Stealthy “perfctl” Malware Exploits Linux Servers for Cryptojacking and Proxyjacking

Perfctl Malware Targets Vulnerable Linux Servers

An ongoing malware campaign is exploiting misconfigured and vulnerable Linux servers, delivering a stealthy malware known as Perfctl. The primary goal of this malware is to install cryptocurrency miners and proxyjacking software. According to Aqua Security researchers Assaf Morag and Idan Revivo, Perfctl is particularly elusive, using advanced techniques to avoid detection and persistently remain in the system.

PwnKit Exploitation for Privilege Escalation

Perfctl malware takes advantage of the Polkit (CVE-2021-4043) vulnerability, commonly referred to as PwnKit, to gain root privileges on the compromised system. Once it escalates privileges, the malware installs a cryptocurrency miner called perfcc. The name “perfctl” is intentionally chosen to resemble legitimate system processes, such as Linux performance monitoring tools, to blend in and evade detection.

Discover your weakest link. Be proactive, not reactive. Cybercriminals need just one flaw to strike.

Attack Chain Involving Apache RocketMQ

The attack chain begins when Perfctl breaches Linux servers by exploiting a vulnerable instance of Apache RocketMQ, a popular messaging platform. The malware then delivers a payload named httpd. Once the malware is executed, it copies itself to a different location, terminates the original process, and deletes the initial binary to cover its tracks.

The entire attack flow

Cryptocurrency Mining and Proxyjacking Techniques

Perfctl engages in cryptocurrency mining and proxyjacking by installing a rootkit to evade detection. It also retrieves and executes proxyjacking software from a remote server. By disguising itself with names that mimic legitimate system processes, Perfctl continues running in the background without raising suspicion. It even stops “noisy” activities when a user logs in, resuming only when the system is idle.

Are u a security researcher? Or a company that writes articles about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing? If you want to express your idea in an article contact us here for a quote: [email protected]

Source: thehackernews.com

Source Link