{ "intelligence": { "actors": [], "counts": { "actors": 0, "associated_entity_contexts": 5, "deduplicated_iocs": 52, "direct_entities": 131, "direct_relationships": 720, "invalid_iocs": 0, "iocs": 52, "mentioned": 11, "mitre_associated": 19, "mitre_direct": 0, "targets": 0, "techniques": 0, "unsupported_indicators": 16, "vulnerabilities": 0 }, "coverage": { "associated_repertoire_is_incident_evidence": false, "attribution_policy": "explicit-public-relationships-only", "descriptions_publicly_exported": false, "excluded_context_objects": 1096, "excluded_graph_objects": 1769, "graph_complete": true, "graph_objects": 131, "graph_relationships": 720, "mitre_context_complete": true, "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "status_as_of": "2026-10-10T18:16:56+00:00", "table_preview_limit": 20 }, "direct_entities": [ { "__typename": "IPv4Addr", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:24:04.570Z", "updated_at": "2026-09-26T05:24:42.706Z" }, "description_available": false, "entity_type": "IPv4-Addr", "id": "01333910-071d-4b01-b2f4-28b9cbbcb5f6", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "ipv4-addr--d9143b9b-b803-58cf-b785-254a7d8a88cd", "type": "IPv4Addr" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:25:44.623Z", "updated_at": "2026-09-26T05:25:45.127Z" }, "description_available": false, "entity_type": "StixFile", "id": "016f544e-e59c-4260-b22d-e1c41b3acf25", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "file--13cac8fa-8111-5863-affe-d4a8732272fc", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "IPv4-Addr", "x_opencti_score": 20 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.030Z", "created_at": "2026-09-26T05:26:29.279Z", "modified": "2026-10-01T03:52:29.405Z", "updated_at": "2026-10-01T03:52:29.405Z" }, "description_available": false, "entity_type": "Indicator", "id": "01c74684-bdd9-45d1-84be-d24d189bcb28", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "indicator--73226059-5d78-5be0-badf-089bd12a4ccd", "type": "Indicator" }, { "__typename": "IPv4Addr", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:25:40.511Z", "updated_at": "2026-09-26T05:26:12.324Z" }, "description_available": false, "entity_type": "IPv4-Addr", "id": "057c7c24-a4a7-4440-b9e0-342673290da3", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "ipv4-addr--2db94096-d929-57cc-8a49-1778d09d6bce", "type": "IPv4Addr" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "IPv4-Addr", "x_opencti_score": 20 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.205Z", "created_at": "2026-09-26T05:26:56.724Z", "modified": "2026-10-01T03:52:31.851Z", "updated_at": "2026-10-01T03:52:31.851Z" }, "description_available": false, "entity_type": "Indicator", "id": "09acd2d3-2afb-4de1-a147-7ae7904d3859", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "indicator--9f70cadb-3538-506b-baa8-62b832130b20", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:26:12.194Z", "updated_at": "2026-09-26T05:26:12.534Z" }, "description_available": false, "entity_type": "StixFile", "id": "0b49f882-3713-40dc-957f-7e6435f89a00", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "file--43c5dd75-44bf-574b-96ab-5f31099c4be2", "type": "StixFile" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:26:12.670Z", "updated_at": "2026-09-26T05:26:12.977Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "0c77a85a-303f-453d-92ba-020828262896", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "domain-name--1805f939-c531-513d-bd9d-3b2670de60ea", "type": "DomainName" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "IPv4-Addr", "x_opencti_score": 20 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.039Z", "created_at": "2026-09-26T05:26:32.258Z", "modified": "2026-10-01T03:52:29.242Z", "updated_at": "2026-10-01T03:52:29.242Z" }, "description_available": false, "entity_type": "Indicator", "id": "0eb188e3-885e-4084-abdf-6d4ba0098e64", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "indicator--72aede0f-0de7-5823-a370-9d85e5f1104e", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.088Z", "created_at": "2026-09-26T05:26:47.134Z", "modified": "2026-09-26T05:28:01.308Z", "updated_at": "2026-09-26T05:28:01.308Z" }, "description_available": false, "entity_type": "Indicator", "id": "10b221ff-1d17-4b38-ae27-73235f136031", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "indicator--f482b30d-f031-50f8-b235-677c69ce515b", "type": "Indicator" }, { "__typename": "IPv4Addr", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:25:59.640Z", "updated_at": "2026-09-26T05:26:36.322Z" }, "description_available": false, "entity_type": "IPv4-Addr", "id": "127cff7a-eff6-40a6-a2f5-c5160ba6006e", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "ipv4-addr--455daeaf-6eb3-5949-a0b1-0172d643a21e", "type": "IPv4Addr" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.100Z", "created_at": "2026-09-26T05:26:50.167Z", "modified": "2026-09-26T05:28:23.635Z", "updated_at": "2026-09-26T05:28:23.635Z" }, "description_available": false, "entity_type": "Indicator", "id": "1315ce2a-6659-4f4f-b9b7-e2450564ca9b", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "indicator--a3140529-45c7-5481-a25f-7c71f9c30829", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.061Z", "created_at": "2026-09-26T05:26:40.519Z", "modified": "2026-09-26T05:27:43.271Z", "updated_at": "2026-09-26T05:27:43.271Z" }, "description_available": false, "entity_type": "Indicator", "id": "157ca5cb-7d34-4fc3-83d2-bac13ceb9804", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "indicator--a08cf744-0458-5d9d-adab-27ca40a660f9", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.075Z", "created_at": "2026-09-26T05:26:43.219Z", "modified": "2026-09-26T05:27:54.444Z", "updated_at": "2026-09-26T05:27:54.444Z" }, "description_available": false, "entity_type": "Indicator", "id": "1a15e67e-da7b-42ec-b24a-d47fd8aa0767", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "indicator--ba3d6992-32c9-532f-a3d5-ec7a03754ecf", "type": "Indicator" }, { "__typename": "IPv4Addr", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:25:32.528Z", "updated_at": "2026-09-26T05:26:00.270Z" }, "description_available": false, "entity_type": "IPv4-Addr", "id": "2055a094-ceaf-4dfb-aba7-f26e1663bc4a", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "ipv4-addr--4cdd4234-d036-5da2-b0d7-0c01b646cdc2", "type": "IPv4Addr" }, { "__typename": "Malware", "aliases": [ "win.hemigate" ], "attributes": { "is_family": true }, "authorized_members": [], "confidence": 50, "created_by": { "authorized_members": [], "id": "1b7caa41-88e1-4a38-8cfc-62b85639333a", "is_inferred": false, "name": "Malpedia", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2026-01-18T18:52:55.727Z", "created_at": "2026-01-18T22:41:11.973Z", "first_seen": "1970-01-01T00:00:00.000Z", "last_seen": "5138-11-16T09:46:40.000Z", "modified": "2026-09-29T02:50:51.946Z", "updated_at": "2026-09-29T02:50:51.946Z" }, "description_available": true, "entity_type": "Malware", "id": "208a45aa-c18e-4619-9a90-7004849cab40", "is_inferred": false, "labels": [], "lang": "en", "name": "HemiGate", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": null, "id": "81141a6c-2a6a-4813-83a5-d413c6b719ae", "source_name": "malpedia", "url": "https://jsac.jpcert.or.jp/archive/2024/pdf/JSAC2024_1_7_hara_nakajima_kawakami_en.pdf" }, { "external_id": null, "id": "c73485dc-c67a-4f50-94ec-830b0e96ab4f", "source_name": "malpedia", "url": "https://jsac.jpcert.or.jp/archive/2025/pdf/JSAC2025_1_5_leon-chang_theo-chen_en.pdf" }, { "external_id": null, "id": "ee6c3dcb-d9ac-4a42-94a8-d415ba46c61b", "source_name": "malpedia", "url": "https://malpedia.caad.fkie.fraunhofer.de/details/win.hemigate" }, { "external_id": null, "id": "fc9ecf70-5699-4043-8799-ca158be1e762", "source_name": "malpedia", "url": "https://www.trendmicro.com/en_us/research/23/h/earth-estries-targets-government-tech-for-cyberespionage.html" } ], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "malware--4ef125d9-2683-5796-9c40-eeb6c1d339ef", "type": "Malware" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Hostname", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.016Z", "created_at": "2026-09-26T05:26:19.069Z", "modified": "2026-09-26T05:26:56.444Z", "updated_at": "2026-09-26T05:26:56.444Z" }, "description_available": false, "entity_type": "Indicator", "id": "20bc512e-2f63-438d-bcee-abdf39614bf5", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "indicator--ca0d81a1-33e1-5e9c-9efc-ea5554f598d0", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.085Z", "created_at": "2026-09-26T05:26:47.126Z", "modified": "2026-09-26T05:28:03.948Z", "updated_at": "2026-09-26T05:28:03.948Z" }, "description_available": false, "entity_type": "Indicator", "id": "2227cc4b-afc7-4060-b897-a1a458d90abd", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "indicator--df54a279-556a-5021-b620-56ae46b9bb3f", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.104Z", "created_at": "2026-09-26T05:26:50.315Z", "modified": "2026-09-26T05:28:27.194Z", "updated_at": "2026-09-26T05:28:27.194Z" }, "description_available": false, "entity_type": "Indicator", "id": "2497f466-fac3-4bfc-ab1f-5ebcf363283b", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "indicator--2057816d-dc61-577a-a042-73b21038f621", "type": "Indicator" }, { "__typename": "Url", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:26:10.546Z", "updated_at": "2026-09-26T05:26:11.872Z" }, "description_available": false, "entity_type": "Url", "id": "2664d5d7-e095-48a9-8b0a-4bbf509e3cdc", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "url--561beff8-ae08-5ef6-aa83-e2622c5824eb", "type": "Url" }, { "__typename": "Hostname", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:24:17.906Z", "updated_at": "2026-09-26T05:24:25.557Z" }, "description_available": false, "entity_type": "Hostname", "id": "26ce54a1-f3a1-4886-afcd-344e44e6354b", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "hostname--a98c4130-12a4-53e1-b58c-d3eac4e0c1ec", "type": "Hostname" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "IPv4-Addr", "x_opencti_score": 20 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.109Z", "created_at": "2026-09-26T05:26:51.551Z", "modified": "2026-10-01T03:52:32.392Z", "updated_at": "2026-10-01T03:52:32.392Z" }, "description_available": false, "entity_type": "Indicator", "id": "26da206d-5fde-40ba-bc45-0f24f378263c", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "indicator--ad6e49c8-23d2-5b0a-8acc-2516c7074fa1", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:25:44.419Z", "updated_at": "2026-09-26T05:25:44.951Z" }, "description_available": false, "entity_type": "StixFile", "id": "27bf2255-9252-4604-8c7c-83202fb44fb9", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "file--3a525eeb-5a31-5e68-886e-2ea8ec3ad49a", "type": "StixFile" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:24:29.467Z", "updated_at": "2026-09-26T05:24:34.827Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "2946350a-219e-4fc3-a946-0b21873bc1b2", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "domain-name--a7d3297c-a495-52d8-8320-585f72989c0c", "type": "DomainName" }, { "__typename": "IPv4Addr", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:25:55.775Z", "updated_at": "2026-09-26T05:26:22.777Z" }, "description_available": false, "entity_type": "IPv4-Addr", "id": "2a32de1d-3c80-424d-91d9-77dd6be4c048", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "ipv4-addr--cae724a5-1bd0-5db5-bf82-c469fee29684", "type": "IPv4Addr" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "IPv4-Addr", "x_opencti_score": 20 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.208Z", "created_at": "2026-09-26T05:26:56.833Z", "modified": "2026-10-01T03:52:31.250Z", "updated_at": "2026-10-01T03:52:31.250Z" }, "description_available": false, "entity_type": "Indicator", "id": "2c0b3e29-5bb5-4044-8031-4f47cd51a008", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "indicator--900f441e-f95b-59d8-8d90-c6371b5808e5", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Url", "x_opencti_score": 20 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.219Z", "created_at": "2026-09-26T05:26:59.809Z", "modified": "2026-10-01T03:52:24.229Z", "updated_at": "2026-10-01T03:52:24.229Z" }, "description_available": false, "entity_type": "Indicator", "id": "2d16d740-ae8a-45ff-8a8b-9032f924c3fa", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "indicator--1f6caeb6-3731-56d0-badd-e98cc68cbd17", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.106Z", "created_at": "2026-09-26T05:26:50.447Z", "modified": "2026-09-26T05:28:31.443Z", "updated_at": "2026-09-26T05:28:31.443Z" }, "description_available": false, "entity_type": "Indicator", "id": "2d8df4da-244f-458a-8c2d-ff67380121e9", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "indicator--19363dbc-2b68-5228-a27a-972ceae2d9a0", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.225Z", "created_at": "2026-09-26T05:27:01.363Z", "modified": "2026-09-26T05:29:58.365Z", "updated_at": "2026-09-26T05:29:58.365Z" }, "description_available": false, "entity_type": "Indicator", "id": "313c8419-28b4-4ef9-9855-91d315819bf8", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "indicator--06c69a22-8217-56ca-b57f-1450d8093ab6", "type": "Indicator" }, { "__typename": "IPv4Addr", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:25:32.536Z", "updated_at": "2026-09-26T05:26:03.736Z" }, "description_available": false, "entity_type": "IPv4-Addr", "id": "34e12ea3-8b2b-4e72-bcf2-ce08877ef79c", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "ipv4-addr--a661b6e1-9daf-50be-a255-25a63ad99982", "type": "IPv4Addr" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "IPv4-Addr", "x_opencti_score": 20 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.198Z", "created_at": "2026-09-26T05:26:54.631Z", "modified": "2026-10-01T03:52:28.225Z", "updated_at": "2026-10-01T03:52:28.225Z" }, "description_available": false, "entity_type": "Indicator", "id": "350ff6fa-1c04-4870-b345-041e0d3d6d92", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "indicator--552b4dae-671f-52b8-8854-a6f1719f9e4f", "type": "Indicator" }, { "__typename": "IPv4Addr", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:26:01.650Z", "updated_at": "2026-09-26T05:26:45.711Z" }, "description_available": false, "entity_type": "IPv4-Addr", "id": "38a810da-9fd2-4970-952c-20d833c93f6d", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "ipv4-addr--a3606b2a-2574-5798-9441-d567f5c5ae5b", "type": "IPv4Addr" }, { "__typename": "IPv4Addr", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:24:42.341Z", "updated_at": "2026-09-26T05:25:38.356Z" }, "description_available": false, "entity_type": "IPv4-Addr", "id": "38bd1e2c-7b42-420b-9c2b-9b6d47e262a9", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "ipv4-addr--fed6c935-5b44-5461-9899-4a8634900ce1", "type": "IPv4Addr" }, { "__typename": "IPv4Addr", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:26:01.345Z", "updated_at": "2026-09-26T05:26:42.149Z" }, "description_available": false, "entity_type": "IPv4-Addr", "id": "3b17245e-fd0a-4e60-aca2-694cccd39c6d", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "ipv4-addr--2e5a0cd0-e23d-5d43-89b4-b376dbc2dd53", "type": "IPv4Addr" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "IPv4-Addr", "x_opencti_score": 20 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.210Z", "created_at": "2026-09-26T05:26:57.996Z", "modified": "2026-10-01T03:52:23.848Z", "updated_at": "2026-10-01T03:52:23.848Z" }, "description_available": false, "entity_type": "Indicator", "id": "3b95a828-10fe-4895-a5fa-606043535451", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "indicator--1b34e067-ea7c-520f-a511-44f27890d015", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "IPv4-Addr", "x_opencti_score": 20 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.052Z", "created_at": "2026-09-26T05:26:38.538Z", "modified": "2026-10-01T03:52:23.235Z", "updated_at": "2026-10-01T03:52:23.235Z" }, "description_available": false, "entity_type": "Indicator", "id": "3be1760f-af98-4d5c-80e2-c0338b71f391", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "indicator--0a54a5e1-f775-59e0-b0ce-8c963b52a113", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Url", "x_opencti_score": 20 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.217Z", "created_at": "2026-09-26T05:26:59.787Z", "modified": "2026-10-01T03:52:33.009Z", "updated_at": "2026-10-01T03:52:33.009Z" }, "description_available": false, "entity_type": "Indicator", "id": "3c2ca4de-2c25-4802-a582-ebf285060ed9", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "indicator--e1f76748-6d4c-530a-9d3d-a1095c1c6d12", "type": "Indicator" }, { "__typename": "IPv4Addr", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:26:08.198Z", "updated_at": "2026-09-26T05:26:50.443Z" }, "description_available": false, "entity_type": "IPv4-Addr", "id": "3f67326c-9dfe-411f-ad47-f5aa047fb1dd", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "ipv4-addr--044069bd-51b3-5f1f-9c6b-b32236b65a86", "type": "IPv4Addr" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "IPv4-Addr", "x_opencti_score": 20 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.037Z", "created_at": "2026-09-26T05:26:31.055Z", "modified": "2026-10-01T03:52:22.946Z", "updated_at": "2026-10-01T03:52:22.946Z" }, "description_available": false, "entity_type": "Indicator", "id": "435fff26-763c-4528-906f-e8da098d6aee", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "indicator--06efe187-3526-59d8-adc2-c0ca221933d1", "type": "Indicator" }, { "__typename": "Malware", "aliases": [], "attributes": { "is_family": false }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T22:02:12.329Z", "created_at": "2026-04-03T21:09:30.536Z", "first_seen": "1970-01-01T00:00:00.000Z", "last_seen": "5138-11-16T09:46:40.000Z", "modified": "2026-04-03T21:09:31.301Z", "updated_at": "2026-04-03T21:09:31.301Z" }, "description_available": false, "entity_type": "Malware", "id": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "is_inferred": false, "labels": [], "lang": "en", "name": "Spark - S0543", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "malware--3edfe45d-afad-55ef-8742-84dd44c5ce6e", "type": "Malware" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:25:46.557Z", "updated_at": "2026-09-26T05:25:47.006Z" }, "description_available": false, "entity_type": "StixFile", "id": "464bb6a2-f467-40fe-b562-fb088579a17f", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "file--53c894b2-a52c-5e87-81d8-47b6310b666e", "type": "StixFile" }, { "__typename": "IPv4Addr", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:25:12.868Z", "updated_at": "2026-09-26T05:26:29.685Z" }, "description_available": false, "entity_type": "IPv4-Addr", "id": "473feaf2-9501-41f3-bf51-78c6f3efc898", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "ipv4-addr--e5d83f72-9f24-521c-a551-f05231e54f4b", "type": "IPv4Addr" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "IPv4-Addr", "x_opencti_score": 20 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.014Z", "created_at": "2026-09-26T05:26:18.824Z", "modified": "2026-10-01T03:52:31.071Z", "updated_at": "2026-10-01T03:52:31.071Z" }, "description_available": false, "entity_type": "Indicator", "id": "48f22366-f0fd-4667-b458-fc531795e8ff", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "indicator--8a43d3fa-3055-5b7f-9b87-8b053e071e7c", "type": "Indicator" }, { "__typename": "IPv4Addr", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:25:54.307Z", "updated_at": "2026-09-26T05:26:17.145Z" }, "description_available": false, "entity_type": "IPv4-Addr", "id": "4c992236-6476-4fe3-96f7-f527564a3c5a", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "ipv4-addr--74b2c0e3-7edd-5c15-8f08-c151dbda570e", "type": "IPv4Addr" }, { "__typename": "IPv4Addr", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:26:08.257Z", "updated_at": "2026-09-26T05:26:53.196Z" }, "description_available": false, "entity_type": "IPv4-Addr", "id": "4fac57e7-eef7-47f0-9b98-c7356e554504", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "ipv4-addr--5621c9b8-a3c7-5f33-aae4-af97f79b4012", "type": "IPv4Addr" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "IPv4-Addr", "x_opencti_score": 20 