Perfctl is a relatively new piece of malware that has quickly demonstrated its ability to infiltrate complex environments, particularly enterprise Linux servers. Over the past three to four years, Perfctl is believed to have targeted millions of Linux servers, exploiting nearly 20,000 vulnerable configurations, such as exposed credentials or poorly secured administration interfaces.
More than just a malicious script, Perfctl stands out for its modular architecture and advanced evasion techniques, making it particularly difficult to detect and neutralize.
Chronological Overview and Victimology of Perfctl
Perfctl was first detected in 2021 during an investigation into unusual behavior observed on enterprise Linux servers. These investigations revealed that the malware used advanced stealth techniques to infiltrate systems and compromise their integrity. Researchers identified its activities after noticing abnormal CPU resource usage, which is often associated with cryptocurrency mining operations such as XMRig.
As for the perpetrators, although their exact identity remains unclear, evidence suggests the involvement of APT (Advanced Persistent Threat) groups affiliated with organized cybercriminals. These groups appear to be motivated by both financial and operational objectives (data exfiltration, sabotage).
- 2022: Perfctl expands its scope of operation by exploiting vulnerabilities, allowing it to gain elevated privileges. It incorporates advanced stealth techniques, such as the use of rootkits, which effectively conceal its malicious activities.
- 2023: Perfctl continues to evolve, exploiting critical vulnerabilities. This ability to quickly exploit recent vulnerabilities demonstrates that its operators are actively monitoring emerging vulnerabilities.
- 2024: Perfctl targets servers exposing unsecured Docker APIs, allowing the deployment of malicious containers. These containers are used to mine cryptocurrencies and establish persistent access points, thereby strengthening its resilience and ability to evade detection.
Perfctl targets sectors where Linux servers play a critical role:
- Cloud service providers that host a large number of Linux servers
- Financial organizations, often chosen for their critical resources
- Critical infrastructure, such as telecommunications, where service disruptions can have massive consequences
Geographically, Perfctl has been observed primarily in North America and Europe, although some campaigns have also targeted regions in Asia where Linux systems are widely used.
Typical Operation of a Perfctl Malware Attack
Initial Exploitation of Vulnerabilities
The Perfctl attack therefore begins byexploiting critical vulnerabilities in Linux systems. These vulnerabilities allow the attacker to gain initial access by bypassing security mechanisms. Perfctl uses specially designed scripts or exploitation tools to identify and exploit these vulnerabilities in the system. Once inside, it escalates its privileges, gaining near-total control over the targeted machine.
The Deployment of Malicious Payloads
After gaining access, Perfctl deploys a series of malicious components. These payloads include rootkits, which modify the system kernel to hide malware-related activities and files. At the same time, Perfctl sets up command-and-control (C2) protocols to enable continuous communication with the attacker’s servers. These communications are often disguised as legitimate network traffic and are encrypted to prevent interception by detection systems.
Persistence and Evasion of Defenses
Perfctl employs several mechanisms to ensure it remains active even after a reboot or attempts to clean the system. It alters critical scripts, creates scheduled tasks, or manipulates system configuration files to restart itself automatically. To evade detection, it disables or bypasses security solutions such as antivirus software and intrusion detection systems (IDS). It uses advanced techniques, such as system call redirection, to hide its malicious processes behind legitimate system processes.
The Execution of Malicious Activities
Once fully installed, Perfctl begins its malicious activities. One of the most common is cryptocurrency mining, in which the malware hijacks the CPU and GPU resources of the infected server to generate profits. At the same time, Perfctl can be used for proxy-jacking, exploiting the victim’s bandwidth to conceal other malicious activities, such as DDoS attacks or the hosting of illegal content. These activities are carried out with minimal visible impact to avoid arousing suspicion.
Cleaning and Stealth
To avoid detection, Perfctl uses advanced cleanup techniques. It deletes event logs, clears temporary files, and modifies file metadata to hide its tracks. It can also temporarily disable system monitoring tools to carry out its operations uninterrupted. These measures ensure maximum stealth, allowing attackers to maintain a prolonged presence on the compromised system.
Diagram of an attack exploiting a vulnerability in Apache RocketMQ, a distributed messaging component, in a Linux environment
Exploiting Linux Vulnerabilities and MITRE ATT&CK Techniques
Exploited Vulnerabilities
The Perfctl malware targets Linux servers by exploiting specific vulnerabilities to compromise systems and maintain a stealthy presence. Among the exploited vulnerabilities, two critical vulnerabilities have been identified:
- CVE-2021-4034: Known as "PwnKit," this vulnerability affects Polkit. Perfctl exploits this vulnerability to escalate its privileges and gain root access on targeted systems.
- CVE-2023-33246: This critical vulnerability affects Apache RocketMQ, a message-queuing system. Perfctl exploits this vulnerability to gain access to vulnerable systems, thereby compromising their security.
MITRE ATT&CK techniques used by Perfctl to compromise Linux systems
- Malicious Capability Development (T1587.001):
Attackers develop malware that includes payloads, backdoors, and command-and-control (C2) protocols to maintain control over compromised machines and evade defenses. - Acquisition of Malware (T1588.001):
Attackers acquire or develop malware—such as payloads, droppers, and backdoors—to support their operations. These tools are used to control systems and carry out post-compromise actions. - User Execution: Malicious File (T1204.002):
Attackers trick users into executing malicious files—often disguised as legitimate documents—in order to compromise systems.
Some measures to protect against Perfctl attacks
To effectively protect yourself against this type of malware, it is recommended that you follow these best practices:
Keep systems up to date: Regularly apply security patches for the operating system and installed software
Configure services correctly: Ensure that exposed services, such as Apache RocketMQ, are properly configured and secured to prevent unauthorized access
Restrict network access: Limit the exposure of critical services to the Internet and segment the network to reduce the risk of intrusion
ITrust offers advanced solutions to strengthen protection against threats such as Perfctl:
- IKare : A vulnerability scanner that continuously assesses infrastructure security by identifying exploitable vulnerabilities
- Reveelium : An AI-powered behavioral analytics platform capable of detecting abnormal behavior and advanced threats—even unknown ones—in real time by analyzing network data streams
- SOC (Security Operations Center) Service : 24/7 monitoring by cybersecurity experts, ensuring rapid detection and an effective response to security incidents.
