Threat Actors Target Unpatched Linux Server Vulnerabilities With Malware Dubbed PERFCTL

"A Linux malware dubbed ""perfctl"" was identified exploiting over 20000 types of misconfigurations to target Linux servers worldwide. Once compromised the malware remains dormant until the server is idle employing rootkits to conceal its presence and using tactics to persist undetected. It communicates internally via Unix sockets and externally via TOR and it deletes its binaries post-execution to avoid detection. Perfctls attack flow includes exploiting the Polkit vulnerability CVE-2021-4043 and/or RocketMQ vulnerability CVE-2023-33246 for privilege escalation initial access and deploying cryptominers to hijack resources."