New Mélofée Linux malware linked to Chinese APT groups

Exatrack researchers warn of an unknown China-linked hacking group that has been linked to a new Linux malware, dubbed Mélofée.

Cybersecurity researchers from ExaTrack recently discovered a previously undetected malware family, dubbed Mélofée, targeting Linux servers.

The researchers linked with high-confidence this malware to China-linked APT groups, in particular the Winnti group.

The Mélofée malware includes a kernel-mode rootkit that’s based on an open-source project referred to as Reptile.

The analysis of the vermagic metadata revealed that it is compiled for a kernel version 5.10.112-108.499.amzn2.x86_64. The experts noticed that the rootkit has a limited set of features.

The attackers use shell commands to download the installer and a custom binary package from a remote server and install the implant and the rootkit.

The installer is written in C++, it takes the binary package as an argument and then extracts the rootkit as well as a server implant module.

The researchers noticed that the implant is currently under active development.

The malware configuration is encrypted using the RC4 algorithm in the two early samples, while authors used a simple xor with a single byte key (0x43) in the most recent sample analyzed by the experts.

The configuration format in the first sample contains all elements in encrypted form, while the most recent sample has only the C&C domain encrypted.

The implant supports two mechanisms of persistence, depending on the privileges of his execution. When it runs as the root user, it tries to write a line containing sh -c IMPLANT_EXECUTABLE_NAME >/dev/null 2>& in the files /etc/rc.local or /etc/rc.d/rc.local.

If it runs as a simple user, it will modify the following files:

/home/CURRENT_USERNAME/.bash_profile /home/CURRENT_USERNAME/.bash_login /home/CURRENT_USERNAME/.profile

The rootkit installer will insert the persistence for the kernel module in the /etc/rc.modules file.

The implant supports common backdoor commands, experts noticed the development of the backdoor

Mélofée can execute arbitrary commands, carry out file operations, Kill the current process and removes the persistance, create sockets, and launch a shell.

The researchers linked Mélofée to China-linked APT groups like APT41, and Earth Berberoka.

Below are evidence collected by the researchers that link Mélofée implants to China state-sponsored activity:

Some of the servers were tracked by our Cyber Threat Intelligence as ShadowPad C&C servers; Other servers were linked to both Winnti and HelloBot tools; We also saw related domains used as C&C servers for tools like PlugX, Spark9, Cobalt Strike, StowAway 10, and the legitimate toDesk remote control tool; Lastly, the attacker also probably used the ezXSS 11 tool, but we could not confirm why.

Researchers also pointed out that the HelloBot Linux malware family, linked to Winnti APT group, shared Mélofée infrastructure.

The experts also discovered another malware tracked as AlienReverse, which appears to be similar to Mélofée and includes public tools like tools EarthWorm and socks_proxy.

“The Mélofée implant family is another tool in the arsenal of chinese state sponsored attackers, which show constant innovation and development.” concludes the report.

“The capabilities offered by Mélofée are relatively simple, but may enable adversaries to conduct their attacks under the radar. These implants were not widely seen, showing that the attacker are likely limiting its usage to high value targets.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Mélofée)

---