“When a new user logs into the server, it immediately stops all “noisy” activities, lying dormant until the server is idle again.”
Perfctl has spent three to four years scanning for more than 20,000 types of misconfiguration. It deletes its own binary, hides behind names like perf and sh, swaps in trojaned ldd and lsof, and goes quiet the moment an admin logs in. The payoff for all that tradecraft is a cryptominer. The root exploit it uses, Polkit CVE-2021-4034, is three years old.