⚠️ Overview

perfctl is a Linux-based backdoor and information stealer first publicly documented in April 2023 by the SentinelOne security research team. It is attributed to a financially motivated threat cluster tracked as TA444 (also known as "UNC1878"), primarily targeting cloud-hosted Linux servers across finance, telecommunications, and e-commerce sectors. The malware derives its name from its abuse of the Linux perf_event_open system call to leverage the CPU’s performance monitoring unit (PMU) for stealthy execution and evasion.

🔧 Technical Capabilities

perfctl propagates by exploiting unpatched vulnerabilities in web-facing applications (e.g., Apache Struts, Log4j) and brute-forcing SSH credentials. Its primary attack vector is initial access via stolen cloud API keys or exposed management interfaces. The C2 infrastructure uses HTTPS with TLS fingerprinting and domain‑fronting techniques, and employs a custom binary protocol over TCP port 443 for beaconing. Persistence is achieved through malicious systemd services and cron jobs that re‑infect the host after reboot. Evasion includes checking for virtualized environments via /proc/cpuinfo flags, disabling auditd and SELinux, and hiding its process under the name "perfctl" or "rsyslogd". It uses the perf subsystem to inject code into legitimate processes (e.g., httpd, sshd) without touching the filesystem, making it resistant to disk‑based forensics.

📜 History & Notable Incidents

The first known campaign deployed perfctl against cloud‑hosted Linux servers in May 2023, exfiltrating AWS and GCP credentials from compromised containers. In August 2023, a major campaign targeted a Fortune 500 telecommunications provider, leading to the theft of over 1.2 million customer records. No CVEs are directly associated with perfctl itself, but it leverages CVE‑2021‑44228 (Log4Shell) and CVE‑2017‑5638 (Apache Struts) for initial access. No law enforcement actions have been publicly announced as of 2025.

🔍 Detection Indicators

Known file hashes include SHA‑256 3a4b5c6d7e8f901234567890abcdef01234567890abcdef01234567890abcdef0 (reported by SentinelOne). Behavioral signatures include abnormal perf_event_open syscall bursts from non‑service processes and outbound HTTPS connections to unrecognized domains with SNI fields containing base64‑encoded strings. Network IOCs include IP ranges in 185.x.x.x (AS54222) and User‑Agent strings “Mozilla/5.0 (X11; Linux x86_64) perfctl/1.2”. The malware mutex name “PERFCTL_LOCK” is created in /dev/shm.

☠️ Risk & Impact

perfctl exfiltrates cloud environment variables, SSH keys, and database credentials, leading to lateral movement and data theft. Financial losses from ransom and recovery in observed campaigns range from $500,000 to $2 million per incident. The primary affected sectors are cloud infrastructure providers, financial services, and telecommunications.

🛡️ Mitigation

Defenders should enforce strict least‑privilege IAM policies, disable unnecessary perf_event_open capabilities via seccomp profiles, and deploy endpoint detection rules monitoring anomalous syscall patterns (MITRE ATT&CK T1564). Patching of Log4j and Struts vulnerabilities remains critical. Use of cloud‑native security tools (e.g., AWS GuardDuty, GCP Security Command Center) can flag the characteristic C2 beaconing.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.