Threats Tagged 'melofee'

Melofee is a Linux implant malware that has evolved over three years to include a modular architecture with hot-loadable components for shell access, file management, and command execution. It incorporates a kernel rootkit based on the Reptile project for enhanced stealth and supports multiple communication protocols with RC4 encryption. The malware uses fake certificates to impersonate trusted entities and is linked by code similarities to Windows implants used by Chinese state-linked groups. Its modular design allows dynamic loading of up to eleven specialized modules via a common plugin interface.