Loading story…
Researchers reported that the perfctl malware campaign has compromised large numbers of internet-facing Linux servers by exploiting vulnerable or misconfigured systems and then establishing deep persistence. Aqua Security said the malware has operated for several years, using CVE-2023-33246 in Apache RocketMQ for initial access and attempting CVE-2021-4034 in Polkit for privilege escalation. Once deployed, perfctl deletes its original binary, disguises itself as legitimate processes, communicates locally over Unix sockets, and routes external traffic through Tor to reduce detection.
The campaign primarily monetizes access through XMRIG Monero mining, while some infected hosts were also used for proxyjacking via services including Bitping, Earn.fm, Speedshare, and Repocket. Aqua said the malware maintains stealth with LD_PRELOAD rootkits, trojanized userland tools, modified profile scripts, and watchdog components such as wizlmsh, and it even suppresses noisy activity when users log in. Separate reporting on the abuse of Selenium Grid infrastructure for cryptomining and proxyjacking points to a broader trend of attackers repurposing exposed Linux and cloud services for covert resource theft and bandwidth monetization.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
Aqua Nautilus disclosed technical details of perfctl, including observed initial access via CVE-2023-33246 in RocketMQ, attempted privilege escalation via CVE-2021-4034 in Polkit, use of LD_PRELOAD rootkits and trojanized utilities for stealth, and persistence through modified profile scripts and watchdog components. Aqua also reported that all observed attacks deployed an XMRIG-based Monero miner, with some infections additionally running proxy-jacking software tied to Bitping, Earn.fm, Speedshare, and Repocket.
Aqua Nautilus reported that the perfctl malware campaign had been active for roughly 3-4 years, scanning for more than 20,000 types of misconfigurations and exploiting vulnerable or misconfigured internet-facing Linux servers at scale. The researchers assessed that the campaign likely targeted millions of Linux servers worldwide and may have resulted in thousands of victims.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 15 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
AhnLab Security intelligence Center (ASEC) reported an ongoing campaign targeting poorly managed Linux servers, where attackers gain access through SSH brute-force attempts or stolen credentials and then deploy propagation malware to install **XMRig**-based coin miners. Observed through multiple honeypots, the activity uses a multi-stage toolset that includes Go-based downloaders and SSH spreaders, along with malware families such as **ShellBot/PerlBot**, **MIG LogCleaner**, and **XHide** to move laterally, fetch payloads, hide activity, and maintain control of compromised hosts. The miners are disguised as legitimate processes and are installed with multiple persistence mechanisms, including `systemd` services, cron jobs, hidden binary paths, and watchdog functions that restore deleted payloads. ASEC said the propagation malware scans for exposed SSH services, authenticates with credential lists, installs miners on newly compromised systems, and reports results back to attacker infrastructure, assessing that the same threat actor has likely been conducting Linux-focused cryptomining attacks since at least 2023.
Jul 15, 2026
Attackers exploited multiple publicly disclosed **pre-authentication vulnerabilities** in internet-exposed enterprise products to install **Monero-mining malware** on both Windows and Linux systems. Observed targets included **Apache HTTP Server**, **Atlassian Confluence**, **F5 BIG-IP**, **VMware vCenter**, and **Oracle WebLogic Server**, with exploitation attempts seen in the wild through honeypots. The operation abused trusted cloud platforms **GitHub** and **Netlify** to host delivery scripts and miner payloads, helping the malware blend into normal HTTPS traffic before the hosted content was removed. On Windows, the malware used batch scripts to profile infected hosts, download **XMRig** and supporting components, establish persistence, and run the miner as a background service. On Linux, shell scripts killed high-CPU processes, removed competing miners, fetched multiple binaries and configuration files, and launched mining with `nohup`. The campaign highlighted how public proof-of-concept exploits, unpatched exposed servers, and the use of legitimate hosting services combined to sustain large-scale cryptojacking activity.
Aug 14, 2026
Linux-focused cryptocurrency-mining malware has increasingly targeted servers, cloud workloads, and Docker environments, with attackers abusing the platforms’ reliability, prevalence, and processing power to mine privacy-centric coins such as **Monero**. The activity reflects a broader shift in cryptojacking operations toward Linux systems and exposed applications or APIs that can be leveraged to gain unauthorized access and sustain mining activity. Researchers reported that newer Linux cryptominers are not only designed to consume victim resources but also to detect, disable, and remove rival miners already present on compromised machines, effectively turning infected hosts into contested infrastructure. The behavior mirrors tactics seen in earlier malware families including **KORKERDS** and **Skidmap**, underscoring how cryptojacking campaigns have evolved from simple resource theft into more persistent and competitive operations aimed at monopolizing compromised compute capacity.
Aug 14, 2026