Melofee: a look back at a Linux implant and its new variants
Melofee is a Linux malware that steals data, runs hidden commands, and hides itself deep in your system. Attackers can update its features and change how it communicates with their servers.
- Report priority
- Medium
- Targets
- Threat actor: APT41
How it works
- Attackers install Melofee on Linux systems by tricking users into running a malicious file or exploiting a vulnerability.
- Once inside, it uses RC4 encryption to hide its commands and can load different modules to steal files, run programs, or change system settings.
- It also uses fake certificates to trick security tools and can change how it talks to its command servers.
- The malware can hide itself deep in the system's memory, making it hard to detect or remove.
What to do
If you run Linux and recently opened a suspicious file or downloaded software from an untrusted source, check for unusual processes or high memory usage. Look for files named with random or unusual names in your system directories. If you see unexpected files or processes running, stop using the infected system immediately.
Isolate it from your network to prevent further damage. Contact your IT team or a cybersecurity expert to scan and clean the system. Update all Linux software and use trusted antivirus tools to check for malware. If you suspect a breach, report it to your organization's security team or the appropriate authorities.
Technical details
Affected software: Threat actor: APT41
Attackers use fake Symantec certificates to trick security tools and hide Melofee's activity. They can also update the malware's features remotely, allowing it to steal files, run commands, or even hide itself deeper in the system's memory.
Melofee is a Linux implant with roots in 2020 that has since evolved into a modular, stealthy backdoor with advanced persistence and evasion techniques. The malware now supports hot-swappable components for shell access, file manipulation, and arbitrary command execution, while a kernel-level rootkit, derived from the Reptile project, enables deep system infiltration. Communication is encrypted with RC4 and supports TCP, HTTP, HTTPS, and TLS, with observed infrastructure clusters using fraudulent Symantec certificates.
Analysis links its codebase to Windows implants like CrowDoor, Hemigate, and RatelS, indicating shared tooling among Chinese state-affiliated groups. Up to eleven specialized modules can be dynamically loaded via a plugin interface, expanding its operational capabilities.