#ParsedReport #CompletenessHigh
10-09-2026

Melofee: a look back at a Linux implant and its new variants

https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/

Report completeness: High

Actors/Campaigns:
Winnti
Ghostemperor

Threats:
Melofee
Crowdoor
Hemigate
Ratels
Reptile
Cobalt_strike_tool
Shadowpad
Plugx_rat
Stowaway_tool
Sparrowdoor
Terndoor
Cshell

Victims:
Linux servers

Geo:
Chinese, China

TTPs:
Tactics: 5
Technics: 0

IOCs:
File: 4
Hash: 9
Domain: 11
IP: 34

Soft:
Linux, crontab, systemd, inux Im

Algorithms:
sha1, rc4

Functions:
flock, uname, ioctl, connect, GetPlgInterface, GetPlugId, WritePlugin, SetBackCall

Win API:
getaddrinfo

YARA: Found
SIGMA: Found