Security researchers at Aqua Nautilus uncovered “perfctl,” a highly evasive malware strain that has compromised thousands of Linux servers and workstations over a multi-year campaign. Threat actors gain initial execution by scanning for exposed server misconfigurations or weaponizing known remote execution and local privilege escalation vulnerabilities, including CVE-2023-33246 in Apache RocketMQ and CVE-2021-4034 (“PwnKit”) in Polkit. Once privileged access is achieved, a packed ELF payload executes under deceptive names such as httpd before deleting its binary on disk and running purely from memory via unlinked process descriptors.

To maintain covert persistence, perfctl installs a user-mode rootkit via /etc/ld.so.preload using the libgcwrap.so library, hooking standard glibc system calls to conceal malicious processes, network sockets, and file system artifacts from diagnostic utilities like ps, top, and lsof. The malware routes command-and-control communications over Tor and deploys Monero cryptominers and proxy-jacking modules. Evasion routines actively poll active terminal sessions (utmp); upon detecting administrator logins via SSH, perfctl instantly throttles or terminates its resource-heavy processes, resuming execution only when the system is idle.

Why it matters:

• Bullet 1 — Technical & Architecture Risk: By hijacking dynamic library preloading (/etc/ld.so.preload) and hooking userland libc system calls, perfctl effectively blinds native host monitoring and runtime inspection tools, while session-aware throttling conceals high CPU utilization during active administrative investigations.
• Bullet 2 — Strategic & Defender Imperative: Organizations must audit /etc/ld.so.preload and process execution paths for unauthorized shared objects, enforce immutable system configurations, patch exposed services against known RCE vectors, and inspect outbound perimeter traffic for unauthorized Tor circuits.