<story><title>Perfctl: Stealthy malware targeting Linux servers</title><url>https://www.aquasec.com/blog/perfctl-a-stealthy-malware-targeting-millions-of-linux-servers/</url></story><parent_chain></parent_chain><comment><author>theamk</author><text>Heh, my work has a firewall policy: any activity towards TOR servers flags an alert and makes security contact you. If you don&amp;#x27;t confirm it was by design, they&amp;#x27;ll start full scale &amp;quot;computer compromised&amp;quot; procedure. (And if you do confirm it it was by design, then they&amp;#x27;ll ask you to change that design if possible :) )&lt;p&gt;I thought it was overly paranoid, but it seems that would have really helped in this case.</text></comment>
<story><title>Perfctl: Stealthy malware targeting Linux servers</title><url>https://www.aquasec.com/blog/perfctl-a-stealthy-malware-targeting-millions-of-linux-servers/</url></story><parent_chain></parent_chain><comment><author>PhilipRoman</author><text>A lot of focus on the malware itself, but not so much on the misconfigurations and vulnerabilities which enable it. Would love to see that list. Other than that, the evasion techniques look pretty traditional.&lt;p&gt;And of course the privilege escalation is done by a polkit vulnerability...</text></comment>