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.033Z", "created_at": "2026-09-26T05:26:30.838Z", "modified": "2026-10-01T03:52:29.047Z", "updated_at": "2026-10-01T03:52:29.047Z" }, "description_available": false, "entity_type": "Indicator", "id": "4ff9e994-0564-43c3-8240-004f20eb7d3f", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "indicator--66164a2f-34ac-5e3d-b34e-eb4d427a9e5f", "type": "Indicator" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:26:13.257Z", "updated_at": "2026-09-26T05:26:13.798Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "51f01700-015a-4847-b006-08292d4e3fa5", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "domain-name--ff8cf4f1-c59f-5072-a5ab-be51f964916e", "type": "DomainName" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:25:46.556Z", "updated_at": "2026-09-26T05:25:47.005Z" }, "description_available": false, "entity_type": "StixFile", "id": "526752ca-7f3b-4cb8-b0ec-5bd2ab4cd5d4", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "file--b4411cc4-0f62-57cd-8384-d1a109d1546d", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "IPv4-Addr", "x_opencti_score": 20 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.121Z", "created_at": "2026-09-26T05:26:53.698Z", "modified": "2026-10-01T03:52:25.308Z", "updated_at": "2026-10-01T03:52:25.308Z" }, "description_available": false, "entity_type": "Indicator", "id": "52b56463-7f22-48f8-b036-35d89d2dabcb", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "indicator--2963cb90-b391-5b06-b4a8-42f12ea86182", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.229Z", "created_at": "2026-09-26T05:27:01.403Z", "modified": "2026-09-26T05:30:18.379Z", "updated_at": "2026-09-26T05:30:18.379Z" }, "description_available": false, "entity_type": "Indicator", "id": "5330b1c5-bebb-4760-ae47-12dd0e0d1e23", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "indicator--897b9f03-c0de-551f-b5d7-be00150e3a91", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "IPv4-Addr", "x_opencti_score": 20 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.123Z", "created_at": "2026-09-26T05:26:54.413Z", "modified": "2026-10-01T03:52:31.426Z", "updated_at": "2026-10-01T03:52:31.426Z" }, "description_available": false, "entity_type": "Indicator", "id": "56d609d1-e0ef-4633-8cfe-a3e1f792fbff", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "indicator--986bbea9-ab22-5168-8c64-7ad518141b18", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:25:44.411Z", "updated_at": "2026-09-26T05:25:45.125Z" }, "description_available": false, "entity_type": "StixFile", "id": "5acd99db-1647-4737-931f-6bda9bc2e3fa", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "file--e57387ba-79d9-5c2a-b63f-2e2074fe1df3", "type": "StixFile" }, { "__typename": "IPv4Addr", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:26:01.499Z", "updated_at": "2026-09-26T05:26:48.529Z" }, "description_available": false, "entity_type": "IPv4-Addr", "id": "5d59618f-3a97-48e9-8661-b14e05c89144", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "ipv4-addr--cf92dc0c-72fe-50b8-83bb-193bcdf0695d", "type": "IPv4Addr" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "IPv4-Addr", "x_opencti_score": 20 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.049Z", "created_at": "2026-09-26T05:26:38.517Z", "modified": "2026-10-01T03:52:32.221Z", "updated_at": "2026-10-01T03:52:32.221Z" }, "description_available": false, "entity_type": "Indicator", "id": "610b3366-3a08-4e4d-9f45-c8543a783a7f", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "indicator--a7ca2470-4fff-586e-a195-5fc6f7965481", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.042Z", "created_at": "2026-09-26T05:26:32.523Z", "modified": "2026-09-26T05:27:26.982Z", "updated_at": "2026-09-26T05:27:26.982Z" }, "description_available": false, "entity_type": "Indicator", "id": "653baf3a-7205-44e8-bf30-e40825fbf42a", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "indicator--b59dbb34-916a-5d1e-894b-df96af9afa4b", "type": "Indicator" }, { "__typename": "Malware", "aliases": [], "attributes": { "is_family": false }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-18T18:09:56.087Z", "created_at": "2026-01-19T17:43:57.855Z", "first_seen": "1970-01-01T00:00:00.000Z", "last_seen": "5138-11-16T09:46:40.000Z", "modified": "2026-01-19T17:43:58.116Z", "updated_at": "2026-01-19T17:43:58.116Z" }, "description_available": false, "entity_type": "Malware", "id": "657ff382-024b-45a4-974a-3e41f1762074", "is_inferred": false, "labels": [], "lang": "en", "name": "Cobalt Strike - S0154", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "malware--6c93bbcc-ce1a-5089-ade3-c596b7d58adb", "type": "Malware" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:26:13.484Z", "updated_at": "2026-09-26T05:26:14.609Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "65928f13-af58-4e92-87d2-583157b8a75a", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "domain-name--cc398608-7c9f-5d68-b41a-65313be86b35", "type": "DomainName" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "IPv4-Addr", "x_opencti_score": 20 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.116Z", "created_at": "2026-09-26T05:26:53.409Z", "modified": "2026-10-01T03:52:28.432Z", "updated_at": "2026-10-01T03:52:28.432Z" }, "description_available": false, "entity_type": "Indicator", "id": "66f40cca-cc72-4806-beef-47ae23125e5f", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "indicator--58ae9827-dbea-5fa2-9390-e3a5a1cdcfea", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "IPv4-Addr", "x_opencti_score": 20 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.057Z", "created_at": "2026-09-26T05:26:40.511Z", "modified": "2026-10-01T03:52:29.999Z", "updated_at": "2026-10-01T03:52:29.999Z" }, "description_available": false, "entity_type": "Indicator", "id": "681c2240-1fb8-466d-a533-8f1d8132b27b", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "indicator--78cf9dbd-8d88-5dfe-9293-ae508f20a73f", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Hostname", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.246Z", "created_at": "2026-09-26T05:27:05.388Z", "modified": "2026-09-26T05:32:01.829Z", "updated_at": "2026-09-26T05:32:01.829Z" }, "description_available": false, "entity_type": "Indicator", "id": "6ac03fc4-4c10-4d8f-b546-7ce2b9422c39", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "indicator--9cf64e76-f819-5d19-ba17-6426fc4d5db9", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.091Z", "created_at": "2026-09-26T05:26:48.516Z", "modified": "2026-09-26T05:28:12.375Z", "updated_at": "2026-09-26T05:28:12.375Z" }, "description_available": false, "entity_type": "Indicator", "id": "6ae45569-c03b-471f-80ff-50d7a804075a", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "indicator--c639c9f1-5f30-5d46-8458-e4118a3d8455", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "IPv4-Addr", "x_opencti_score": 20 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.212Z", "created_at": "2026-09-26T05:26:58.400Z", "modified": "2026-10-01T03:52:27.971Z", "updated_at": "2026-10-01T03:52:27.971Z" }, "description_available": false, "entity_type": "Indicator", "id": "6fbf4d94-634a-4763-b0e5-0cbe6e9f67ea", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "indicator--4e00b158-afd4-5a2e-be23-4ddbbdeb994b", "type": "Indicator" }, { "__typename": "IPv4Addr", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:25:12.843Z", "updated_at": "2026-09-26T05:25:58.090Z" }, "description_available": false, "entity_type": "IPv4-Addr", "id": "746e057f-05ff-48aa-af9c-a0589b31c045", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "ipv4-addr--f2152a6c-b5fe-5035-abf2-f6939694a4ef", "type": "IPv4Addr" }, { "__typename": "IPv4Addr", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:25:54.066Z", "updated_at": "2026-09-26T05:26:14.000Z" }, "description_available": false, "entity_type": "IPv4-Addr", "id": "770e49ee-7bed-41b3-a341-8a41d6bd0258", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "ipv4-addr--d75ba00d-b255-5c5a-8b7f-b0e46088f8e4", "type": "IPv4Addr" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.236Z", "created_at": "2026-09-26T05:27:03.842Z", "modified": "2026-09-26T05:31:15.092Z", "updated_at": "2026-09-26T05:31:15.092Z" }, "description_available": false, "entity_type": "Indicator", "id": "781e0e33-439f-46a6-b565-9c9e6287a0ff", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "indicator--024182d8-b3ce-5132-8786-ad52e3b38164", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:25:52.512Z", "updated_at": "2026-09-26T05:25:52.765Z" }, "description_available": false, "entity_type": "StixFile", "id": "78bce55a-b598-436c-956d-75bca2e1d662", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "file--65e2aed0-bdec-5f4d-8836-f9d810d94c2c", "type": "StixFile" }, { "__typename": "IPv4Addr", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:25:58.352Z", "updated_at": "2026-09-26T05:26:30.532Z" }, "description_available": false, "entity_type": "IPv4-Addr", "id": "7afdb82b-9941-485e-8009-7224919d145a", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "ipv4-addr--366bc133-0e68-502e-b748-3f114b767f55", "type": "IPv4Addr" }, { "__typename": "IPv4Addr", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:24:01.806Z", "updated_at": "2026-09-26T05:24:20.583Z" }, "description_available": false, "entity_type": "IPv4-Addr", "id": "80884810-4591-4dfe-970a-330ea35c15af", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "ipv4-addr--ab62f458-42db-5baf-a4e9-6f14ca316346", "type": "IPv4Addr" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.080Z", "created_at": "2026-09-26T05:26:45.938Z", "modified": "2026-09-26T05:27:59.382Z", "updated_at": "2026-09-26T05:27:59.382Z" }, "description_available": false, "entity_type": "Indicator", "id": "8134c07a-eec8-489c-80e7-aca40ccc6268", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "indicator--b53de0c5-32fa-58fe-a4a5-7b91f3c6dbb3", "type": "Indicator" }, { "__typename": "Malware", "aliases": [ "Mélofée", "elf.melofee" ], "attributes": { "is_family": true }, "authorized_members": [], "confidence": 50, "created_by": { "authorized_members": [], "id": "1b7caa41-88e1-4a38-8cfc-62b85639333a", "is_inferred": false, "name": "Malpedia", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2026-01-18T17:49:13.856Z", "created_at": "2026-01-18T20:35:52.263Z", "first_seen": "1970-01-01T00:00:00.000Z", "last_seen": "5138-11-16T09:46:40.000Z", "modified": "2026-09-29T02:41:32.227Z", "updated_at": "2026-09-29T02:41:32.227Z" }, "description_available": true, "entity_type": "Malware", "id": "82dae33b-e459-494e-ba12-c05113d9bb06", "is_inferred": false, "labels": [], "lang": "en", "name": "Melofee", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": null, "id": "89e774c8-84b6-4b08-a8b9-17848b4f361a", "source_name": "malpedia", "url": "https://asec.ahnlab.com/en/55785/" }, { "external_id": null, "id": "449107b9-f714-4d5d-924a-dabddf8d4169", "source_name": "malpedia", "url": "https://blog.exatrack.com/melofee/" }, { "external_id": null, "id": "6db1f416-13e6-4101-b5e3-3a2deb95e517", "source_name": "malpedia", "url": "https://blog.sekoia.io/my-teas-not-cold-an-overview-of-china-cyber-threat/" }, { "external_id": null, "id": "8cda2641-3b29-48e7-8964-2ebc89fdcd2c", "source_name": "malpedia", "url": "https://blog.xlab.qianxin.com/analysis_of_new_melofee_variant_en/" }, { "external_id": null, "id": "633eec1e-2e5d-4ab5-8ff4-6584b04112f1", "source_name": "malpedia", "url": "https://malpedia.caad.fkie.fraunhofer.de/details/elf.melofee" } ], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "malware--4615f724-6808-56b8-8712-75456771ddd9", "type": "Malware" }, { "__typename": "IPv4Addr", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:24:47.674Z", "updated_at": "2026-09-26T05:25:43.890Z" }, "description_available": false, "entity_type": "IPv4-Addr", "id": "84c081dd-c3ae-4f17-a8bc-75a9988112fd", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "ipv4-addr--727440cb-f2cb-5fcc-ac92-4202e262f838", "type": "IPv4Addr" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.025Z", "created_at": "2026-09-26T05:26:29.288Z", "modified": "2026-09-26T05:27:11.097Z", "updated_at": "2026-09-26T05:27:11.097Z" }, "description_available": false, "entity_type": "Indicator", "id": "8c1b4518-8219-46bb-a619-1c69182e4eec", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "indicator--0789f650-492e-51cf-93dc-757532100468", "type": "Indicator" }, { "__typename": "IPv4Addr", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:24:52.108Z", "updated_at": "2026-09-26T05:25:47.351Z" }, "description_available": false, "entity_type": "IPv4-Addr", "id": "8e14af81-a523-423f-9f91-478260788646", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "ipv4-addr--c8c49a78-e520-5244-b6b4-292285b6efb8", "type": "IPv4Addr" }, { "__typename": "Malware", "aliases": [ "win.terndoor" ], "attributes": { "is_family": true }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-03-18T09:13:59.104Z", "created_at": "2026-04-24T13:15:54.313Z", "first_seen": "1970-01-01T00:00:00.000Z", "last_seen": "5138-11-16T09:46:40.000Z", "modified": "2026-09-29T03:05:48.222Z", "updated_at": "2026-09-29T03:05:48.222Z" }, "description_available": true, "entity_type": "Malware", "id": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "is_inferred": false, "labels": [], "lang": "en", "name": "TernDoor", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": null, "id": "7ecfd6c0-f81f-4f93-a560-23dae7b40349", "source_name": "alien-vault", "url": "https://blog.talosintelligence.com/uat-9244/" }, { "external_id": null, "id": "15731222-9622-4e65-9f41-a26ee0cb036a", "source_name": "malpedia", "url": "https://malpedia.caad.fkie.fraunhofer.de/details/win.terndoor" } ], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "malware--31515f08-e214-5725-97d6-b93ceb317679", "type": "Malware" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Hostname", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.021Z", "created_at": "2026-09-26T05:26:23.689Z", "modified": "2026-09-26T05:27:04.583Z", "updated_at": "2026-09-26T05:27:04.583Z" }, "description_available": false, "entity_type": "Indicator", "id": "94a7b3a6-0b64-4746-86ff-6647d1a2df8d", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "indicator--86d526b0-0272-5f56-b334-d048e8137720", "type": "Indicator" }, { "__typename": "Hostname", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:26:17.708Z", "updated_at": "2026-09-26T05:26:18.191Z" }, "description_available": false, "entity_type": "Hostname", "id": "9550d260-f7e1-4850-958a-73c46f8d76a7", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "hostname--7655475a-292d-5ddb-afb0-56c0393d2457", "type": "Hostname" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Url", "x_opencti_score": 20 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.215Z", "created_at": "2026-09-26T05:26:58.801Z", "modified": "2026-10-01T03:52:29.808Z", "updated_at": "2026-10-01T03:52:29.808Z" }, "description_available": false, "entity_type": "Indicator", "id": "95ef732a-5859-4b75-a4ea-fd3cfe3f1618", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "indicator--7669c1be-9220-5287-b125-40d7adbdf529", "type": "Indicator" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:25:12.844Z", "updated_at": "2026-09-26T05:25:24.774Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "9ad9ffb0-21a9-41e9-8ba4-eb7a850a99d7", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "domain-name--dc2c47e8-d7fe-5107-b191-afecb179e6dd", "type": "DomainName" }, { "__typename": "Url", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:26:12.094Z", "updated_at": "2026-09-26T05:26:12.348Z" }, "description_available": false, "entity_type": "Url", "id": "9c508525-38f5-4ad0-a0d5-897383007809", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "url--d1315fe4-fc7d-5c84-8bd7-a106c6921eeb", "type": "Url" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:25:47.796Z", "updated_at": "2026-09-26T05:25:48.390Z" }, "description_available": false, "entity_type": "StixFile", "id": "9d5b7e5a-f4bb-4233-b9d0-269de30e7216", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "file--69008ace-4c1f-535d-8a07-990d048730e0", "type": "StixFile" }, { "__typename": "Malware", "aliases": [ "win.stowaway" ], "attributes": { "is_family": true }, "authorized_members": [], "confidence": 50, "created_by": { "authorized_members": [], "id": "1b7caa41-88e1-4a38-8cfc-62b85639333a", "is_inferred": false, "name": "Malpedia", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2026-01-18T19:46:33.949Z", "created_at": "2026-01-18T23:58:37.946Z", "first_seen": "1970-01-01T00:00:00.000Z", "last_seen": "5138-11-16T09:46:40.000Z", "modified": "2026-09-29T03:04:30.325Z", "updated_at": "2026-09-29T03:04:30.325Z" }, "description_available": true, "entity_type": "Malware", "id": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "is_inferred": false, "labels": [], "lang": "en", "name": "STOWAWAY", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": null, "id": "2e7090aa-04e3-4340-966c-1f5e5826ff1d", "source_name": "Mandiant Trojanized Windows 10", "url": "https://www.mandiant.com/resources/blog/trojanized-windows-installers-ukrainian-government" }, { "external_id": null, "id": "36cdc073-5977-4976-965d-554fec5bf92c", "source_name": "alien-vault", "url": "https://blog.talosintelligence.com/uat-8302/" }, { "external_id": null, "id": "449107b9-f714-4d5d-924a-dabddf8d4169", "source_name": "malpedia", "url": "https://blog.exatrack.com/melofee/" }, { "external_id": null, "id": "40408d5e-7b99-4b89-ae15-8e4ee43d671b", "source_name": "malpedia", "url": "https://businessinsights.bitdefender.com/eggstreme-fileless-malware-cyberattack-apac" }, { "external_id": null, "id": "893b9b55-8570-47e4-b763-2aaab7f07b66", "source_name": "malpedia", "url": "https://github.com/ph4ntonn/Stowaway" }, { "external_id": null, "id": "83b1d464-7af6-40ad-9840-92ccf6d3b42f", "source_name": "malpedia", "url": "https://malpedia.caad.fkie.fraunhofer.de/details/win.stowaway" }, { "external_id": null, "id": "cbc54cbf-89a6-4cbf-aafe-ffa3bfdd3f70", "source_name": "malpedia", "url": "https://www.trendmicro.com/en_us/research/25/e/earth-lamia.html" } ], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "malware--504b7cdb-23e6-568f-aabf-294ea566fb57", "type": "Malware" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.064Z", "created_at": "2026-09-26T05:26:40.511Z", "modified": "2026-09-26T05:27:46.729Z", "updated_at": "2026-09-26T05:27:46.729Z" }, "description_available": false, "entity_type": "Indicator", "id": "a7a198b8-f0a3-4221-b768-191720f061b9", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "indicator--888169ab-a0d5-5141-9fc3-5260f16db83b", "type": "Indicator" }, { "__typename": "IPv4Addr", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:24:12.987Z", "updated_at": "2026-09-26T14:55:09.311Z" }, "description_available": false, "entity_type": "IPv4-Addr", "id": "a7c4c835-d970-49b2-8782-cd5a75827218", "is_inferred": false, "labels": [ "bloodalchemy", "cobalt strike", "crowdoor", "government impersonation", "hellobot", "hemigate", "linux implant", "mélofée", "nodeedgerat", "nomadrat", "plugx", "ratels", "reptile", "shadowpad", "silkparasite", "spark", "spicerat", "stowaway", "terndoor" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "ipv4-addr--d73e17a3-3f67-5ccb-9d23-9f57a20d7b77", "type": "IPv4Addr" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "IPv4-Addr", "x_opencti_score": 20 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.203Z", "created_at": "2026-09-26T05:26:56.504Z", "modified": "2026-10-01T03:52:28.667Z", "updated_at": "2026-10-01T03:52:28.667Z" }, "description_available": false, "entity_type": "Indicator", "id": "aaf834aa-275b-4a6a-9790-6971e8adf52d", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "indicator--58b3bda8-d9d8-50b3-88cf-5d3554afc86b", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.222Z", "created_at": "2026-09-26T05:26:59.803Z", "modified": "2026-09-26T05:29:16.979Z", "updated_at": "2026-09-26T05:29:16.979Z" }, "description_available": false, "entity_type": "Indicator", "id": "ac6046d8-f570-4eca-af26-b22ab4b74e00", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "indicator--ea288c45-2835-5df4-9354-c027b7f7dc43", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:25:52.809Z", "updated_at": "2026-09-26T05:25:53.273Z" }, "description_available": false, "entity_type": "StixFile", "id": "b2074404-2769-4ab5-8041-fea559804907", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "file--06174357-0156-5585-b5d9-e6d0f390c517", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "IPv4-Addr", "x_opencti_score": 20 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.018Z", "created_at": "2026-09-26T05:26:23.696Z", "modified": "2026-10-01T03:52:27.611Z", "updated_at": "2026-10-01T03:52:27.611Z" }, "description_available": false, "entity_type": "Indicator", "id": "b2490479-1c8f-4288-a8e1-23589e1535cf", "is_inferred": false, "labels": [ "bloodalchemy", "cobalt strike", "crowdoor", "government impersonation", "hellobot", "hemigate", "linux