Linux malware “perfctl” behind years-long cryptomining campaign

Aqua Nautilus researchers describe 'perfctl', a long-running, highly evasive Linux cryptomining malware that exploits misconfigurations and known vulnerabilities (notably CVE-2023-33246 and CVE-2021-4034) to deploy rootkits, replace system utilities, and mine Monero over TOR; the report covers infection vectors, persistence locations, evasion mechanisms, IoCs, detection methods, and remediation recommendations.