxy-jacking and hijacking server resources, potentially affecting thousands to millions of Linux servers. Recommended mitigations include patching, vulnerability assessments, monitoring and endpoint protections.