Loading malware…
Reptile is an open-source Linux kernel rootkit and backdoor framework, commonly referenced as REPTILE, with mentions of version 1.0. It is used to provide stealth and persistence on compromised Linux systems by loading as a kernel module and hiding attacker activity. Reported capabilities include hiding files, directories, processes, kernel modules, and network connections; hooking kernel functions such as fillonedir, filldir, filldir64, vfs_read, tcp4_seq_show, and inet_ioctl; and supporting user space control through ioctl, including use of the trigger value 0xE0E0E0E in observed variants. Reptile is also described as featuring backdoor capabilities, using inline function patching through a custom framework called KHOOK, and communicating with command-and-control infrastructure over raw TCP with optional TLS encryption.
The malware has been observed both as the original open-source project and in modified derivatives. A Mélofée-linked sample dropped a rootkit based on a modified version of Reptile, compiled for Linux kernel 5.10.112-108.499.amzn2.x86_64, stored at /etc/intel_audio/intel_audio.ko, loaded with insmod, and used to hide names containing intel_audio or rc.modules. Another analyzed Linux backdoor variant, pskt/Melofee, embedded an RC4-encrypted Reptile-derived kernel module named kworkerx targeting RHEL 7.9 kernel 3.10.0; this module hid traffic on port 443 and used inet_ioctl for userland control. Reptile loaders have also been described as directly invoking the init_module syscall with an in-memory decrypted kernel blob, and one report notes a Reptile persistence mechanism via a malicious udev rule under /etc/udev/rules.d/ that executes /lib/udev/reptile when /dev/random is added.
Threat actor associations in the provided content include UNC3886, which has used the publicly available rootkits REPTILE and MEDUSA on targeted systems, including during VMware-focused intrusions and the RedPenguin campaign after exploitation of vCenter and ESXi vulnerabilities. The content also links modified Reptile-based rootkits to Linux server intrusions associated with Mélofée and assessed Chinese state-sponsored activity tied to the Winnti cluster. High-confidence artifacts mentioned in the content include the filenames kworkerx and kmatryoshka, the path /lib/udev/reptile, the ioctl value 0xE0E0E0E, and persistence or staging paths such as /etc/intel_audio/intel_audio.ko and /etc/rc.modules.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Researchers observed the group deploying Linux rootkits, including REPTILE and MEDUSA, after exploiting vCenter and ESXi vulnerabilities.
17 distinct techniques documented for this family, organized by ATT&CK tactic.
The first sample we found dropped a rootkit based on a modified version of the open source projet Reptile.
To avoid scrutiny during process enumeration or system monitoring, rootkits often rename their processes and threads to match benign system components. Common disguises include: kworker, migration, or rcu_sched... sshd, systemd, dbus-daemon, or bash.
The content repeatedly describes malware and threat actors decoding, decrypting, or deobfuscating payloads, strings, configuration data, commands, and C2 traffic prior to execution or use, e.g., 'APT28 macro uses the command certutil -decode to decode contents of a .txt file storing the base64 encoded payload' and 'Action RAT can use Base64 to decode actor-controlled C2 server communications.'
FIN8 has used the Plink utility to tunnel RDP back to C2 infrastructure. REPTILE can use TLS over raw TCP for secure C2.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Linux rootkit used to hide attacker activity, maintain persistence, and support credential theft on compromised systems, including VMware environments.
A Linux rootkit with a custom loader that directly invokes init_module and uses a kmatryoshka chainloader; also discussed for udev-based persistence, port knocking, masquerading via kworker, and indirect execution persistence techniques.
Modern Linux kernel rootkit/backdoor using inline function patching (via KHOOK framework) and a userspace loader; supports stealth and backdoor commands (e.g., signal-triggered actions).
... REPTILE ... (v1.0) ...
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.