Loading story…
Researchers linked multiple Linux intrusions to suspected Chinese state-sponsored activity using the open-source Reptile kernel rootkit and a custom implant known as Mélofée. ExaTrack reported that Mélofée targeted Linux servers with capabilities for file and directory operations, shell execution, persistence, and command-and-control over TCP, TLS, and UDP/KCP, while one 2022 sample embedded a kernel-mode rootkit derived from Reptile. The installer deployed components under the disguised path /etc/intel_audio/, loaded the malicious kernel module with insmod, and established persistence through startup files such as /etc/rc.modules, tying the activity to infrastructure and tooling associated with Winnti, ShadowPad, PlugX, Spark, HelloBot, StowAway, and Cobalt Strike.
AhnLab later documented a Korean intrusion that used Reptile in a nearly identical way, including installation under /etc/intel_audio/, manual kernel-module loading instead of the default loader flow, persistence via rc.local, and deployment alongside an ICMP backdoor called ISH. Reptile provides stealth features for files, directories, processes, file contents, and network traffic, and can activate a reverse shell through a Port Knocking mechanism using Magic Packets. The overlap in installation path and deployment method matched patterns previously highlighted by ExaTrack and reinforced assessments that Reptile-derived Linux rootkits were being operationalized in broader Chinese espionage campaigns, including activity Mandiant associated with exploitation of Fortinet zero-days and custom malware.
TTPs, infrastructure, and targeting history in one profile.
6 events from the most recent confirmed update back to the earliest known activity.
AhnLab reported a Korean intrusion case in which Reptile was installed under /etc/intel_audio/ with hard-coded configuration values and persistence via rc.local. The attacker manually loaded the kernel module with insmod instead of using Reptile's standard loader flow, and AhnLab noted similarities to ExaTrack's Mélofée/Winnti-linked activity.
ExaTrack published research on the Mélofée Linux implant and attributed the activity with high confidence to the China-linked Winnti group. The report documented a modified Reptile rootkit installed under /etc/intel_audio/ and loaded directly with insmod.
AhnLab cited Mandiant as confirming that a China-based threat group used the Reptile rootkit in attacks exploiting a Fortinet zero-day vulnerability. This connected the open-source Linux rootkit to real-world espionage operations.
ExaTrack assessed a third Mélofée sample to date from late April or May 2022 and said the related tooling and infrastructure were used by Chinese state-sponsored attackers during at least all of 2022. The activity included deployment under /etc/intel_audio/ and loading a Reptile-derived rootkit with insmod.
ExaTrack identified another Mélofée sample labeled 20220308, showing continued development of the implant's communications, configuration handling, and functionality. The family included a modified Reptile-based rootkit in at least one sample.
ExaTrack reported that one of the three identified Mélofée samples was labeled 20220111, indicating an early 2022 stage of the Linux implant's development. The malware family was linked with high confidence to Chinese state-sponsored activity, particularly the Winnti cluster.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 69 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
asec.ahnlab.com
Open sourceblog.exatrack.com
Open sourcemandiant.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported continued use of the **Rekoobe** Linux backdoor in intrusions tied to China-linked **APT31**, including attacks against Korean organizations and Linux servers. Rekoobe, derived from the open-source Tiny SHell project, has appeared in multiple variants across `x86`, `x64`, and `SPARC` systems and typically provides file upload, file download, and reverse shell access. In one analyzed case, the malware contacted `resolv.ctmailer[.]net:80`, disguised its process name as `/bin/bash`, and protected command-and-control traffic with **AES-128** encryption derived from an **HMAC-SHA1** routine and a hard-coded password. Separate analysis found Rekoobe operating alongside the **Syslogk** Linux kernel rootkit, forming a stealthy persistence and remote access toolkit. Syslogk, based on the open-source **Adore-Ng** rootkit, hides files, processes, and network activity, removes itself from kernel module listings, and can remotely start or stop Rekoobe using specially crafted TCP magic packets. Researchers also observed Rekoobe masquerading as a fake SMTP service and spawning a shell after receiving a specific backdoor command over TLS, reinforcing that the malware remains an active and adaptable threat to poorly maintained or unpatched Linux environments.
Aug 15, 2026
Researchers identified **RedXOR**, a Linux backdoor disguised as a `polkit` daemon, and assessed it was likely operated by a Chinese nation-state actor based on victimology, tactics, and code overlaps with malware associated with the **Winnti** umbrella. The malware targets Linux endpoints and servers, persists through init scripts, and uses the **Adore-ng** LKM rootkit for stealth. It supports host reconnaissance, file manipulation, remote shell access, self-update and uninstall functions, rootkit deployment, and network tunneling through a modified **Rinetd** component. RedXOR communicates with command-and-control infrastructure over TCP traffic made to resemble HTTP and uses XOR-based encoding to obscure data in transit. Researchers reported low antivirus detection and observed sample uploads from **Taiwan** and **Indonesia**, while intermittent command-and-control availability suggested the operation was active during analysis. The activity was framed against broader reporting on Chinese intrusion groups, including archived references to **APT41** and long-running Chinese cyber-espionage operations, reinforcing the assessment that RedXOR fits an established pattern of Linux-focused tooling used in state-linked campaigns.
Aug 15, 2026
Researchers reported a China-linked espionage campaign targeting enterprise edge routers in Southeast Asia with a custom Linux implant called `router.elf`. The malware uses encrypted HTTPS command-and-control over port 443 and Cloudflare DNS over HTTPS to conceal communications, while modifying `iptables` NAT rules to redirect downstream DNS traffic to attacker-controlled resolvers. Analysts said this gives the operators an infrastructure-level foothold for surveillance, traffic interception, and possible manipulation of internal network activity, including software update flows. The operation also appears to extend from compromised routers into Windows environments. Investigators linked the Linux activity to a secondary backdoor, `client_rc_start`, and to a Windows intrusion chain that deploys a Cobalt Strike Beacon through DLL sideloading, using a malicious `version.dll` loaded by `CrashReport.exe`. Shared command-and-control domains, URI patterns, cookie markers, user-agent values, and beacon timing indicate centralized control across the Linux and Windows components, while attribution clues cited in reporting include Mandarin-language strings, a `zh-CN` setting, and tooling overlaps with earlier China-linked operations.
Jun 29, 2026