Mélofée: The latest malware targeting Linux servers

The malware may be linked to another state-sponsored APT group called Earth Berberoka (or GamblingPuppet), which mainly targets gambling websites in China.

ExaTrack, a cybersecurity company based in France, recently discovered the innovative malware it named Mélofée. This malware specifically targets Linux servers and is believed to be operated by an anonymous Chinese state-sponsored APT group.

The researchers have linked this malware to the notorious Winnti group with high confidence. “We linked with high confidence this malware to Chinese state-sponsored APT groups, in particular the notorious Winnti group,” researchers said in a blog post.

Mélofée Malware Activity

The malware’s capabilities include a kernel-mode rootkit, which is based on an open source project called Reptile. The rootkit has limited capabilities as it mainly installs a hook that it has been designed to remain hidden.

This malware by using shell commands, the implant and rootkit can be deployed on a system. This process downloads an installer with a custom binary package from a remote server. This binary package extracts the rootkit and a server implant module, which is currently under active development.

The malware is capable of establishing a connection to a remote server and receiving commands to carry out different operations, launch a shell, create sockets, and execute arbitrary commands.

The company discovered two samples in which one was identified as 20220111 and 20220308 respectively, while the other had an estimated date ranging from April to May 2022.

IOCs

Filenames

• /etc/intel_audio
• /etc/intel_audio/id
• /etc/intel_audio/intel_audio.ko

Follow Us on: Twitter, Instagram, Facebook to get the latest security news!