# Thousands of Linux Systems Hit by Stealthy Malware Since 2021! 🔒

**URL:** <https://onehack.st/t/thousands-of-linux-systems-hit-by-stealthy-malware-since-2021/292824>\
**Category:** News & Articles\
**Tags:** hacking, trading\
**Created:** [October 5, 2024, 6:58pm UTC](https://onehack.st/t/thousands-of-linux-systems-hit-by-stealthy-malware-since-2021/292824 "2024-10-05T18:58:22Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![TheJoker](https://onehack.st/user_avatar/onehack.st/thejoker/32/22660_2.png) [@TheJoker](https://onehack.st/u/TheJoker)\
**Post date:** [October 5, 2024, 6:58pm UTC](https://onehack.st/t/thousands-of-linux-systems-hit-by-stealthy-malware-since-2021/292824/1 "2024-10-05T18:58:23Z")

</div>

**Summary:**

1. **Widespread Malware Infection**  
A sophisticated malware called **Perfctl** has infected thousands of Linux systems since 2021, exploiting over **20,000 misconfigurations** and a critical vulnerability in Apache RocketMQ.

2. **Stealth Techniques**  
Perfctl uses advanced methods to evade detection, including installing a **rootkit** and mimicking legitimate process names, making it hard to identify.

3. **Persistence Mechanism**  
The malware can survive system reboots by altering login scripts and copying itself to various disk locations, allowing it to restart even after attempts to remove it.

4. **Malicious Activities**  
Perfctl hijacks infected systems for **cryptocurrency mining** and proxy services, while also acting as a backdoor for further malware installations.

5. **Detection Challenges**  
Despite some antivirus software being able to detect Perfctl, its ability to restart after removal poses significant challenges for system administrators trying to eliminate it.

**Read more at:** [Ars Technica](https://arstechnica.com/security/2024/10/persistent-stealthy-linux-malware-has-infected-thousands-since-2021/)