implant", "mélofée", "nodeedgerat", "nomadrat", "plugx", "ratels", "reptile", "shadowpad", "silkparasite", "spark", "spicerat", "stowaway", "terndoor" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "indicator--43124f66-81b2-55c0-9eac-e3f4e342ecf3", "type": "Indicator" }, { "__typename": "Url", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:26:08.261Z", "updated_at": "2026-09-26T05:26:08.884Z" }, "description_available": false, "entity_type": "Url", "id": "b43b9fe9-5ab2-4d09-bb77-e585675093c6", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "url--c195761a-b0f8-585a-9acf-1655576c0791", "type": "Url" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "IPv4-Addr", "x_opencti_score": 20 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.046Z", "created_at": "2026-09-26T05:26:32.531Z", "modified": "2026-10-01T03:52:25.009Z", "updated_at": "2026-10-01T03:52:25.009Z" }, "description_available": false, "entity_type": "Indicator", "id": "b5ad9feb-b128-47fb-9914-8319d0f48229", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "indicator--248c920a-d1a1-5f91-a780-f0437c220975", "type": "Indicator" }, { "__typename": "IPv4Addr", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:25:16.220Z", "updated_at": "2026-09-26T05:25:58.149Z" }, "description_available": false, "entity_type": "IPv4-Addr", "id": "b8f3a636-2804-4e40-bf6e-d055e9b61462", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "ipv4-addr--26e47720-1a19-5045-82c5-11e58e2fd978", "type": "IPv4Addr" }, { "__typename": "Hostname", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:24:07.378Z", "updated_at": "2026-09-26T05:24:11.285Z" }, "description_available": false, "entity_type": "Hostname", "id": "bf3b8856-9137-440a-957e-bfbd1c098297", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "hostname--c6afdea9-d925-5ac3-a622-252acc5163d9", "type": "Hostname" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Hostname", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.239Z", "created_at": "2026-09-26T05:27:04.235Z", "modified": "2026-09-26T05:31:50.526Z", "updated_at": "2026-09-26T05:31:50.526Z" }, "description_available": false, "entity_type": "Indicator", "id": "c08d31e4-ff5a-45b7-8880-330403eced75", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "indicator--0e615fff-d13a-57db-8f91-068f81800f23", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "IPv4-Addr", "x_opencti_score": 20 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.035Z", "created_at": "2026-09-26T05:26:31.046Z", "modified": "2026-10-01T03:52:25.592Z", "updated_at": "2026-10-01T03:52:25.592Z" }, "description_available": false, "entity_type": "Indicator", "id": "c2dcc828-9ae2-404f-a201-0074f26085ba", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "indicator--2f36c001-dffa-55c6-9c5a-c1fd75a9342e", "type": "Indicator" }, { "__typename": "IPv4Addr", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:26:00.034Z", "updated_at": "2026-09-26T05:26:39.261Z" }, "description_available": false, "entity_type": "IPv4-Addr", "id": "c4ec9e93-b504-4f50-8451-fac10c9ad804", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "ipv4-addr--0bc95d6a-7c41-58b3-9eaa-fccc1a8bd8eb", "type": "IPv4Addr" }, { "__typename": "Hostname", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:26:13.636Z", "updated_at": "2026-09-26T05:26:14.608Z" }, "description_available": false, "entity_type": "Hostname", "id": "c60babc6-0b39-4b6d-8c38-a1a13fde2bba", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "hostname--b8426714-efd0-5388-a5df-906c2c71eacd", "type": "Hostname" }, { "__typename": "IPv4Addr", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:25:32.509Z", "updated_at": "2026-09-26T05:26:08.848Z" }, "description_available": false, "entity_type": "IPv4-Addr", "id": "c693aaa8-d711-4326-9843-d33513ceb248", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "ipv4-addr--c32c8db3-5b01-5231-bf7d-63acad79cbef", "type": "IPv4Addr" }, { "__typename": "IPv4Addr", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:25:54.625Z", "updated_at": "2026-09-26T05:26:19.401Z" }, "description_available": false, "entity_type": "IPv4-Addr", "id": "c75f6906-a6e4-4a6f-bedb-eb506639f40f", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "ipv4-addr--88fb607d-817e-5c7f-bb47-d3fd5653c62e", "type": "IPv4Addr" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.094Z", "created_at": "2026-09-26T05:26:48.795Z", "modified": "2026-09-26T05:28:17.454Z", "updated_at": "2026-09-26T05:28:17.454Z" }, "description_available": false, "entity_type": "Indicator", "id": "c77e0b5e-a168-4a6f-993c-bc7076c78285", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "indicator--f9773d68-05bc-5635-9ba6-b23bc9cbae94", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Hostname", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.242Z", "created_at": "2026-09-26T05:27:04.236Z", "modified": "2026-09-26T05:31:31.522Z", "updated_at": "2026-09-26T05:31:31.522Z" }, "description_available": false, "entity_type": "Indicator", "id": "c9493e20-dc6a-4938-8fee-746005c4ae07", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "indicator--e3400f81-bff9-5fb7-8e4b-2c7abeab6f59", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:25:52.799Z", "updated_at": "2026-09-26T05:25:53.205Z" }, "description_available": false, "entity_type": "StixFile", "id": "ca8da3f5-7f0e-44c2-a7fa-6ac0dc228591", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "file--afe71ac9-bcf6-58be-8aaf-4c2b8a5aec1d", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "IPv4-Addr", "x_opencti_score": 20 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.111Z", "created_at": "2026-09-26T05:26:52.049Z", "modified": "2026-10-01T03:52:32.699Z", "updated_at": "2026-10-01T03:52:32.699Z" }, "description_available": false, "entity_type": "Indicator", "id": "cd0c196b-8e17-4794-80e8-7129d42950e2", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "indicator--c232e5ed-9d4a-51f5-95f2-b53356959461", "type": "Indicator" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:26:12.205Z", "updated_at": "2026-09-26T05:26:12.533Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "cd7ff8be-11f3-4197-9332-31bb24712c8c", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "domain-name--549b53f2-6f57-5648-9f76-935f75cd1fd1", "type": "DomainName" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "IPv4-Addr", "x_opencti_score": 20 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.055Z", "created_at": "2026-09-26T05:26:38.532Z", "modified": "2026-10-01T03:52:32.554Z", "updated_at": "2026-10-01T03:52:32.554Z" }, "description_available": false, "entity_type": "Indicator", "id": "cdadaaa5-0866-4957-b6d7-c64be31a1cf9", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "indicator--b32ad7d3-ae79-5611-b0fc-10d2361d8676", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.071Z", "created_at": "2026-09-26T05:26:43.232Z", "modified": "2026-09-26T05:27:52.129Z", "updated_at": "2026-09-26T05:27:52.129Z" }, "description_available": false, "entity_type": "Indicator", "id": "ce5e270a-a0f5-4d07-9faf-6493364c1a2b", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "indicator--427f06a9-cc63-5065-b3c2-755e74253033", "type": "Indicator" }, { "__typename": "Malware", "aliases": [], "attributes": { "is_family": false }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T19:53:14.980Z", "created_at": "2026-03-15T07:08:31.216Z", "first_seen": "1970-01-01T00:00:00.000Z", "last_seen": "5138-11-16T09:46:40.000Z", "modified": "2026-03-19T17:12:47.363Z", "updated_at": "2026-03-19T17:12:47.363Z" }, "description_available": false, "entity_type": "Malware", "id": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "is_inferred": false, "labels": [], "lang": "en", "name": "CrowDoor", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "malware--0cd8a6bd-4eb0-5a9f-aaf1-33ec101ba60b", "type": "Malware" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "IPv4-Addr", "x_opencti_score": 20 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.028Z", "created_at": "2026-09-26T05:26:29.272Z", "modified": "2026-10-01T03:52:31.605Z", "updated_at": "2026-10-01T03:52:31.605Z" }, "description_available": false, "entity_type": "Indicator", "id": "d4aa073f-c77f-4db6-a515-5246469cf6b0", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "indicator--9a88aef6-bfe1-5ed5-807f-2c1e6ed5ed2c", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Hostname", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.252Z", "created_at": "2026-09-26T05:27:06.330Z", "modified": "2026-09-26T05:32:32.962Z", "updated_at": "2026-09-26T05:32:32.962Z" }, "description_available": false, "entity_type": "Indicator", "id": "d5009423-c128-4583-ac72-3f07f1201db6", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "indicator--8e3d6d2d-6861-5428-be8c-1b5e8e869150", "type": "Indicator" }, { "__typename": "Hostname", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:26:16.983Z", "updated_at": "2026-09-26T05:26:17.692Z" }, "description_available": false, "entity_type": "Hostname", "id": "d5ef1d29-2c13-4e41-ac4d-39f613e66cbb", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "hostname--12b489a4-eed4-5073-b651-462eef9f37d9", "type": "Hostname" }, { "__typename": "Hostname", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:24:15.846Z", "updated_at": "2026-09-26T05:24:21.642Z" }, "description_available": false, "entity_type": "Hostname", "id": "d7cc6736-6d0e-44e8-ad46-b060d3d6980d", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "hostname--6fb11036-51f6-5ee4-8da2-8a1401c8ba80", "type": "Hostname" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.232Z", "created_at": "2026-09-26T05:27:01.398Z", "modified": "2026-09-26T05:27:01.953Z", "updated_at": "2026-09-26T05:27:01.953Z" }, "description_available": false, "entity_type": "Indicator", "id": "d7d77ca0-8c06-4de9-bacb-a526f344e2e9", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "indicator--e6234ff7-b1d5-519e-a136-487cce516be6", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "IPv4-Addr", "x_opencti_score": 20 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.118Z", "created_at": "2026-09-26T05:26:53.685Z", "modified": "2026-10-01T03:52:30.787Z", "updated_at": "2026-10-01T03:52:30.787Z" }, "description_available": false, "entity_type": "Indicator", "id": "d7f88a85-9ab3-45b8-982b-294d838461a6", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "indicator--7a72c93a-73b1-57aa-8ec5-370e170823f1", "type": "Indicator" }, { "__typename": "IPv4Addr", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:25:56.216Z", "updated_at": "2026-09-26T05:26:28.486Z" }, "description_available": false, "entity_type": "IPv4-Addr", "id": "d8d488d1-6404-4891-a4d4-e6ad07248ed2", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "ipv4-addr--3663661d-e4af-5ff5-9c4d-89137d6ee21b", "type": "IPv4Addr" }, { "__typename": "Malware", "aliases": [ "win.hellobot" ], "attributes": { "is_family": true }, "authorized_members": [], "confidence": 50, "created_by": { "authorized_members": [], "id": "1b7caa41-88e1-4a38-8cfc-62b85639333a", "is_inferred": false, "name": "Malpedia", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2026-01-18T18:52:54.742Z", "created_at": "2026-01-18T20:31:29.909Z", "first_seen": "1970-01-01T00:00:00.000Z", "last_seen": "5138-11-16T09:46:40.000Z", "modified": "2026-09-29T02:41:19.160Z", "updated_at": "2026-09-29T02:41:19.160Z" }, "description_available": true, "entity_type": "Malware", "id": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "is_inferred": false, "labels": [], "lang": "en", "name": "HelloBot", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": null, "id": "01760027-d2ed-450a-a866-9fd40173c431", "source_name": "malpedia", "url": "https://documents.trendmicro.com/assets/txt/earth-berberoka-windows-iocs-2.txt" }, { "external_id": null, "id": "eacde347-7f62-4907-9386-aec5b05e6e2f", "source_name": "malpedia", "url": "https://malpedia.caad.fkie.fraunhofer.de/details/win.hellobot" }, { "external_id": null, "id": "d7d42304-89e7-43e9-8d77-9a1e0349d18f", "source_name": "malpedia", "url": "https://www.trendmicro.com/en_us/research/22/d/new-apt-group-earth-berberoka-targets-gambling-websites-with-old.html" }, { "external_id": null, "id": "458e2763-5f77-4819-ac99-50d9a67627ad", "source_name": "malpedia", "url": "https://www.virusbulletin.com/uploads/pdf/conference/vb2024/papers/Down-the-GRAYRABBIT-hole-exposing-UNC3569-and-its-modus-operandi.pdf" } ], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "malware--5f59ed50-7846-5b4c-be57-960f6e7fa8b9", "type": "Malware" }, { "__typename": "Hostname", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:26:15.157Z", "updated_at": "2026-09-26T05:26:16.556Z" }, "description_available": false, "entity_type": "Hostname", "id": "dd7ebe8e-4dea-4c48-88b8-1ca32915aa4c", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "hostname--43c81c75-0693-5359-90e5-8a83923051ca", "type": "Hostname" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.067Z", "created_at": "2026-09-26T05:26:43.032Z", "modified": "2026-09-26T05:27:47.776Z", "updated_at": "2026-09-26T05:27:47.776Z" }, "description_available": false, "entity_type": "Indicator", "id": "de51cd6f-4b7a-4c4b-9b3d-d5094f650356", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "indicator--05647fda-fe3f-56e3-9bc2-6006402953a6", "type": "Indicator" }, { "__typename": "IPv4Addr", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:24:47.585Z", "updated_at": "2026-09-26T05:26:46.239Z" }, "description_available": false, "entity_type": "IPv4-Addr", "id": "de6cfc4d-a139-4133-8ce1-195a0b3fd5c5", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "ipv4-addr--222b0483-b95a-5599-a22c-19ffdb9b4816", "type": "IPv4Addr" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:25:47.775Z", "updated_at": "2026-09-26T05:25:48.122Z" }, "description_available": false, "entity_type": "StixFile", "id": "e61b6017-a6a7-4dfb-a05d-e24eef8b4eec", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "file--7fd5f1cd-f0b8-5bcf-96b7-e3389c1eca0d", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Hostname", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.249Z", "created_at": "2026-09-26T05:27:06.260Z", "modified": "2026-09-26T05:32:31.072Z", "updated_at": "2026-09-26T05:32:31.072Z" }, "description_available": false, "entity_type": "Indicator", "id": "e82e98a0-5491-4b41-82dd-1ffa975dde57", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "indicator--4fca75cb-7ad5-5ff4-9d0b-e58554f75306", "type": "Indicator" }, { "__typename": "Hostname", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:26:17.198Z", "updated_at": "2026-09-26T05:26:17.792Z" }, "description_available": false, "entity_type": "Hostname", "id": "ea11e1a2-40e6-4526-9a9e-890d173ac098", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "hostname--34f4b41d-055b-59e2-a444-c1f91a099e9b", "type": "Hostname" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:25:40.532Z", "updated_at": "2026-09-26T05:25:43.009Z" }, "description_available": false, "entity_type": "StixFile", "id": "ea1778a7-5b4b-491f-b4b4-49c709df6453", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "file--9d121279-1c10-51da-bdcb-f774f5e16b12", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "IPv4-Addr", "x_opencti_score": 20 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.114Z", "created_at": "2026-09-26T05:26:52.747Z", "modified": "2026-10-01T03:52:29.601Z", "updated_at": "2026-10-01T03:52:29.601Z" }, "description_available": false, "entity_type": "Indicator", "id": "ea8ff45b-69d1-4069-bebe-6f7107045959", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "indicator--753486cc-5418-5cbc-9bee-c991c6a8d7cc", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Hostname", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.023Z", "created_at": "2026-09-26T05:26:23.695Z", "modified": "2026-09-26T05:27:00.711Z", "updated_at": "2026-09-26T05:27:00.711Z" }, "description_available": false, "entity_type": "Indicator", "id": "eb51ab90-3d38-4f58-84c1-b0700196508c", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "indicator--567c3ccd-e1dd-5fbe-bb67-42ec84283b0e", "type": "Indicator" }, { "__typename": "Malware", "aliases": [], "attributes": { "is_family": false }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:23.717Z", "created_at": "2026-09-26T05:23:52.428Z", "first_seen": "1970-01-01T00:00:00.000Z", "last_seen": "5138-11-16T09:46:40.000Z", "modified": "2026-09-26T05:23:56.824Z", "updated_at": "2026-09-26T05:23:56.824Z" }, "description_available": false, "entity_type": "Malware", "id": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "is_inferred": false, "labels": [], "lang": "en", "name": "RatelS", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "malware--19ce99d6-7389-5bfa-8a65-e7c47d31069f", "type": "Malware" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:25:47.791Z", "updated_at": "2026-09-26T05:25:48.388Z" }, "description_available": false, "entity_type": "StixFile", "id": "f05ee10f-9e6f-4994-b588-c172a138f88e", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "file--2283bcbe-22e8-564b-ac7a-8e509a27da03", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "IPv4-Addr", "x_opencti_score": 20 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.201Z", "created_at": "2026-09-26T05:26:54.631Z", "modified": "2026-10-01T03:52:32.076Z", "updated_at": "2026-10-01T03:52:32.076Z" }, "description_available": false, "entity_type": "Indicator", "id": "f0b6cabc-d961-4c2b-a9a0-4075ac17972c", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "indicator--a51b29c3-77c6-50c2-bddd-c8b717d14ea1", "type": "Indicator" }, { "__typename": "IPv4Addr", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:24:33.289Z", "updated_at": "2026-09-26T05:26:34.346Z" }, "description_available": false, "entity_type": "IPv4-Addr", "id": "f4f85fd2-e8e3-4f88-9173-9680e5c6e9ae", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "ipv4-addr--0f10a040-ce84-5956-ac54-14797b6b52bf", "type": "IPv4Addr" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "IPv4-Addr", "x_opencti_score": 20 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.011Z", "created_at": "2026-09-26T05:26:18.712Z", "modified": "2026-10-01T03:52:23.605Z", "updated_at": "2026-10-01T03:52:23.605Z" }, "description_available": false, "entity_type": "Indicator", "id": "f7f8f4c3-42b1-433b-a4ab-f67c83968004", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "indicator--0fdf3a7e-e0ea-50ab-a76c-189fba4e1219", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:25:46.546Z", "updated_at": "2026-09-26T05:25:46.943Z" }, "description_available": false, "entity_type": "StixFile", "id": "f9498165-6ce4-46a4-ad53-6692e3059b2e", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "file--836db3e8-6212-5f88-b18f-03a072d11220", "type": "StixFile" }, { "__typename": "Malware", "aliases": [], "attributes": { "is_family": false }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T16:23:00.041Z", "created_at": "2026-02-06T21:11:44.284Z", "first_seen": "1970-01-01T00:00:00.000Z", "last_seen": "5138-11-16T09:46:40.000Z", "modified": "2026-02-06T21:11:44.805Z", "updated_at": "2026-02-06T21:11:44.805Z" }, "description_available": false, "entity_type": "Malware", "id": "fab79403-9d60-420c-bc87-42b644d12f6d", "is_inferred": false, "labels": [], "lang": "en", "name": "ShadowPad - S0596", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "malware--4edb8b8a-6948-5841-80c3-46da68f5c6a9", "type": "Malware" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.097Z", "created_at": "2026-09-26T05:26:48.876Z", "modified": "2026-09-26T05:28:19.732Z", "updated_at": "2026-09-26T05:28:19.732Z" }, "description_available": false, "entity_type": "Indicator", "id": "fdaa0a79-121c-4e17-91bb-e23da88da18e", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "indicator--1c0212f0-36ae-530b-ab40-472675ad9e17", "type": "Indicator" }, { "__typename": "Malware", "aliases": [], "attributes": { "is_family": false }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-18T18:44:37.266Z", "created_at": "2026-01-22T21:59:30.114Z", "first_seen": "1970-01-01T00:00:00.000Z", "last_seen": "5138-11-16T09:46:40.000Z", "modified": "2026-01-22T21:59:30.535Z", "updated_at": "2026-01-22T21:59:30.535Z" }, "description_available": false, "entity_type": "Malware", "id": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "is_inferred": false, "labels": [], "lang": "en", "name": "PlugX - S0013", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "malware--a1ba90e1-f3aa-5f26-9f1c-63c0a45795b7", "type": "Malware" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T05:25:40.518Z", "updated_at": "2026-09-26T05:25:43.008Z" }, "description_available": false, "entity_type": "StixFile", "id": "ffe798a7-54cc-419f-8e75-b8a9ec869d0d", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "file--4f3ed32e-64c0-52c7-a85e-a2fc9ed42958", "type": "StixFile" } ], "direct_relationships": [ { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.368Z", "created_at": "2026-09-26T06:04:52.901Z", "modified": "2026-09-26T06:04:53.222Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:04:53.222Z" }, "description_available": false, "entity_type": "indicates", "fromId": "3c2ca4de-2c25-4802-a582-ebf285060ed9", "from_id": "3c2ca4de-2c25-4802-a582-ebf285060ed9", "from_name": null, "from_type": "Indicator", "id": "00d25f24-f86a-4b1c-ad71-bff39a903add", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--43c1c9f5-34c0-554f-b10a-3f6fe4638703", "toId": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_id": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_name": "RatelS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.486Z", "created_at": "2026-09-26T05:41:39.360Z", "modified": "2026-09-26T05:41:40.860Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:41:40.860Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c2dcc828-9ae2-404f-a201-0074f26085ba", "from_id": "c2dcc828-9ae2-404f-a201-0074f26085ba", "from_name": null, "from_type": "Indicator", "id": "010f465f-2fb8-4b44-8458-5d45964b460a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--bd152929-0c34-5324-b6fb-f9fa1b97317a", "toId": "208a45aa-c18e-4619-9a90-7004849cab40", "to_id": "208a45aa-c18e-4619-9a90-7004849cab40", "to_name": "HemiGate", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.504Z", "created_at": "2026-09-26T06:07:55.170Z", "modified": "2026-09-26T06:07:55.476Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:07:55.476Z" }, "description_available": false, "entity_type": "indicates", "fromId": "781e0e33-439f-46a6-b565-9c9e6287a0ff", "from_id": "781e0e33-439f-46a6-b565-9c9e6287a0ff", "from_name": null, "from_type": "Indicator", "id": "01530d79-599b-46dd-833a-b0933ff0b4c4", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--58de4c3f-a0e1-5a68-9e8b-f1a36299c72b", "toId": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_id": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_name": "TernDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.845Z", "created_at": "2026-09-26T05:52:11.730Z", "modified": "2026-09-26T05:52:11.926Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:52:11.926Z" }, "description_available": false, "entity_type": "indicates", "fromId": "6ae45569-c03b-471f-80ff-50d7a804075a", "from_id": "6ae45569-c03b-471f-80ff-50d7a804075a", "from_name": null, "from_type": "Indicator", "id": "02162ffe-cc58-4f9b-afbf-f0e6ddc1f940", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--8d937a4b-435a-57fc-b359-959e05334aee", "toId": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_id": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_name": "HelloBot", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.571Z", "created_at": "2026-09-26T06:10:57.610Z", "modified": "2026-09-26T06:10:57.859Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:10:57.859Z" }, "description_available": false, "entity_type": "indicates", "fromId": "6ac03fc4-4c10-4d8f-b546-7ce2b9422c39", "from_id": "6ac03fc4-4c10-4d8f-b546-7ce2b9422c39", "from_name": null, "from_type": "Indicator", "id": "0276a5bb-fba4-4d80-833f-602516233000", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--c7651aca-dbbf-53cd-a4c1-7d2e2a3c905a", "toId": "208a45aa-c18e-4619-9a90-7004849cab40", "to_id": "208a45aa-c18e-4619-9a90-7004849cab40", "to_name": "HemiGate", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.440Z", "created_at": "2026-09-26T05:40:45.877Z", "modified": "2026-09-26T05:40:46.033Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:40:46.033Z" }, "description_available": false, "entity_type": "indicates", "fromId": "01c74684-bdd9-45d1-84be-d24d189bcb28", "from_id": "01c74684-bdd9-45d1-84be-d24d189bcb28", "from_name": null, "from_type": "Indicator", "id": "02dce47b-ee68-4005-8db9-97ab13ef64d8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--04a18b3a-a831-53c5-9f99-8f7b909cdb97", "toId": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_id": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_name": "RatelS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.572Z", "created_at": "2026-09-26T05:43:29.760Z", "modified": "2026-09-26T05:43:29.915Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:43:29.915Z" }, "description_available": false, "entity_type": "indicates", "fromId": "b5ad9feb-b128-47fb-9914-8319d0f48229", "from_id": "b5ad9feb-b128-47fb-9914-8319d0f48229", "from_name": null, "from_type": "Indicator", "id": "030b2408-f33f-45f3-9255-3e6d6c446215", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--da6930d6-6216-5c95-9856-6ae1a56e470d", "toId": "208a45aa-c18e-4619-9a90-7004849cab40", "to_id": "208a45aa-c18e-4619-9a90-7004849cab40", "to_name": "HemiGate", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.540Z", "created_at": "2026-09-26T06:08:58.303Z", "modified": "2026-09-26T06:08:58.527Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:08:58.527Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c9493e20-dc6a-4938-8fee-746005c4ae07", "from_id": "c9493e20-dc6a-4938-8fee-746005c4ae07", "from_name": null, "from_type": "Indicator", "id": "03170e6d-3b4c-4b5f-b90f-8086caadef93", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--f6daf779-6434-5dfc-b8d0-6e68335a9dc0", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.298Z", "created_at": "2026-09-26T05:36:17.247Z", "modified": "2026-09-26T05:36:17.407Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:36:17.407Z" }, "description_available": false, "entity_type": "indicates", "fromId": "20bc512e-2f63-438d-bcee-abdf39614bf5", "from_id": "20bc512e-2f63-438d-bcee-abdf39614bf5", "from_name": null, "from_type": "Indicator", "id": "03332100-ad76-4c18-b484-15a1ea0fe347", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--dd324ee6-4de3-52ca-bd07-373288d58078", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.851Z", "created_at": "2026-09-26T05:52:13.825Z", "modified": "2026-09-26T05:52:14.151Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:52:14.151Z" }, "description_available": false, "entity_type": "indicates", "fromId": "6ae45569-c03b-471f-80ff-50d7a804075a", "from_id": "6ae45569-c03b-471f-80ff-50d7a804075a", "from_name": null, "from_type": "Indicator", "id": "0336e6ca-2706-4a62-8064-092347f1c534", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--fc6ae0b5-6a97-50ec-af28-41dd0480b008", "toId": "657ff382-024b-45a4-974a-3e41f1762074", "to_id": "657ff382-024b-45a4-974a-3e41f1762074", "to_name": "Cobalt Strike - S0154", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.199Z", "created_at": "2026-09-26T06:00:04.353Z", "modified": "2026-09-26T06:00:04.842Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:00:04.842Z" }, "description_available": false, "entity_type": "indicates", "fromId": "f0b6cabc-d961-4c2b-a9a0-4075ac17972c", "from_id": "f0b6cabc-d961-4c2b-a9a0-4075ac17972c", "from_name": null, "from_type": "Indicator", "id": "03377755-d32c-4773-813d-8d1f01a59a0c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--cf7a74b3-79c6-5d1b-a617-9a1031d91bdb", "toId": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_id": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_name": "HelloBot", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.346Z", "created_at": "2026-09-26T06:04:29.433Z", "modified": "2026-09-26T06:04:29.634Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:04:29.634Z" }, "description_available": false, "entity_type": "indicates", "fromId": "95ef732a-5859-4b75-a4ea-fd3cfe3f1618", "from_id": "95ef732a-5859-4b75-a4ea-fd3cfe3f1618", "from_name": null, "from_type": "Indicator", "id": "0355cc94-2a66-4229-9821-4ba4660610db", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--b5cd3c77-409a-51d2-bfbd-f742bd98fe50", "toId": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_id": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_name": "RatelS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.585Z", "created_at": "2026-09-26T05:43:39.586Z", "modified": "2026-09-26T05:43:40.268Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:43:40.268Z" }, "description_available": false, "entity_type": "indicates", "fromId": "610b3366-3a08-4e4d-9f45-c8543a783a7f", "from_id": "610b3366-3a08-4e4d-9f45-c8543a783a7f", "from_name": null, "from_type": "Indicator", "id": "03e31b50-7748-467c-b9cd-2e8a3b6d0d01", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--8147822a-a0e9-5bbd-9f8d-b244d459e33b", "toId": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_id": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_name": "Melofee", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.588Z", "created_at": "2026-09-26T05:43:41.413Z", "modified": "2026-09-26T05:43:41.586Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:43:41.586Z" }, "description_available": false, "entity_type": "indicates", "fromId": "610b3366-3a08-4e4d-9f45-c8543a783a7f", "from_id": "610b3366-3a08-4e4d-9f45-c8543a783a7f", "from_name": null, "from_type": "Indicator", "id": "03ea0428-a696-45b2-bb4d-aecaa945d9dd", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--2a6bee33-f470-5a33-a0b6-fcc7c03a4abf", "toId": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_id": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_name": "PlugX - S0013", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.588Z", "created_at": "2026-09-26T06:11:16.523Z", "modified": "2026-09-26T06:11:16.670Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:11:16.670Z" }, "description_available": false, "entity_type": "indicates", "fromId": "e82e98a0-5491-4b41-82dd-1ffa975dde57", "from_id": "e82e98a0-5491-4b41-82dd-1ffa975dde57", "from_name": null, "from_type": "Indicator", "id": "041d5293-1663-4a52-9dc9-8622884bb18a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--41baa3d1-a7ce-50b4-999f-a0e0fa8fdbd6", "toId": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_id": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_name": "PlugX - S0013", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.551Z", "created_at": "2026-09-26T05:42:59.536Z", "modified": "2026-09-26T05:42:59.735Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:42:59.735Z" }, "description_available": false, "entity_type": "indicates", "fromId": "653baf3a-7205-44e8-bf30-e40825fbf42a", "from_id": "653baf3a-7205-44e8-bf30-e40825fbf42a", "from_name": null, "from_type": "Indicator", "id": "04629212-02ad-486a-9dbf-cb7f6adcddf9", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--128cc023-4cdc-5259-a558-d45621c94081", "toId": "208a45aa-c18e-4619-9a90-7004849cab40", "to_id": "208a45aa-c18e-4619-9a90-7004849cab40", "to_name": "HemiGate", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.251Z", "created_at": "2026-09-26T05:35:19.313Z", "modified": "2026-09-26T05:35:19.602Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:35:19.602Z" }, "description_available": false, "entity_type": "based-on", "fromId": "e82e98a0-5491-4b41-82dd-1ffa975dde57", "from_id": "e82e98a0-5491-4b41-82dd-1ffa975dde57", "from_name": null, "from_type": "Indicator", "id": "046acd65-c1a9-48d7-b414-a55ffdbac720", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--6e29fcca-7393-5700-a108-fba145356b99", "toId": "ea11e1a2-40e6-4526-9a9e-890d173ac098", "to_id": "ea11e1a2-40e6-4526-9a9e-890d173ac098", "to_name": null, "to_type": "Hostname" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.218Z", "created_at": "2026-09-26T05:35:14.100Z", "modified": "2026-09-26T05:35:16.481Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:35:16.481Z" }, "description_available": false, "entity_type": "based-on", "fromId": "3c2ca4de-2c25-4802-a582-ebf285060ed9", "from_id": "3c2ca4de-2c25-4802-a582-ebf285060ed9", "from_name": null, "from_type": "Indicator", "id": "047324de-dbe4-41ee-9c60-e76cc2062305", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--fe731a40-e6ac-50f1-b993-38d28a4b86b5", "toId": "2664d5d7-e095-48a9-8b0a-4bbf509e3cdc", "to_id": "2664d5d7-e095-48a9-8b0a-4bbf509e3cdc", "to_name": null, "to_type": "Url" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.388Z", "created_at": "2026-09-26T06:05:19.734Z", "modified": "2026-09-26T06:05:19.906Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:05:19.906Z" }, "description_available": false, "entity_type": "indicates", "fromId": "2d16d740-ae8a-45ff-8a8b-9032f924c3fa", "from_id": "2d16d740-ae8a-45ff-8a8b-9032f924c3fa", "from_name": null, "from_type": "Indicator", "id": "04bac4a4-51c3-4819-b936-a3967499a6b9", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--230e0b45-5587-5df6-b8c1-3f786badeb13", "toId": "657ff382-024b-45a4-974a-3e41f1762074", "to_id": "657ff382-024b-45a4-974a-3e41f1762074", "to_name": "Cobalt Strike - S0154", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.455Z", "created_at": "2026-09-26T05:41:01.387Z", "modified": "2026-09-26T05:41:01.771Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:41:01.771Z" }, "description_available": false, "entity_type": "indicates", "fromId": "4ff9e994-0564-43c3-8240-004f20eb7d3f", "from_id": "4ff9e994-0564-43c3-8240-004f20eb7d3f", "from_name": null, "from_type": "Indicator", "id": "04e4c532-b3b8-44cd-b2d5-fd2937146468", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--6a66f277-6c35-5591-9ad0-ed81c6f84e27", "toId": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_id": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_name": "HelloBot", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.614Z", "created_at": "2026-09-26T05:45:15.271Z", "modified": "2026-09-26T05:45:15.739Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:45:15.739Z" }, "description_available": false, "entity_type": "indicates", "fromId": "3be1760f-af98-4d5c-80e2-c0338b71f391", "from_id": "3be1760f-af98-4d5c-80e2-c0338b71f391", "from_name": null, "from_type": "Indicator", "id": "05088253-603a-46a0-82fa-9c47229474f9", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--93977171-3e30-5c62-ba88-a975424a64b5", "toId": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_id": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_name": "Spark - S0543", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.787Z", "created_at": "2026-09-26T05:49:20.666Z", "modified": "2026-09-26T05:49:20.938Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:49:20.938Z" }, "description_available": false, "entity_type": "indicates", "fromId": "8134c07a-eec8-489c-80e7-aca40ccc6268", "from_id": "8134c07a-eec8-489c-80e7-aca40ccc6268", "from_name": null, "from_type": "Indicator", "id": "05e1a8a8-855c-4177-9a7a-af722b64cb9f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--61a8fece-560c-5bce-9159-f54084f96431", "toId": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_id": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_name": "CrowDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.149Z", "created_at": "2026-09-26T05:59:02.696Z", "modified": "2026-09-26T05:59:02.897Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:59:02.897Z" }, "description_available": false, "entity_type": "indicates", "fromId": "56d609d1-e0ef-4633-8cfe-a3e1f792fbff", "from_id": "56d609d1-e0ef-4633-8cfe-a3e1f792fbff", "from_name": null, "from_type": "Indicator", "id": "06518991-f741-460a-a8c9-91107cc66eaa", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--1f2c4066-d7e7-5756-bde2-09fb36efd746", "toId": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_id": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_name": "Spark - S0543", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.506Z", "created_at": "2026-09-26T05:42:03.539Z", "modified": "2026-09-26T05:42:03.750Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:42:03.750Z" }, "description_available": false, "entity_type": "indicates", "fromId": "435fff26-763c-4528-906f-e8da098d6aee", "from_id": "435fff26-763c-4528-906f-e8da098d6aee", "from_name": null, "from_type": "Indicator", "id": "0720e95f-959b-41a0-9112-0c42a03755a4", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--8c403433-2265-583d-b969-21dd39a58326", "toId": "657ff382-024b-45a4-974a-3e41f1762074", "to_id": "657ff382-024b-45a4-974a-3e41f1762074", "to_name": "Cobalt Strike - S0154", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.765Z", "created_at": "2026-09-26T05:48:49.048Z", "modified": "2026-09-26T05:48:49.270Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:48:49.270Z" }, "description_available": false, "entity_type": "indicates", "fromId": "1a15e67e-da7b-42ec-b24a-d47fd8aa0767", "from_id": "1a15e67e-da7b-42ec-b24a-d47fd8aa0767", "from_name": null, "from_type": "Indicator", "id": "076a6211-b4ef-44b9-a901-2d7ff0271b63", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--6d1272bb-291b-5fc3-80a8-47463817163c", "toId": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_id": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_name": "CrowDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.342Z", "created_at": "2026-09-26T05:37:16.290Z", "modified": "2026-09-26T05:37:16.486Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:37:16.486Z" }, "description_available": false, "entity_type": "indicates", "fromId": "94a7b3a6-0b64-4746-86ff-6647d1a2df8d", "from_id": "94a7b3a6-0b64-4746-86ff-6647d1a2df8d", "from_name": null, "from_type": "Indicator", "id": "07a82040-d5d8-469f-bdf8-93c22851bf6b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--12de9ef2-9c6e-5b27-978d-1db2e3611052", "toId": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_id": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_name": "Melofee", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.120Z", "created_at": "2026-09-26T05:58:35.680Z", "modified": "2026-09-26T05:58:35.883Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:58:35.883Z" }, "description_available": false, "entity_type": "indicates", "fromId": "52b56463-7f22-48f8-b036-35d89d2dabcb", "from_id": "52b56463-7f22-48f8-b036-35d89d2dabcb", "from_name": null, "from_type": "Indicator", "id": "07d24c51-e5b4-44a3-92f1-0fa393cf173f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--97101a94-5b8d-5c3b-957c-2af59f24a942", "toId": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_id": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_name": "PlugX - S0013", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.254Z", "created_at": "2026-09-26T06:01:38.722Z", "modified": "2026-09-26T06:01:39.033Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:01:39.033Z" }, "description_available": false, "entity_type": "indicates", "fromId": "09acd2d3-2afb-4de1-a147-7ae7904d3859", "from_id": "09acd2d3-2afb-4de1-a147-7ae7904d3859", "from_name": null, "from_type": "Indicator", "id": "090f3253-7852-4e0e-977e-d2cf8d5f3abd", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--7d01e3e0-0424-5667-b066-60945e2fb26b", "toId": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_id": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_name": "TernDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.594Z", "created_at": "2026-09-26T05:43:45.254Z", "modified": "2026-09-26T05:43:45.533Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:43:45.533Z" }, "description_available": false, "entity_type": "indicates", "fromId": "610b3366-3a08-4e4d-9f45-c8543a783a7f", "from_id": "610b3366-3a08-4e4d-9f45-c8543a783a7f", "from_name": null, "from_type": "Indicator", "id": "091a57b0-bf25-410c-9223-da98d220af29", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--15bf9446-0acb-52d1-a3f0-587e61ac93a0", "toId": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_id": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_name": "TernDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.234Z", "created_at": "2026-09-26T05:35:17.861Z", "modified": "2026-09-26T05:35:18.176Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:35:18.176Z" }, "description_available": false, "entity_type": "based-on", "fromId": "d7d77ca0-8c06-4de9-bacb-a526f344e2e9", "from_id": "d7d77ca0-8c06-4de9-bacb-a526f344e2e9", "from_name": null, "from_type": "Indicator", "id": "097ac828-f9a9-4858-9d7e-599c3ed26d26", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--5291482f-b7cc-5fd5-bc39-b6667c5be27b", "toId": "51f01700-015a-4847-b006-08292d4e3fa5", "to_id": "51f01700-015a-4847-b006-08292d4e3fa5", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.505Z", "created_at": "2026-09-26T06:07:56.191Z", "modified": "2026-09-26T06:07:56.416Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:07:56.416Z" }, "description_available": false, "entity_type": "indicates", "fromId": "781e0e33-439f-46a6-b565-9c9e6287a0ff", "from_id": "781e0e33-439f-46a6-b565-9c9e6287a0ff", "from_name": null, "from_type": "Indicator", "id": "0994ccb7-7769-4af5-b066-99b59b1027db", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--b0493629-43b4-53b6-9a42-b1f4202ac58f", "toId": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_id": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_name": "RatelS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.004Z", "created_at": "2026-09-26T05:54:57.468Z", "modified": "2026-09-26T05:54:57.908Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:54:57.908Z" }, "description_available": false, "entity_type": "indicates", "fromId": "26da206d-5fde-40ba-bc45-0f24f378263c", "from_id": "26da206d-5fde-40ba-bc45-0f24f378263c", "from_name": null, "from_type": "Indicator", "id": "0a3f602b-27fc-4e71-ade0-b0e02240fdee", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--87fac08e-ee80-5271-a11e-073bf5774148", "toId": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_id": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_name": "Spark - S0543", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.409Z", "created_at": "2026-09-26T06:05:50.958Z", "modified": "2026-09-26T06:05:51.321Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:05:51.321Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ac6046d8-f570-4eca-af26-b22ab4b74e00", "from_id": "ac6046d8-f570-4eca-af26-b22ab4b74e00", "from_name": null, "from_type": "Indicator", "id": "0a9126b5-9d22-4367-9b14-41ece61a7154", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--239e38db-bf3a-589a-a900-6f9b016f9874", "toId": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_id": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_name": "Spark - S0543", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.206Z", "created_at": "2026-09-26T06:00:18.107Z", "modified": "2026-09-26T06:00:18.561Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:00:18.561Z" }, "description_available": false, "entity_type": "indicates", "fromId": "f0b6cabc-d961-4c2b-a9a0-4075ac17972c", "from_id": "f0b6cabc-d961-4c2b-a9a0-4075ac17972c", "from_name": null, "from_type": "Indicator", "id": "0af5b377-127a-4290-9a4b-be9a0b749aba", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--858e0fc4-77b5-5e3a-a780-5ebcc67f6ebc", "toId": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_id": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_name": "Spark - S0543", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.570Z", "created_at": "2026-09-26T05:43:24.216Z", "modified": "2026-09-26T05:43:24.322Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:43:24.322Z" }, "description_available": false, "entity_type": "indicates", "fromId": "b5ad9feb-b128-47fb-9914-8319d0f48229", "from_id": "b5ad9feb-b128-47fb-9914-8319d0f48229", "from_name": null, "from_type": "Indicator", "id": "0b3fe509-82a5-4153-9487-fd0a9a7a97ac", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--87773f55-89f5-567c-a474-1c239f4cf296", "toId": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_id": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_name": "Spark - S0543", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.202Z", "created_at": "2026-09-26T05:35:07.009Z", "modified": "2026-09-26T05:35:08.718Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:35:08.718Z" }, "description_available": false, "entity_type": "based-on", "fromId": "f0b6cabc-d961-4c2b-a9a0-4075ac17972c", "from_id": "f0b6cabc-d961-4c2b-a9a0-4075ac17972c", "from_name": null, "from_type": "Indicator", "id": "0b77ad9a-ccb9-4b1c-824b-b6a660f9f8c5", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--0e181b93-e9f1-58da-9163-8a5d14f4a2ee", "toId": "c4ec9e93-b504-4f50-8451-fac10c9ad804", "to_id": "c4ec9e93-b504-4f50-8451-fac10c9ad804", "to_name": null, "to_type": "IPv4Addr" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.234Z", "created_at": "2026-09-26T06:00:56.987Z", "modified": "2026-09-26T06:00:58.839Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:00:58.839Z" }, "description_available": false, "entity_type": "indicates", "fromId": "aaf834aa-275b-4a6a-9790-6971e8adf52d", "from_id": "aaf834aa-275b-4a6a-9790-6971e8adf52d", "from_name": null, "from_type": "Indicator", "id": "0b84de68-21ee-4fb9-b092-7763cba63426", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--fbeaf5d9-8714-5460-8c01-232bc5ca95b0", "toId": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_id": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_name": "RatelS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.278Z", "created_at": "2026-09-26T05:35:58.280Z", "modified": "2026-09-26T05:35:58.509Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:35:58.509Z" }, "description_available": false, "entity_type": "indicates", "fromId": "48f22366-f0fd-4667-b458-fc531795e8ff", "from_id": "48f22366-f0fd-4667-b458-fc531795e8ff", "from_name": null, "from_type": "Indicator", "id": "0bcbcdf7-768e-4d1f-ac43-7054012011db", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--effb2d55-341f-5e38-9104-ef1e3da8fff6", "toId": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_id": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_name": "HelloBot", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.171Z", "created_at": "2026-09-26T05:59:31.034Z", "modified": "2026-09-26T05:59:32.555Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:59:32.555Z" }, "description_available": false, "entity_type": "indicates", "fromId": "350ff6fa-1c04-4870-b345-041e0d3d6d92", "from_id": "350ff6fa-1c04-4870-b345-041e0d3d6d92", "from_name": null, "from_type": "Indicator", "id": "0c03d4a9-3b66-440e-87ee-1ceaec646a71", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--0264e93d-8f2a-5192-9aed-4f55085832a4", "toId": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_id": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_name": "PlugX - S0013", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.177Z", "created_at": "2026-09-26T05:59:36.470Z", "modified": "2026-09-26T05:59:37.761Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:59:37.761Z" }, "description_available": false, "entity_type": "indicates", "fromId": "350ff6fa-1c04-4870-b345-041e0d3d6d92", "from_id": "350ff6fa-1c04-4870-b345-041e0d3d6d92", "from_name": null, "from_type": "Indicator", "id": "0c98e35a-bd5e-494d-9289-a2556cbdfc72", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--88944a97-d2f3-5024-845a-1347b1e0b90a", "toId": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_id": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_name": "CrowDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.527Z", "created_at": "2026-09-26T05:42:30.959Z", "modified": "2026-09-26T05:42:31.195Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:42:31.195Z" }, "description_available": false, "entity_type": "indicates", "fromId": "0eb188e3-885e-4084-abdf-6d4ba0098e64", "from_id": "0eb188e3-885e-4084-abdf-6d4ba0098e64", "from_name": null, "from_type": "Indicator", "id": "0cba897d-a6b9-48a6-ad29-a699ac791e4b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--ce6df219-fc8c-5651-9567-361118202ce8", "toId": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_id": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_name": "Spark - S0543", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.425Z", "created_at": "2026-09-26T06:06:11.110Z", "modified": "2026-09-26T06:06:11.379Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:06:11.379Z" }, "description_available": false, "entity_type": "indicates", "fromId": "313c8419-28b4-4ef9-9855-91d315819bf8", "from_id": "313c8419-28b4-4ef9-9855-91d315819bf8", "from_name": null, "from_type": "Indicator", "id": "0d22b518-71e1-42e1-8e7b-aa1fc11af24f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--2c1792eb-3804-54ae-9686-492c17fb5845", "toId": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_id": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_name": "Melofee", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.387Z", "created_at": "2026-09-26T06:05:19.399Z", "modified": "2026-09-26T06:05:19.537Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:05:19.537Z" }, "description_available": false, "entity_type": "indicates", "fromId": "2d16d740-ae8a-45ff-8a8b-9032f924c3fa", "from_id": "2d16d740-ae8a-45ff-8a8b-9032f924c3fa", "from_name": null, "from_type": "Indicator", "id": "0d964980-d9f6-40ec-9517-24692619a7c5", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--9882e324-70e7-54ca-b3d4-f3ab1e4901db", "toId": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_id": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_name": "Spark - S0543", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.248Z", "created_at": "2026-09-26T06:01:21.432Z", "modified": "2026-09-26T06:01:21.931Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:01:21.931Z" }, "description_available": false, "entity_type": "indicates", "fromId": "09acd2d3-2afb-4de1-a147-7ae7904d3859", "from_id": "09acd2d3-2afb-4de1-a147-7ae7904d3859", "from_name": null, "from_type": "Indicator", "id": "0dabed90-b828-4a39-adcc-6c31bad1d82f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--2fa65294-8d8a-5525-a56e-34bc0d972aaa", "toId": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_id": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_name": "HelloBot", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.457Z", "created_at": "2026-09-26T06:06:52.463Z", "modified": "2026-09-26T06:06:53.085Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:06:53.085Z" }, "description_available": false, "entity_type": "indicates", "fromId": "5330b1c5-bebb-4760-ae47-12dd0e0d1e23", "from_id": "5330b1c5-bebb-4760-ae47-12dd0e0d1e23", "from_name": null, "from_type": "Indicator", "id": "0df7a055-afc1-4aac-baa0-1b9bcf5f3b6d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--88714d04-7bb4-5215-901f-f7ba96a383bb", "toId": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_id": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_name": "Spark - S0543", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.674Z", "created_at": "2026-09-26T05:46:36.433Z", "modified": "2026-09-26T05:46:36.791Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:46:36.791Z" }, "description_available": false, "entity_type": "indicates", "fromId": "157ca5cb-7d34-4fc3-83d2-bac13ceb9804", "from_id": "157ca5cb-7d34-4fc3-83d2-bac13ceb9804", "from_name": null, "from_type": "Indicator", "id": "0e0997e6-12cc-4e4c-9ab0-e6e28e63969f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--e53a9d80-40b0-5580-ab9a-e5f3b5f41b31", "toId": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_id": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_name": "HelloBot", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.564Z", "created_at": "2026-09-26T05:43:23.873Z", "modified": "2026-09-26T05:43:24.033Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:43:24.033Z" }, "description_available": false, "entity_type": "indicates", "fromId": "b5ad9feb-b128-47fb-9914-8319d0f48229", "from_id": "b5ad9feb-b128-47fb-9914-8319d0f48229", "from_name": null, "from_type": "Indicator", "id": "0f365ea7-4c57-4f98-9c52-e0fb47dff17c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--1c8bd3bd-141f-5b56-94bf-786a549cff35", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.151Z", "created_at": "2026-09-26T05:59:06.390Z", "modified": "2026-09-26T05:59:06.581Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:59:06.581Z" }, "description_available": false, "entity_type": "indicates", "fromId": "56d609d1-e0ef-4633-8cfe-a3e1f792fbff", "from_id": "56d609d1-e0ef-4633-8cfe-a3e1f792fbff", "from_name": null, "from_type": "Indicator", "id": "0fc9ba0e-b8d5-4498-b0c9-47bbf1954b35", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--a2ba5488-5524-578d-b6f9-9adbc1da0551", "toId": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_id": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_name": "CrowDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.500Z", "created_at": "2026-09-26T05:42:00.385Z", "modified": "2026-09-26T05:42:01.423Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:42:01.423Z" }, "description_available": false, "entity_type": "indicates", "fromId": "435fff26-763c-4528-906f-e8da098d6aee", "from_id": "435fff26-763c-4528-906f-e8da098d6aee", "from_name": null, "from_type": "Indicator", "id": "108250b4-33eb-4f0e-986c-897bff74cfaf", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--87513c90-f093-506f-9d45-350dfdf792a9", "toId": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_id": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_name": "HelloBot", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.941Z", "created_at": "2026-09-26T05:53:32.397Z", "modified": "2026-09-26T05:53:32.596Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:53:32.596Z" }, "description_available": false, "entity_type": "indicates", "fromId": "1315ce2a-6659-4f4f-b9b7-e2450564ca9b", "from_id": "1315ce2a-6659-4f4f-b9b7-e2450564ca9b", "from_name": null, "from_type": "Indicator", "id": "109bd3fd-d34a-4d6a-bd30-43a22bb9d29c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--e557ce74-a995-50c9-b62f-5b7cdd7f6c35", "toId": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_id": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_name": "CrowDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.787Z", "created_at": "2026-09-26T05:49:21.297Z", "modified": "2026-09-26T05:49:21.620Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:49:21.620Z" }, "description_available": false, "entity_type": "indicates", "fromId": "8134c07a-eec8-489c-80e7-aca40ccc6268", "from_id": "8134c07a-eec8-489c-80e7-aca40ccc6268", "from_name": null, "from_type": "Indicator", "id": "109cf757-2ec2-4403-99b1-7195c14ad748", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--ea0e3107-5f27-5eb5-9980-822b237e5492", "toId": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_id": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_name": "TernDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.392Z", "created_at": "2026-09-26T05:39:36.447Z", "modified": "2026-09-26T05:39:36.753Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:39:36.753Z" }, "description_available": false, "entity_type": "indicates", "fromId": "8c1b4518-8219-46bb-a619-1c69182e4eec", "from_id": "8c1b4518-8219-46bb-a619-1c69182e4eec", "from_name": null, "from_type": "Indicator", "id": "11dc1eb3-b5c6-4270-bc72-86bc50e4a067", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--3cdcfee6-0b00-55a9-8270-31dd75021ebf", "toId": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_id": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_name": "Spark - S0543", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.506Z", "created_at": "2026-09-26T05:42:04.047Z", "modified": "2026-09-26T05:42:04.217Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:42:04.217Z" }, "description_available": false, "entity_type": "indicates", "fromId": "435fff26-763c-4528-906f-e8da098d6aee", "from_id": "435fff26-763c-4528-906f-e8da098d6aee", "from_name": null, "from_type": "Indicator", "id": "11e66a9f-3bb9-4fff-809b-c1a326c538b3", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--e2d3e56e-08da-5c04-a058-34af8ef1a0d1", "toId": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_id": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_name": "STOWAWAY", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.985Z", "created_at": "2026-09-26T05:54:32.958Z", "modified": "2026-09-26T05:54:33.161Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:54:33.161Z" }, "description_available": false, "entity_type": "indicates", "fromId": "2d8df4da-244f-458a-8c2d-ff67380121e9", "from_id": "2d8df4da-244f-458a-8c2d-ff67380121e9", "from_name": null, "from_type": "Indicator", "id": "1247a501-9c40-4a4a-858f-a1e23d596b12", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--971e4164-cc68-5614-bf9a-4d031fda1b1a", "toId": "208a45aa-c18e-4619-9a90-7004849cab40", "to_id": "208a45aa-c18e-4619-9a90-7004849cab40", "to_name": "HemiGate", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.365Z", "created_at": "2026-09-26T05:39:01.407Z", "modified": "2026-09-26T05:39:01.616Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:39:01.616Z" }, "description_available": false, "entity_type": "indicates", "fromId": "eb51ab90-3d38-4f58-84c1-b0700196508c", "from_id": "eb51ab90-3d38-4f58-84c1-b0700196508c", "from_name": null, "from_type": "Indicator", "id": "1249eb59-d387-4d52-8bd2-ed757bf08602", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--561759fa-a9ef-52ba-942e-9468594ff271", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.177Z", "created_at": "2026-09-26T05:59:34.432Z", "modified": "2026-09-26T05:59:34.590Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:59:34.590Z" }, "description_available": false, "entity_type": "indicates", "fromId": "350ff6fa-1c04-4870-b345-041e0d3d6d92", "from_id": "350ff6fa-1c04-4870-b345-041e0d3d6d92", "from_name": null, "from_type": "Indicator", "id": "1302b5fa-5ab8-49dd-b2f3-7d179998f34b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--c788d8e5-ba21-5395-b6a0-929951655e31", "toId": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_id": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_name": "STOWAWAY", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.630Z", "created_at": "2026-09-26T05:45:40.950Z", "modified": "2026-09-26T05:45:41.101Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:45:41.101Z" }, "description_available": false, "entity_type": "indicates", "fromId": "cdadaaa5-0866-4957-b6d7-c64be31a1cf9", "from_id": "cdadaaa5-0866-4957-b6d7-c64be31a1cf9", "from_name": null, "from_type": "Indicator", "id": "13abb5bc-c2cb-4b10-abad-8bb7cec99faf", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--3bfb89c8-0ad7-5629-b7ef-ef77a08e04a4", "toId": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_id": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_name": "Melofee", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.264Z", "created_at": "2026-09-26T05:35:33.122Z", "modified": "2026-09-26T05:35:33.291Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:35:33.291Z" }, "description_available": false, "entity_type": "indicates", "fromId": "f7f8f4c3-42b1-433b-a4ab-f67c83968004", "from_id": "f7f8f4c3-42b1-433b-a4ab-f67c83968004", "from_name": null, "from_type": "Indicator", "id": "13c42a03-99dd-4227-b516-9fb09234eff8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--6f1e0df8-f0cf-56c3-acbd-dcdd9c87aab4", "toId": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_id": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_name": "RatelS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.780Z", "created_at": "2026-09-26T05:49:15.679Z", "modified": "2026-09-26T05:49:15.958Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:49:15.958Z" }, "description_available": false, "entity_type": "indicates", "fromId": "8134c07a-eec8-489c-80e7-aca40ccc6268", "from_id": "8134c07a-eec8-489c-80e7-aca40ccc6268", "from_name": null, "from_type": "Indicator", "id": "145e4df4-bfe3-4519-a605-cac65761c072", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--067ea868-ca0b-5466-a2c7-650dcd412b0a", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.586Z", "created_at": "2026-09-26T06:11:15.369Z", "modified": "2026-09-26T06:11:15.756Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:11:15.756Z" }, "description_available": false, "entity_type": "indicates", "fromId": "e82e98a0-5491-4b41-82dd-1ffa975dde57", "from_id": "e82e98a0-5491-4b41-82dd-1ffa975dde57", "from_name": null, "from_type": "Indicator", "id": "146bb03f-e0c7-4203-9d3f-0383396b6b23", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--1a7c7758-2c38-5095-a503-2bffb2f59dce", "toId": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_id": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_name": "Melofee", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.612Z", "created_at": "2026-09-26T06:11:44.263Z", "modified": "2026-09-26T06:11:44.469Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:11:44.469Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d5009423-c128-4583-ac72-3f07f1201db6", "from_id": "d5009423-c128-4583-ac72-3f07f1201db6", "from_name": null, "from_type": "Indicator", "id": "14c2ee00-cb95-48e1-9bae-bf27fcd04d52", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--d79c2403-b23a-51e3-95d9-32eefd9b68ed", "toId": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_id": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_name": "HelloBot", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.408Z", "created_at": "2026-09-26T05:40:04.454Z", "modified": "2026-09-26T05:40:04.650Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:40:04.650Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d4aa073f-c77f-4db6-a515-5246469cf6b0", "from_id": "d4aa073f-c77f-4db6-a515-5246469cf6b0", "from_name": null, "from_type": "Indicator", "id": "15010e45-81af-45bf-8596-3d57e84afb10", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--1bffe166-424c-5071-8b4c-fba5c6e6b4fb", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.829Z", "created_at": "2026-09-26T05:51:44.889Z", "modified": "2026-09-26T05:51:45.077Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:51:45.077Z" }, "description_available": false, "entity_type": "indicates", "fromId": "10b221ff-1d17-4b38-ae27-73235f136031", "from_id": "10b221ff-1d17-4b38-ae27-73235f136031", "from_name": null, "from_type": "Indicator", "id": "15ad3284-873b-45a7-be60-33f4818e7507", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--1767a80e-9cc3-587e-b892-a1df322f73c2", "toId": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_id": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_name": "STOWAWAY", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.438Z", "created_at": "2026-09-26T05:40:40.475Z", "modified": "2026-09-26T05:40:40.674Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:40:40.674Z" }, "description_available": false, "entity_type": "indicates", "fromId": "01c74684-bdd9-45d1-84be-d24d189bcb28", "from_id": "01c74684-bdd9-45d1-84be-d24d189bcb28", "from_name": null, "from_type": "Indicator", "id": "17769d00-5169-4891-89b6-394e057d5ac3", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--2e1b14f5-3f26-5d1b-9209-933cf13a1f75", "toId": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_id": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_name": "STOWAWAY", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.621Z", "created_at": "2026-09-26T06:11:50.693Z", "modified": "2026-09-26T06:11:50.886Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:11:50.886Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d5009423-c128-4583-ac72-3f07f1201db6", "from_id": "d5009423-c128-4583-ac72-3f07f1201db6", "from_name": null, "from_type": "Indicator", "id": "17dc5c09-a77b-45aa-9bd1-feaf26b175e0", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--bee9e9b6-5320-544e-8bc4-0a77f8ba5acb", "toId": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_id": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_name": "RatelS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.388Z", "created_at": "2026-09-26T05:39:30.236Z", "modified": "2026-09-26T05:39:30.608Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:39:30.608Z" }, "description_available": false, "entity_type": "indicates", "fromId": "8c1b4518-8219-46bb-a619-1c69182e4eec", "from_id": "8c1b4518-8219-46bb-a619-1c69182e4eec", "from_name": null, "from_type": "Indicator", "id": "17eae38b-1eff-4eb5-bd37-37f103ed6108", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--f88cc7f1-61eb-58c0-85db-9c53ec2660ee", "toId": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_id": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_name": "PlugX - S0013", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.389Z", "created_at": "2026-09-26T06:05:20.637Z", "modified": "2026-09-26T06:05:20.899Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:05:20.899Z" }, "description_available": false, "entity_type": "indicates", "fromId": "2d16d740-ae8a-45ff-8a8b-9032f924c3fa", "from_id": "2d16d740-ae8a-45ff-8a8b-9032f924c3fa", "from_name": null, "from_type": "Indicator", "id": "17f15883-2b71-4094-aebc-52d896409a62", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--73542663-fca4-59c3-97a2-81dd1b95a358", "toId": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_id": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_name": "TernDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.459Z", "created_at": "2026-09-26T05:41:08.061Z", "modified": "2026-09-26T05:41:08.369Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:41:08.369Z" }, "description_available": false, "entity_type": "indicates", "fromId": "4ff9e994-0564-43c3-8240-004f20eb7d3f", "from_id": "4ff9e994-0564-43c3-8240-004f20eb7d3f", "from_name": null, "from_type": "Indicator", "id": "18c09bce-9881-4188-87a2-7b91add7c928", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--47289832-e1ea-5bb9-9575-13cf285a005e", "toId": "657ff382-024b-45a4-974a-3e41f1762074", "to_id": "657ff382-024b-45a4-974a-3e41f1762074", "to_name": "Cobalt Strike - S0154", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.090Z", "created_at": "2026-09-26T05:58:07.284Z", "modified": "2026-09-26T05:58:07.419Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:58:07.419Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d7f88a85-9ab3-45b8-982b-294d838461a6", "from_id": "d7f88a85-9ab3-45b8-982b-294d838461a6", "from_name": null, "from_type": "Indicator", "id": "18c5c279-68b8-4588-8133-62340d585e93", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--ce11e244-a780-5b9d-b500-2720e7c7ac5e", "toId": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_id": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_name": "PlugX - S0013", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.593Z", "created_at": "2026-09-26T05:43:44.536Z", "modified": "2026-09-26T05:43:44.737Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:43:44.737Z" }, "description_available": false, "entity_type": "indicates", "fromId": "610b3366-3a08-4e4d-9f45-c8543a783a7f", "from_id": "610b3366-3a08-4e4d-9f45-c8543a783a7f", "from_name": null, "from_type": "Indicator", "id": "192451b2-09ad-42bf-8e50-af76a9f107e9", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--a8b25e76-ba32-5b5d-b175-5821180c6c02", "toId": "657ff382-024b-45a4-974a-3e41f1762074", "to_id": "657ff382-024b-45a4-974a-3e41f1762074", "to_name": "Cobalt Strike - S0154", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.891Z", "created_at": "2026-09-26T05:52:41.475Z", "modified": "2026-09-26T05:52:41.623Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:52:41.623Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c77e0b5e-a168-4a6f-993c-bc7076c78285", "from_id": "c77e0b5e-a168-4a6f-993c-bc7076c78285", "from_name": null, "from_type": "Indicator", "id": "19fa0feb-0af4-465a-bd39-2789664f856d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--25542d6a-07f4-5b15-9e74-f5e914382bf8", "toId": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_id": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_name": "CrowDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.508Z", "created_at": "2026-09-26T05:42:05.475Z", "modified": "2026-09-26T05:42:05.808Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:42:05.808Z" }, "description_available": false, "entity_type": "indicates", "fromId": "435fff26-763c-4528-906f-e8da098d6aee", "from_id": "435fff26-763c-4528-906f-e8da098d6aee", "from_name": null, "from_type": "Indicator", "id": "1b2aa087-34df-428c-ad3d-00ba3b325f76", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--b0b2d8b1-5903-5b21-a869-43b21934b047", "toId": "208a45aa-c18e-4619-9a90-7004849cab40", "to_id": "208a45aa-c18e-4619-9a90-7004849cab40", "to_name": "HemiGate", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.337Z", "created_at": "2026-09-26T06:04:24.091Z", "modified": "2026-09-26T06:04:24.241Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:04:24.241Z" }, "description_available": false, "entity_type": "indicates", "fromId": "95ef732a-5859-4b75-a4ea-fd3cfe3f1618", "from_id": "95ef732a-5859-4b75-a4ea-fd3cfe3f1618", "from_name": null, "from_type": "Indicator", "id": "1b3c410d-6d21-4183-8a22-94e6838212b7", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--ead4c909-d2fd-51d7-8794-a81c5efa2ee9", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.317Z", "created_at": "2026-09-26T06:02:54.854Z", "modified": "2026-09-26T06:02:55.000Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:02:55.000Z" }, "description_available": false, "entity_type": "indicates", "fromId": "6fbf4d94-634a-4763-b0e5-0cbe6e9f67ea", "from_id": "6fbf4d94-634a-4763-b0e5-0cbe6e9f67ea", "from_name": null, "from_type": "Indicator", "id": "1b59251b-af2d-4fcc-b109-f666853f7ea9", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--5c3bc4fd-89a0-58b8-8f1b-68eca1235d65", "toId": "657ff382-024b-45a4-974a-3e41f1762074", "to_id": "657ff382-024b-45a4-974a-3e41f1762074", "to_name": "Cobalt Strike - S0154", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.857Z", "created_at": "2026-09-26T05:52:16.423Z", "modified": "2026-09-26T05:52:16.628Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:52:16.628Z" }, "description_available": false, "entity_type": "indicates", "fromId": "6ae45569-c03b-471f-80ff-50d7a804075a", "from_id": "6ae45569-c03b-471f-80ff-50d7a804075a", "from_name": null, "from_type": "Indicator", "id": "1b59fb65-8e4d-4e52-87bb-6fa3b27a13fb", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--277f54ae-d672-5cb9-8e7b-04619ee3269a", "toId": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_id": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_name": "RatelS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.758Z", "created_at": "2026-09-26T05:48:40.140Z", "modified": "2026-09-26T05:48:40.786Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:48:40.786Z" }, "description_available": false, "entity_type": "indicates", "fromId": "1a15e67e-da7b-42ec-b24a-d47fd8aa0767", "from_id": "1a15e67e-da7b-42ec-b24a-d47fd8aa0767", "from_name": null, "from_type": "Indicator", "id": "1b9ead50-a638-4544-9e52-70de30532190", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--01846ce6-c8bb-5154-b871-fc5f2d30d178", "toId": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_id": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_name": "Melofee", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.112Z", "created_at": "2026-09-26T05:35:03.833Z", "modified": "2026-09-26T05:35:04.289Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:35:04.289Z" }, "description_available": false, "entity_type": "based-on", "fromId": "cd0c196b-8e17-4794-80e8-7129d42950e2", "from_id": "cd0c196b-8e17-4794-80e8-7129d42950e2", "from_name": null, "from_type": "Indicator", "id": "1bb2a6c3-192d-47c5-b85f-185c69d876c7", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--08bd944d-b776-5570-8c28-4908f253b431", "toId": "4c992236-6476-4fe3-96f7-f527564a3c5a", "to_id": "4c992236-6476-4fe3-96f7-f527564a3c5a", "to_name": null, "to_type": "IPv4Addr" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.520Z", "created_at": "2026-09-26T06:08:24.727Z", "modified": "2026-09-26T06:08:25.038Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:08:25.038Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c08d31e4-ff5a-45b7-8880-330403eced75", "from_id": "c08d31e4-ff5a-45b7-8880-330403eced75", "from_name": null, "from_type": "Indicator", "id": "1be6d2c9-4251-4fac-9c53-d2cef44cd209", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--09e2cf0f-22b9-5062-a328-c48ba53e2940", "toId": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_id": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_name": "PlugX - S0013", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.831Z", "created_at": "2026-09-26T05:51:50.159Z", "modified": "2026-09-26T05:51:52.319Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:51:52.319Z" }, "description_available": false, "entity_type": "indicates", "fromId": "10b221ff-1d17-4b38-ae27-73235f136031", "from_id": "10b221ff-1d17-4b38-ae27-73235f136031", "from_name": null, "from_type": "Indicator", "id": "1c38eb4e-eb9c-4f21-a912-62294ba4ae26", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--d0c6949b-2090-5780-81a9-94105d0eafbd", "toId": "208a45aa-c18e-4619-9a90-7004849cab40", "to_id": "208a45aa-c18e-4619-9a90-7004849cab40", "to_name": "HemiGate", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.436Z", "created_at": "2026-09-26T06:06:23.374Z", "modified": "2026-09-26T06:06:23.573Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:06:23.573Z" }, "description_available": false, "entity_type": "indicates", "fromId": "313c8419-28b4-4ef9-9855-91d315819bf8", "from_id": "313c8419-28b4-4ef9-9855-91d315819bf8", "from_name": null, "from_type": "Indicator", "id": "1c8570c2-0e5b-48b3-8fac-cb4c2e958602", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--821e1801-6cbb-56b1-9d68-88f80befe257", "toId": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_id": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_name": "RatelS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.882Z", "created_at": "2026-09-26T05:52:33.962Z", "modified": "2026-09-26T05:52:34.205Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:52:34.205Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c77e0b5e-a168-4a6f-993c-bc7076c78285", "from_id": "c77e0b5e-a168-4a6f-993c-bc7076c78285", "from_name": null, "from_type": "Indicator", "id": "1c9368e7-1f14-44da-92be-bb7bf16ea91f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--4e1770ea-aae2-5204-a6ad-385044eb12c2", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.530Z", "created_at": "2026-09-26T05:42:32.587Z", "modified": "2026-09-26T05:42:32.814Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:42:32.814Z" }, "description_available": false, "entity_type": "indicates", "fromId": "0eb188e3-885e-4084-abdf-6d4ba0098e64", "from_id": "0eb188e3-885e-4084-abdf-6d4ba0098e64", "from_name": null, "from_type": "Indicator", "id": "1cb6f8b1-18f5-4c54-8a2d-74f8a2fa189d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--7ef80a18-6327-5d02-b2f9-8b5a0c24ef2c", "toId": "208a45aa-c18e-4619-9a90-7004849cab40", "to_id": "208a45aa-c18e-4619-9a90-7004849cab40", "to_name": "HemiGate", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.434Z", "created_at": "2026-09-26T06:06:19.739Z", "modified": "2026-09-26T06:06:19.938Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:06:19.938Z" }, "description_available": false, "entity_type": "indicates", "fromId": "313c8419-28b4-4ef9-9855-91d315819bf8", "from_id": "313c8419-28b4-4ef9-9855-91d315819bf8", "from_name": null, "from_type": "Indicator", "id": "1cbafb2a-3e94-4afb-a18f-b74c9c6b0f18", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--a9fe76fa-de84-541b-b6da-12057a983566", "toId": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_id": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_name": "STOWAWAY", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.596Z", "created_at": "2026-09-26T06:11:22.242Z", "modified": "2026-09-26T06:11:24.543Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:11:24.543Z" }, "description_available": false, "entity_type": "indicates", "fromId": "e82e98a0-5491-4b41-82dd-1ffa975dde57", "from_id": "e82e98a0-5491-4b41-82dd-1ffa975dde57", "from_name": null, "from_type": "Indicator", "id": "1dccd025-1015-40e9-9f55-43cb81fde305", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--1df49d26-ed11-5dca-95fb-21c4e9fb758c", "toId": "208a45aa-c18e-4619-9a90-7004849cab40", "to_id": "208a45aa-c18e-4619-9a90-7004849cab40", "to_name": "HemiGate", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.479Z", "created_at": "2026-09-26T05:41:27.532Z", "modified": "2026-09-26T05:41:28.260Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:41:28.260Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c2dcc828-9ae2-404f-a201-0074f26085ba", "from_id": "c2dcc828-9ae2-404f-a201-0074f26085ba", "from_name": null, "from_type": "Indicator", "id": "1ebfdf8f-5a92-4245-bd9c-3cf675aae771", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--b7ff8ffd-a16d-5d76-90b0-136a180d0d81", "toId": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_id": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_name": "PlugX - S0013", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.005Z", "created_at": "2026-09-26T05:54:58.129Z", "modified": "2026-09-26T05:54:58.275Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:54:58.275Z" }, "description_available": false, "entity_type": "indicates", "fromId": "26da206d-5fde-40ba-bc45-0f24f378263c", "from_id": "26da206d-5fde-40ba-bc45-0f24f378263c", "from_name": null, "from_type": "Indicator", "id": "1f17a3e4-3e1b-4276-8f89-61ab9c07810e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--931eaefe-a22b-5882-a6dd-54a7b775372b", "toId": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_id": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_name": "STOWAWAY", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.503Z", "created_at": "2026-09-26T06:07:54.520Z", "modified": "2026-09-26T06:07:54.832Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:07:54.832Z" }, "description_available": false, "entity_type": "indicates", "fromId": "781e0e33-439f-46a6-b565-9c9e6287a0ff", "from_id": "781e0e33-439f-46a6-b565-9c9e6287a0ff", "from_name": null, "from_type": "Indicator", "id": "1f2b1523-bbb5-4ffb-b62a-514a411da7e0", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--0574312a-4334-570d-8353-6989518ea100", "toId": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_id": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_name": "STOWAWAY", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.530Z", "created_at": "2026-09-26T05:42:33.061Z", "modified": "2026-09-26T05:42:33.305Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:42:33.305Z" }, "description_available": false, "entity_type": "indicates", "fromId": "0eb188e3-885e-4084-abdf-6d4ba0098e64", "from_id": "0eb188e3-885e-4084-abdf-6d4ba0098e64", "from_name": null, "from_type": "Indicator", "id": "20622f5b-e37c-4287-a8f2-af3bc2080e5e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--4b2b5518-8785-5f57-8233-36a6414a6d76", "toId": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_id": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_name": "RatelS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.893Z", "created_at": "2026-09-26T05:52:58.867Z", "modified": "2026-09-26T05:53:00.393Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:53:00.393Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c77e0b5e-a168-4a6f-993c-bc7076c78285", "from_id": "c77e0b5e-a168-4a6f-993c-bc7076c78285", "from_name": null, "from_type": "Indicator", "id": "20a133a6-71ff-44f2-8903-7c49877121b9", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--11b38838-84e3-5ade-a554-afaa86c01340", "toId": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_id": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_name": "RatelS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.801Z", "created_at": "2026-09-26T05:49:45.077Z", "modified": "2026-09-26T05:49:46.078Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:49:46.078Z" }, "description_available": false, "entity_type": "indicates", "fromId": "2227cc4b-afc7-4060-b897-a1a458d90abd", "from_id": "2227cc4b-afc7-4060-b897-a1a458d90abd", "from_name": null, "from_type": "Indicator", "id": "20e513d4-4a27-4813-bfe9-9494ddfba467", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--d8a93231-c6f2-5862-a339-edc01dc2e369", "toId": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_id": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_name": "Melofee", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.319Z", "created_at": "2026-09-26T05:36:50.626Z", "modified": "2026-09-26T05:36:50.798Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:36:50.798Z" }, "description_available": false, "entity_type": "indicates", "fromId": "b2490479-1c8f-4288-a8e1-23589e1535cf", "from_id": "b2490479-1c8f-4288-a8e1-23589e1535cf", "from_name": null, "from_type": "Indicator", "id": "2152d357-e93a-44aa-aba1-49cc7d70590a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--5e020f96-b623-5215-8913-a1d78b8e50d0", "toId": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_id": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_name": "Melofee", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.910Z", "created_at": "2026-09-26T05:53:02.132Z", "modified": "2026-09-26T05:53:02.320Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:53:02.320Z" }, "description_available": false, "entity_type": "indicates", "fromId": "fdaa0a79-121c-4e17-91bb-e23da88da18e", "from_id": "fdaa0a79-121c-4e17-91bb-e23da88da18e", "from_name": null, "from_type": "Indicator", "id": "2163d020-e09a-4c32-a8d3-a2c72463bcd7", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--03244780-21aa-5dbd-b1e1-9d93bd99d0d9", "toId": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_id": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_name": "PlugX - S0013", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.105Z", "created_at": "2026-09-26T05:34:59.964Z", "modified": "2026-09-26T05:35:02.029Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:35:02.029Z" }, "description_available": false, "entity_type": "based-on", "fromId": "2497f466-fac3-4bfc-ab1f-5ebcf363283b", "from_id": "2497f466-fac3-4bfc-ab1f-5ebcf363283b", "from_name": null, "from_type": "Indicator", "id": "216e5bfb-0742-4362-b80b-10c8f46859b8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--e0c3be98-851e-51e1-9b07-f21dd2623100", "toId": "ca8da3f5-7f0e-44c2-a7fa-6ac0dc228591", "to_id": "ca8da3f5-7f0e-44c2-a7fa-6ac0dc228591", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.102Z", "created_at": "2026-09-26T05:34:59.964Z", "modified": "2026-09-26T05:35:02.030Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:35:02.030Z" }, "description_available": false, "entity_type": "based-on", "fromId": "1315ce2a-6659-4f4f-b9b7-e2450564ca9b", "from_id": "1315ce2a-6659-4f4f-b9b7-e2450564ca9b", "from_name": null, "from_type": "Indicator", "id": "21ac491b-467b-4601-997b-378bd957872c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--ea431aed-1462-599a-a3fd-52404744e38d", "toId": "78bce55a-b598-436c-956d-75bca2e1d662", "to_id": "78bce55a-b598-436c-956d-75bca2e1d662", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.122Z", "created_at": "2026-09-26T05:35:05.144Z", "modified": "2026-09-26T05:35:06.099Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:35:06.099Z" }, "description_available": false, "entity_type": "based-on", "fromId": "52b56463-7f22-48f8-b036-35d89d2dabcb", "from_id": "52b56463-7f22-48f8-b036-35d89d2dabcb", "from_name": null, "from_type": "Indicator", "id": "21c2ded5-2488-4873-95c7-30a87b7ecc03", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--449591c1-ef7d-5817-897b-908eba980fe8", "toId": "b8f3a636-2804-4e40-bf6e-d055e9b61462", "to_id": "b8f3a636-2804-4e40-bf6e-d055e9b61462", "to_name": null, "to_type": "IPv4Addr" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.255Z", "created_at": "2026-09-26T06:01:32.177Z", "modified": "2026-09-26T06:01:32.401Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:01:32.401Z" }, "description_available": false, "entity_type": "indicates", "fromId": "09acd2d3-2afb-4de1-a147-7ae7904d3859", "from_id": "09acd2d3-2afb-4de1-a147-7ae7904d3859", "from_name": null, "from_type": "Indicator", "id": "22addc6f-b25f-4bb0-8a8c-4c5891f724b7", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--78a6fcb1-606e-51b1-b698-0ae6cdb5dd99", "toId": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_id": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_name": "RatelS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.069Z", "created_at": "2026-09-26T05:56:31.153Z", "modified": "2026-09-26T05:56:32.232Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:56:32.232Z" }, "description_available": false, "entity_type": "indicates", "fromId": "66f40cca-cc72-4806-beef-47ae23125e5f", "from_id": "66f40cca-cc72-4806-beef-47ae23125e5f", "from_name": null, "from_type": "Indicator", "id": "2304ae04-2f3d-4332-8073-1c452e9ae62c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--0bd1dbb7-1714-5048-b1d6-7444c3c02c4f", "toId": "657ff382-024b-45a4-974a-3e41f1762074", "to_id": "657ff382-024b-45a4-974a-3e41f1762074", "to_name": "Cobalt Strike - S0154", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.566Z", "created_at": "2026-09-26T05:43:21.889Z", "modified": "2026-09-26T05:43:22.139Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:43:22.139Z" }, "description_available": false, "entity_type": "indicates", "fromId": "b5ad9feb-b128-47fb-9914-8319d0f48229", "from_id": "b5ad9feb-b128-47fb-9914-8319d0f48229", "from_name": null, "from_type": "Indicator", "id": "2394553e-4e0c-4e33-bf4a-8510a288877f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--6f37b5d9-240d-5ac6-9c9d-fcb8ea1c5fea", "toId": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_id": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_name": "PlugX - S0013", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.027Z", "created_at": "2026-09-26T05:34:42.912Z", "modified": "2026-09-26T05:34:43.663Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:34:43.663Z" }, "description_available": false, "entity_type": "based-on", "fromId": "8c1b4518-8219-46bb-a619-1c69182e4eec", "from_id": "8c1b4518-8219-46bb-a619-1c69182e4eec", "from_name": null, "from_type": "Indicator", "id": "23accae7-b7ae-4fff-bcfa-7007636f8d3d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--ef8a13c2-4a2c-53bd-8c29-3f95d56d2662", "toId": "2946350a-219e-4fc3-a946-0b21873bc1b2", "to_id": "2946350a-219e-4fc3-a946-0b21873bc1b2", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.393Z", "created_at": "2026-09-26T05:39:37.362Z", "modified": "2026-09-26T05:39:37.815Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:39:37.815Z" }, "description_available": false, "entity_type": "indicates", "fromId": "8c1b4518-8219-46bb-a619-1c69182e4eec", "from_id": "8c1b4518-8219-46bb-a619-1c69182e4eec", "from_name": null, "from_type": "Indicator", "id": "2490b13e-8dcc-48c4-a353-cd788a157399", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--eb4b7d46-9481-5bd0-b6d3-c3017b92393d", "toId": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_id": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_name": "STOWAWAY", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.246Z", "created_at": "2026-09-26T06:01:18.826Z", "modified": "2026-09-26T06:01:19.032Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:01:19.032Z" }, "description_available": false, "entity_type": "indicates", "fromId": "09acd2d3-2afb-4de1-a147-7ae7904d3859", "from_id": "09acd2d3-2afb-4de1-a147-7ae7904d3859", "from_name": null, "from_type": "Indicator", "id": "2492bd03-8c97-4051-bb89-ee938fb97afc", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--3d05bc61-bb5f-5d57-8042-39ab9dbd2a7f", "toId": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_id": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_name": "Melofee", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.395Z", "created_at": "2026-09-26T05:39:44.207Z", "modified": "2026-09-26T05:39:44.451Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:39:44.451Z" }, "description_available": false, "entity_type": "indicates", "fromId": "8c1b4518-8219-46bb-a619-1c69182e4eec", "from_id": "8c1b4518-8219-46bb-a619-1c69182e4eec", "from_name": null, "from_type": "Indicator", "id": "24b478ae-b4ab-4c97-9f29-2d6c871cb5be", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--2492f0c5-5c96-5524-a388-922c7155fdeb", "toId": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_id": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_name": "RatelS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.006Z", "created_at": "2026-09-26T05:55:00.477Z", "modified": "2026-09-26T05:55:00.851Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:55:00.851Z" }, "description_available": false, "entity_type": "indicates", "fromId": "26da206d-5fde-40ba-bc45-0f24f378263c", "from_id": "26da206d-5fde-40ba-bc45-0f24f378263c", "from_name": null, "from_type": "Indicator", "id": "25692b46-81ba-48ba-bf8e-a2a889ed1481", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--1d760973-5cc3-5d3e-a754-23f179c1480d", "toId": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_id": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_name": "TernDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.738Z", "created_at": "2026-09-26T05:48:08.082Z", "modified": "2026-09-26T05:48:08.280Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:48:08.280Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ce5e270a-a0f5-4d07-9faf-6493364c1a2b", "from_id": "ce5e270a-a0f5-4d07-9faf-6493364c1a2b", "from_name": null, "from_type": "Indicator", "id": "256b7731-0f7f-433e-86a3-33e128a7a195", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--4d816649-ee0f-5530-a7c4-798d1a79dd11", "toId": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_id": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_name": "PlugX - S0013", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.721Z", "created_at": "2026-09-26T05:47:50.297Z", "modified": "2026-09-26T05:47:50.561Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:47:50.561Z" }, "description_available": false, "entity_type": "indicates", "fromId": "de51cd6f-4b7a-4c4b-9b3d-d5094f650356", "from_id": "de51cd6f-4b7a-4c4b-9b3d-d5094f650356", "from_name": null, "from_type": "Indicator", "id": "26b6362a-7073-497c-8355-9d342cf4b723", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--fd1ed2f6-df9b-5f3d-a7cb-f50def318d1d", "toId": "657ff382-024b-45a4-974a-3e41f1762074", "to_id": "657ff382-024b-45a4-974a-3e41f1762074", "to_name": "Cobalt Strike - S0154", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.269Z", "created_at": "2026-09-26T06:01:59.687Z", "modified": "2026-09-26T06:02:01.021Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:02:01.021Z" }, "description_available": false, "entity_type": "indicates", "fromId": "2c0b3e29-5bb5-4044-8031-4f47cd51a008", "from_id": "2c0b3e29-5bb5-4044-8031-4f47cd51a008", "from_name": null, "from_type": "Indicator", "id": "26f04dd5-2714-4260-932f-dd981ed55bda", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--6b3956fb-dd74-5791-8ccd-cf910ca8c20d", "toId": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_id": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_name": "HelloBot", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.041Z", "created_at": "2026-09-26T05:55:54.387Z", "modified": "2026-09-26T05:55:54.636Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:55:54.636Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ea8ff45b-69d1-4069-bebe-6f7107045959", "from_id": "ea8ff45b-69d1-4069-bebe-6f7107045959", "from_name": null, "from_type": "Indicator", "id": "270f11b9-d688-4c0c-a950-a22ccf980fa0", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--2f94d5e4-b866-5b5f-b18a-89b6b3613b86", "toId": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_id": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_name": "Melofee", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.460Z", "created_at": "2026-09-26T06:06:54.395Z", "modified": "2026-09-26T06:06:54.735Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:06:54.735Z" }, "description_available": false, "entity_type": "indicates", "fromId": "5330b1c5-bebb-4760-ae47-12dd0e0d1e23", "from_id": "5330b1c5-bebb-4760-ae47-12dd0e0d1e23", "from_name": null, "from_type": "Indicator", "id": "2778e7b5-2be8-47c7-a6d8-2a6d58ca207c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--19ae9075-3e56-56d8-9390-dba4a35e54bc", "toId": "208a45aa-c18e-4619-9a90-7004849cab40", "to_id": "208a45aa-c18e-4619-9a90-7004849cab40", "to_name": "HemiGate", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.263Z", "created_at": "2026-09-26T05:35:32.242Z", "modified": "2026-09-26T05:35:32.566Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:35:32.566Z" }, "description_available": false, "entity_type": "indicates", "fromId": "f7f8f4c3-42b1-433b-a4ab-f67c83968004", "from_id": "f7f8f4c3-42b1-433b-a4ab-f67c83968004", "from_name": null, "from_type": "Indicator", "id": "27f7319c-ce65-4c68-aa9c-0068f42c717e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--61734fcd-2b67-5e50-9fa0-4ea69a75d229", "toId": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_id": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_name": "TernDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.481Z", "created_at": "2026-09-26T06:07:21.585Z", "modified": "2026-09-26T06:07:22.969Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:07:22.969Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d7d77ca0-8c06-4de9-bacb-a526f344e2e9", "from_id": "d7d77ca0-8c06-4de9-bacb-a526f344e2e9", "from_name": null, "from_type": "Indicator", "id": "280d0da9-6400-417e-9180-6c6a26d7d703", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--4526b700-a301-5004-ad54-b16b2bcfee0f", "toId": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_id": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_name": "STOWAWAY", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.744Z", "created_at": "2026-09-26T05:48:23.372Z", "modified": "2026-09-26T05:48:24.384Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:48:24.384Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ce5e270a-a0f5-4d07-9faf-6493364c1a2b", "from_id": "ce5e270a-a0f5-4d07-9faf-6493364c1a2b", "from_name": null, "from_type": "Indicator", "id": "28127724-2b75-4ca8-8cfa-2d0db3190196", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--1483b743-9664-5788-adb8-b66f14538d45", "toId": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_id": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_name": "CrowDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.312Z", "created_at": "2026-09-26T06:02:50.038Z", "modified": "2026-09-26T06:02:50.224Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:02:50.224Z" }, "description_available": false, "entity_type": "indicates", "fromId": "6fbf4d94-634a-4763-b0e5-0cbe6e9f67ea", "from_id": "6fbf4d94-634a-4763-b0e5-0cbe6e9f67ea", "from_name": null, "from_type": "Indicator", "id": "284375c2-99a6-4f20-b3da-7c4bef4e6618", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--ae9b7c54-43b5-5ec7-842e-11f9ef2c3734", "toId": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_id": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_name": "HelloBot", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.519Z", "created_at": "2026-09-26T06:08:23.763Z", "modified": "2026-09-26T06:08:24.221Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:08:24.221Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c08d31e4-ff5a-45b7-8880-330403eced75", "from_id": "c08d31e4-ff5a-45b7-8880-330403eced75", "from_name": null, "from_type": "Indicator", "id": "28b5f2a1-2702-41a0-a806-43eaf5155632", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--751c550d-37a6-5138-9391-2f357e744139", "toId": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_id": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_name": "HelloBot", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.439Z", "created_at": "2026-09-26T05:40:40.003Z", "modified": "2026-09-26T05:40:40.232Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:40:40.232Z" }, "description_available": false, "entity_type": "indicates", "fromId": "01c74684-bdd9-45d1-84be-d24d189bcb28", "from_id": "01c74684-bdd9-45d1-84be-d24d189bcb28", "from_name": null, "from_type": "Indicator", "id": "29ef229b-f37d-4d43-9b76-90c250c72519", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--025afeca-7a85-587a-8a1f-a2778c725c74", "toId": "208a45aa-c18e-4619-9a90-7004849cab40", "to_id": "208a45aa-c18e-4619-9a90-7004849cab40", "to_name": "HemiGate", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.483Z", "created_at": "2026-09-26T05:41:33.600Z", "modified": "2026-09-26T05:41:33.843Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:41:33.843Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c2dcc828-9ae2-404f-a201-0074f26085ba", "from_id": "c2dcc828-9ae2-404f-a201-0074f26085ba", "from_name": null, "from_type": "Indicator", "id": "29f59b93-391d-4e89-a940-9360fd66d206", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--f333f34e-b85d-5fd0-8286-902ff5fc279c", "toId": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_id": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_name": "Spark - S0543", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.350Z", "created_at": "2026-09-26T05:37:28.228Z", "modified": "2026-09-26T05:37:28.480Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:37:28.480Z" }, "description_available": false, "entity_type": "indicates", "fromId": "94a7b3a6-0b64-4746-86ff-6647d1a2df8d", "from_id": "94a7b3a6-0b64-4746-86ff-6647d1a2df8d", "from_name": null, "from_type": "Indicator", "id": "2a06b573-1144-4b0f-8860-3455dd6ee66c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--20a41ea7-71a9-57a3-9dfe-17ff53e118b1", "toId": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_id": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_name": "STOWAWAY", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.547Z", "created_at": "2026-09-26T06:09:11.434Z", "modified": "2026-09-26T06:09:13.288Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:09:13.288Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c9493e20-dc6a-4938-8fee-746005c4ae07", "from_id": "c9493e20-dc6a-4938-8fee-746005c4ae07", "from_name": null, "from_type": "Indicator", "id": "2b0e8752-d33e-495f-9269-b3843aa6e43b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--0aa19dab-b4df-5abd-8f6d-2b00e202f92c", "toId": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_id": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_name": "STOWAWAY", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.129Z", "created_at": "2026-09-26T05:58:40.215Z", "modified": "2026-09-26T05:58:40.400Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:58:40.400Z" }, "description_available": false, "entity_type": "indicates", "fromId": "52b56463-7f22-48f8-b036-35d89d2dabcb", "from_id": "52b56463-7f22-48f8-b036-35d89d2dabcb", "from_name": null, "from_type": "Indicator", "id": "2b5fc02b-c5ed-43dd-933d-8c91188eff94", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--e3746229-66b3-54a0-9859-41449dd964fc", "toId": "208a45aa-c18e-4619-9a90-7004849cab40", "to_id": "208a45aa-c18e-4619-9a90-7004849cab40", "to_name": "HemiGate", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.110Z", "created_at": "2026-09-26T05:35:03.825Z", "modified": "2026-09-26T05:35:04.238Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:35:04.238Z" }, "description_available": false, "entity_type": "based-on", "fromId": "26da206d-5fde-40ba-bc45-0f24f378263c", "from_id": "26da206d-5fde-40ba-bc45-0f24f378263c", "from_name": null, "from_type": "Indicator", "id": "2b99d8ba-907e-4679-abc0-be14682db8ac", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--1ee3a6c9-7396-54a7-8740-ba6ce248c295", "toId": "770e49ee-7bed-41b3-a341-8a41d6bd0258", "to_id": "770e49ee-7bed-41b3-a341-8a41d6bd0258", "to_name": null, "to_type": "IPv4Addr" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.546Z", "created_at": "2026-09-26T06:09:00.672Z", "modified": "2026-09-26T06:09:00.903Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:09:00.903Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c9493e20-dc6a-4938-8fee-746005c4ae07", "from_id": "c9493e20-dc6a-4938-8fee-746005c4ae07", "from_name": null, "from_type": "Indicator", "id": "2c175bdc-6022-4279-b108-b10c1e36e6aa", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--cd786c25-0d3d-52ec-9200-624eb8248a69", "toId": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_id": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_name": "Spark - S0543", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.452Z", "created_at": "2026-09-26T06:06:50.364Z", "modified": "2026-09-26T06:06:50.562Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:06:50.562Z" }, "description_available": false, "entity_type": "indicates", "fromId": "5330b1c5-bebb-4760-ae47-12dd0e0d1e23", "from_id": "5330b1c5-bebb-4760-ae47-12dd0e0d1e23", "from_name": null, "from_type": "Indicator", "id": "2c51aa61-592d-440c-bd85-d5bac224f006", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--80d1f20a-7245-5b75-b141-3b90d1a19ef4", "toId": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_id": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_name": "HelloBot", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.477Z", "created_at": "2026-09-26T05:41:27.185Z", "modified": "2026-09-26T05:41:27.335Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:41:27.335Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c2dcc828-9ae2-404f-a201-0074f26085ba", "from_id": "c2dcc828-9ae2-404f-a201-0074f26085ba", "from_name": null, "from_type": "Indicator", "id": "2cd156d2-9899-461b-8108-2e31985a340a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--8011942c-a3c6-57ea-a962-0a3b1d1445b2", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.043Z", "created_at": "2026-09-26T05:55:55.607Z", "modified": "2026-09-26T05:55:55.826Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:55:55.826Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ea8ff45b-69d1-4069-bebe-6f7107045959", "from_id": "ea8ff45b-69d1-4069-bebe-6f7107045959", "from_name": null, "from_type": "Indicator", "id": "2cd32f32-1098-43bb-94c6-3e690803ee0c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--ae0568c4-f4b4-56e1-be01-9ab82e4e9ae7", "toId": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_id": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_name": "PlugX - S0013", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.525Z", "created_at": "2026-09-26T06:08:31.716Z", "modified": "2026-09-26T06:08:31.956Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:08:31.956Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c08d31e4-ff5a-45b7-8880-330403eced75", "from_id": "c08d31e4-ff5a-45b7-8880-330403eced75", "from_name": null, "from_type": "Indicator", "id": "2d444149-0d2f-4a33-b965-ddf9230cca2f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--fd8c573c-0fb9-5ef1-b0b1-1875016fe7da", "toId": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_id": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_name": "STOWAWAY", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.453Z", "created_at": "2026-09-26T05:40:56.089Z", "modified": "2026-09-26T05:40:56.295Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:40:56.295Z" }, "description_available": false, "entity_type": "indicates", "fromId": "4ff9e994-0564-43c3-8240-004f20eb7d3f", "from_id": "4ff9e994-0564-43c3-8240-004f20eb7d3f", "from_name": null, "from_type": "Indicator", "id": "2d55fc19-fa80-4742-b954-7f1ecb4be68e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--055821ae-15d4-52bc-80aa-91ca2315c3c8", "toId": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_id": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_name": "Melofee", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.338Z", "created_at": "2026-09-26T06:04:22.951Z", "modified": "2026-09-26T06:04:23.850Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:04:23.850Z" }, "description_available": false, "entity_type": "indicates", "fromId": "95ef732a-5859-4b75-a4ea-fd3cfe3f1618", "from_id": "95ef732a-5859-4b75-a4ea-fd3cfe3f1618", "from_name": null, "from_type": "Indicator", "id": "2d650473-b361-4d04-81e3-b5aab55f9c69", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--8fa6d3ec-d577-54cd-b456-a1be91cca103", "toId": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_id": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_name": "PlugX - S0013", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.481Z", "created_at": "2026-09-26T06:07:21.036Z", "modified": "2026-09-26T06:07:21.227Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:07:21.227Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d7d77ca0-8c06-4de9-bacb-a526f344e2e9", "from_id": "d7d77ca0-8c06-4de9-bacb-a526f344e2e9", "from_name": null, "from_type": "Indicator", "id": "2d8bd693-56b9-428a-b0aa-cbf3e8f551d2", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--19c75822-9396-59b3-adee-c4b9e300b40c", "toId": "657ff382-024b-45a4-974a-3e41f1762074", "to_id": "657ff382-024b-45a4-974a-3e41f1762074", "to_name": "Cobalt Strike - S0154", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.477Z", "created_at": "2026-09-26T05:41:25.731Z", "modified": "2026-09-26T05:41:25.959Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:41:25.959Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c2dcc828-9ae2-404f-a201-0074f26085ba", "from_id": "c2dcc828-9ae2-404f-a201-0074f26085ba", "from_name": null, "from_type": "Indicator", "id": "2df92349-157e-4792-ad66-b1f162d3af7b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--e532dace-319e-5ac0-8fce-9977022e94bd", "toId": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_id": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_name": "Melofee", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.100Z", "created_at": "2026-09-26T05:58:15.584Z", "modified": "2026-09-26T05:58:15.890Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:58:15.890Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d7f88a85-9ab3-45b8-982b-294d838461a6", "from_id": "d7f88a85-9ab3-45b8-982b-294d838461a6", "from_name": null, "from_type": "Indicator", "id": "2eec076a-f8e9-477c-8672-fc5e51063f34", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--34b43b14-8d03-5491-a50f-e4c197607f4b", "toId": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_id": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_name": "RatelS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.460Z", "created_at": "2026-09-26T06:06:53.921Z", "modified": "2026-09-26T06:06:54.103Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:06:54.103Z" }, "description_available": false, "entity_type": "indicates", "fromId": "5330b1c5-bebb-4760-ae47-12dd0e0d1e23", "from_id": "5330b1c5-bebb-4760-ae47-12dd0e0d1e23", "from_name": null, "from_type": "Indicator", "id": "2f75263d-153e-41d1-84ad-8c3f2ce48ad8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--944e4771-d672-506a-be41-5818364a3384", "toId": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_id": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_name": "TernDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.125Z", "created_at": "2026-09-26T05:58:37.955Z", "modified": "2026-09-26T05:58:38.102Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:58:38.102Z" }, "description_available": false, "entity_type": "indicates", "fromId": "52b56463-7f22-48f8-b036-35d89d2dabcb", "from_id": "52b56463-7f22-48f8-b036-35d89d2dabcb", "from_name": null, "from_type": "Indicator", "id": "2ffab591-54f6-4b0f-a0a6-93ddd988c595", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--ca9f147f-9128-58d0-80cc-8dffefd0dae9", "toId": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_id": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_name": "Spark - S0543", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.044Z", "created_at": "2026-09-26T05:34:47.231Z", "modified": "2026-09-26T05:34:48.299Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:34:48.299Z" }, "description_available": false, "entity_type": "based-on", "fromId": "653baf3a-7205-44e8-bf30-e40825fbf42a", "from_id": "653baf3a-7205-44e8-bf30-e40825fbf42a", "from_name": null, "from_type": "Indicator", "id": "316513f5-2440-4d36-85de-74cf35881bbe", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--85931192-48e0-5f41-a50e-93e59803c50e", "toId": "9ad9ffb0-21a9-41e9-8ba4-eb7a850a99d7", "to_id": "9ad9ffb0-21a9-41e9-8ba4-eb7a850a99d7", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.344Z", "created_at": "2026-09-26T05:37:19.659Z", "modified": "2026-09-26T05:37:20.102Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:37:20.102Z" }, "description_available": false, "entity_type": "indicates", "fromId": "94a7b3a6-0b64-4746-86ff-6647d1a2df8d", "from_id": "94a7b3a6-0b64-4746-86ff-6647d1a2df8d", "from_name": null, "from_type": "Indicator", "id": "3179d968-8ec7-4c33-93da-e60a3ff94347", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--58149ee9-316a-593f-ac50-acb7b8945d9c", "toId": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_id": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_name": "PlugX - S0013", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.564Z", "created_at": "2026-09-26T05:43:20.912Z", "modified": "2026-09-26T05:43:21.131Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:43:21.131Z" }, "description_available": false, "entity_type": "indicates", "fromId": "b5ad9feb-b128-47fb-9914-8319d0f48229", "from_id": "b5ad9feb-b128-47fb-9914-8319d0f48229", "from_name": null, "from_type": "Indicator", "id": "319f2213-260f-4eaf-b38a-7c054367cccc", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--8b2c1410-4749-552e-ae51-a4071d377935", "toId": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_id": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_name": "Melofee", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.364Z", "created_at": "2026-09-26T05:38:57.457Z", "modified": "2026-09-26T05:38:58.036Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:38:58.036Z" }, "description_available": false, "entity_type": "indicates", "fromId": "eb51ab90-3d38-4f58-84c1-b0700196508c", "from_id": "eb51ab90-3d38-4f58-84c1-b0700196508c", "from_name": null, "from_type": "Indicator", "id": "31a83d78-bd81-4efe-b98f-0a614b117eba", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--7fa3690a-9df5-52ea-b9a2-6b9927349670", "toId": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_id": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_name": "Melofee", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.658Z", "created_at": "2026-09-26T05:46:07.609Z", "modified": "2026-09-26T05:46:07.804Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:46:07.804Z" }, "description_available": false, "entity_type": "indicates", "fromId": "681c2240-1fb8-466d-a533-8f1d8132b27b", "from_id": "681c2240-1fb8-466d-a533-8f1d8132b27b", "from_name": null, "from_type": "Indicator", "id": "326d7dde-3423-4717-9846-230e5f68fa20", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--6c5c374b-5776-59e2-8f62-464645f2871f", "toId": "657ff382-024b-45a4-974a-3e41f1762074", "to_id": "657ff382-024b-45a4-974a-3e41f1762074", "to_name": "Cobalt Strike - S0154", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.130Z", "created_at": "2026-09-26T05:58:41.646Z", "modified": "2026-09-26T05:58:41.785Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:58:41.785Z" }, "description_available": false, "entity_type": "indicates", "fromId": "52b56463-7f22-48f8-b036-35d89d2dabcb", "from_id": "52b56463-7f22-48f8-b036-35d89d2dabcb", "from_name": null, "from_type": "Indicator", "id": "328058f4-86b1-4e10-b3d0-5e4c6577444f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--64470000-9178-548b-b583-cd9b520f437b", "toId": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_id": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_name": "RatelS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.383Z", "created_at": "2026-09-26T06:05:16.089Z", "modified": "2026-09-26T06:05:16.521Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:05:16.521Z" }, "description_available": false, "entity_type": "indicates", "fromId": "2d16d740-ae8a-45ff-8a8b-9032f924c3fa", "from_id": "2d16d740-ae8a-45ff-8a8b-9032f924c3fa", "from_name": null, "from_type": "Indicator", "id": "3286d192-4113-480f-bb91-952679194b25", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--65dbb01c-4712-5488-b63a-53bdcc590d92", "toId": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_id": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_name": "HelloBot", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.034Z", "created_at": "2026-09-26T05:34:44.215Z", "modified": "2026-09-26T05:34:46.012Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:34:46.012Z" }, "description_available": false, "entity_type": "based-on", "fromId": "4ff9e994-0564-43c3-8240-004f20eb7d3f", "from_id": "4ff9e994-0564-43c3-8240-004f20eb7d3f", "from_name": null, "from_type": "Indicator", "id": "329b5fe1-05d7-4e55-99fa-674efd16a9cb", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--658e768a-7f62-55b4-b494-ae641d2a1c1c", "toId": "de6cfc4d-a139-4133-8ce1-195a0b3fd5c5", "to_id": "de6cfc4d-a139-4133-8ce1-195a0b3fd5c5", "to_name": null, "to_type": "IPv4Addr" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.316Z", "created_at": "2026-09-26T06:02:54.376Z", "modified": "2026-09-26T06:02:54.635Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:02:54.635Z" }, "description_available": false, "entity_type": "indicates", "fromId": "6fbf4d94-634a-4763-b0e5-0cbe6e9f67ea", "from_id": "6fbf4d94-634a-4763-b0e5-0cbe6e9f67ea", "from_name": null, "from_type": "Indicator", "id": "32bcfd6a-3742-4c02-93d7-a0833034d894", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--f2bf59ec-6cfa-5f74-9800-637b0be04926", "toId": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_id": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_name": "Spark - S0543", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.611Z", "created_at": "2026-09-26T06:11:45.114Z", "modified": "2026-09-26T06:11:45.401Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:11:45.401Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d5009423-c128-4583-ac72-3f07f1201db6", "from_id": "d5009423-c128-4583-ac72-3f07f1201db6", "from_name": null, "from_type": "Indicator", "id": "331afd5c-b095-40a0-89ed-6def11099689", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--4c56c883-690c-50ad-aecb-94361fc34718", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.611Z", "created_at": "2026-09-26T05:45:12.145Z", "modified": "2026-09-26T05:45:12.348Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:45:12.348Z" }, "description_available": false, "entity_type": "indicates", "fromId": "3be1760f-af98-4d5c-80e2-c0338b71f391", "from_id": "3be1760f-af98-4d5c-80e2-c0338b71f391", "from_name": null, "from_type": "Indicator", "id": "331e0e72-3224-4b15-820a-f9c2c954bbf3", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--efa4f4cb-7648-5be2-ac02-b41785cb6cad", "toId": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_id": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_name": "PlugX - S0013", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.036Z", "created_at": "2026-09-26T05:34:45.689Z", "modified": "2026-09-26T05:34:46.395Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:34:46.395Z" }, "description_available": false, "entity_type": "based-on", "fromId": "c2dcc828-9ae2-404f-a201-0074f26085ba", "from_id": "c2dcc828-9ae2-404f-a201-0074f26085ba", "from_name": null, "from_type": "Indicator", "id": "334c2be5-9f5d-4da9-b52a-f79357638798", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--f62df081-6f18-595b-9fbd-b4f3b49def08", "toId": "84c081dd-c3ae-4f17-a8bc-75a9988112fd", "to_id": "84c081dd-c3ae-4f17-a8bc-75a9988112fd", "to_name": null, "to_type": "IPv4Addr" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.386Z", "created_at": "2026-09-26T05:39:26.725Z", "modified": "2026-09-26T05:39:27.720Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:39:27.720Z" }, "description_available": false, "entity_type": "indicates", "fromId": "8c1b4518-8219-46bb-a619-1c69182e4eec", "from_id": "8c1b4518-8219-46bb-a619-1c69182e4eec", "from_name": null, "from_type": "Indicator", "id": "3388032a-624b-4aca-a3d7-e6acb1f94b8e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--fe0df7eb-f054-57cb-bd72-cdcfd007f2f2", "toId": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_id": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_name": "Melofee", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.349Z", "created_at": "2026-09-26T05:37:31.142Z", "modified": "2026-09-26T05:37:32.116Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:37:32.116Z" }, "description_available": false, "entity_type": "indicates", "fromId": "94a7b3a6-0b64-4746-86ff-6647d1a2df8d", "from_id": "94a7b3a6-0b64-4746-86ff-6647d1a2df8d", "from_name": null, "from_type": "Indicator", "id": "3410a1bc-ae5c-45b4-8743-5da3786db8ce", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--5c74c262-052b-5981-bde6-568aab1b7230", "toId": "657ff382-024b-45a4-974a-3e41f1762074", "to_id": "657ff382-024b-45a4-974a-3e41f1762074", "to_name": "Cobalt Strike - S0154", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.919Z", "created_at": "2026-09-26T05:53:09.158Z", "modified": "2026-09-26T05:53:09.472Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:53:09.472Z" }, "description_available": false, "entity_type": "indicates", "fromId": "fdaa0a79-121c-4e17-91bb-e23da88da18e", "from_id": "fdaa0a79-121c-4e17-91bb-e23da88da18e", "from_name": null, "from_type": "Indicator", "id": "3434b636-99d3-4570-9508-eeee0861d100", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--2cbeb7ca-872d-5e75-b966-ede455461d9b", "toId": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_id": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_name": "RatelS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.150Z", "created_at": "2026-09-26T05:59:07.831Z", "modified": "2026-09-26T05:59:08.230Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:59:08.230Z" }, "description_available": false, "entity_type": "indicates", "fromId": "56d609d1-e0ef-4633-8cfe-a3e1f792fbff", "from_id": "56d609d1-e0ef-4633-8cfe-a3e1f792fbff", "from_name": null, "from_type": "Indicator", "id": "3504975c-803a-4e02-8e93-04215e401726", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--9c75d453-e816-59fc-86a1-dcbd7f6c348b", "toId": "657ff382-024b-45a4-974a-3e41f1762074", "to_id": "657ff382-024b-45a4-974a-3e41f1762074", "to_name": "Cobalt Strike - S0154", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.527Z", "created_at": "2026-09-26T05:42:32.033Z", "modified": "2026-09-26T05:42:32.284Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:42:32.284Z" }, "description_available": false, "entity_type": "indicates", "fromId": "0eb188e3-885e-4084-abdf-6d4ba0098e64", "from_id": "0eb188e3-885e-4084-abdf-6d4ba0098e64", "from_name": null, "from_type": "Indicator", "id": "358f4e08-6b24-41ab-93fa-e7df067b4026", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--5fed251c-4a66-5a5c-9204-4376dd54739e", "toId": "657ff382-024b-45a4-974a-3e41f1762074", "to_id": "657ff382-024b-45a4-974a-3e41f1762074", "to_name": "Cobalt Strike - S0154", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.350Z", "created_at": "2026-09-26T05:37:55.687Z", "modified": "2026-09-26T05:37:58.502Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:37:58.502Z" }, "description_available": false, "entity_type": "indicates", "fromId": "94a7b3a6-0b64-4746-86ff-6647d1a2df8d", "from_id": "94a7b3a6-0b64-4746-86ff-6647d1a2df8d", "from_name": null, "from_type": "Indicator", "id": "36051202-5237-4d09-83ce-5a1613d73218", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--010990ea-a4d5-52c6-976d-5767730a8b1d", "toId": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_id": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_name": "CrowDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.336Z", "created_at": "2026-09-26T06:04:22.097Z", "modified": "2026-09-26T06:04:22.299Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:04:22.299Z" }, "description_available": false, "entity_type": "indicates", "fromId": "95ef732a-5859-4b75-a4ea-fd3cfe3f1618", "from_id": "95ef732a-5859-4b75-a4ea-fd3cfe3f1618", "from_name": null, "from_type": "Indicator", "id": "3796a2d3-f118-4a5d-9c48-1957e5bd010d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--571c9dd9-5637-5cd2-8789-40fc1bb11fe0", "toId": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_id": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_name": "Melofee", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.881Z", "created_at": "2026-09-26T05:52:38.376Z", "modified": "2026-09-26T05:52:38.671Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:52:38.671Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c77e0b5e-a168-4a6f-993c-bc7076c78285", "from_id": "c77e0b5e-a168-4a6f-993c-bc7076c78285", "from_name": null, "from_type": "Indicator", "id": "38604e83-5edf-48ca-9e00-f1b36b9f20d7", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--67257a79-21e4-5d8c-9ca5-df890a2dfa6e", "toId": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_id": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_name": "Melofee", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.673Z", "created_at": "2026-09-26T05:46:31.617Z", "modified": "2026-09-26T05:46:31.970Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:46:31.970Z" }, "description_available": false, "entity_type": "indicates", "fromId": "157ca5cb-7d34-4fc3-83d2-bac13ceb9804", "from_id": "157ca5cb-7d34-4fc3-83d2-bac13ceb9804", "from_name": null, "from_type": "Indicator", "id": "38860c15-9739-4f28-8060-05e9f7296b12", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--1d5ecf0d-b1f1-536b-b647-f1831b5a1d78", "toId": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_id": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_name": "Melofee", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.071Z", "created_at": "2026-09-26T05:56:27.749Z", "modified": "2026-09-26T05:56:29.717Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:56:29.717Z" }, "description_available": false, "entity_type": "indicates", "fromId": "66f40cca-cc72-4806-beef-47ae23125e5f", "from_id": "66f40cca-cc72-4806-beef-47ae23125e5f", "from_name": null, "from_type": "Indicator", "id": "390cbfeb-77d9-431f-822f-23a9fbd4539f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--0c980003-8c1a-50fe-9c3e-92e54ee6ac88", "toId": "208a45aa-c18e-4619-9a90-7004849cab40", "to_id": "208a45aa-c18e-4619-9a90-7004849cab40", "to_name": "HemiGate", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.801Z", "created_at": "2026-09-26T05:49:43.478Z", "modified": "2026-09-26T05:49:43.739Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:49:43.739Z" }, "description_available": false, "entity_type": "indicates", "fromId": "2227cc4b-afc7-4060-b897-a1a458d90abd", "from_id": "2227cc4b-afc7-4060-b897-a1a458d90abd", "from_name": null, "from_type": "Indicator", "id": "399b1f63-8b5a-4373-a879-036a8bc240df", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--a74b9e7d-d8bd-5446-858a-c4b6086ccbe0", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.179Z", "created_at": "2026-09-26T05:59:39.395Z", "modified": "2026-09-26T05:59:39.580Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:59:39.580Z" }, "description_available": false, "entity_type": "indicates", "fromId": "350ff6fa-1c04-4870-b345-041e0d3d6d92", "from_id": "350ff6fa-1c04-4870-b345-041e0d3d6d92", "from_name": null, "from_type": "Indicator", "id": "39a7252e-d8d0-40e2-907a-5d9e9010b979", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--652714a0-628c-57a2-b9ba-9fa13b3c13a8", "toId": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_id": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_name": "RatelS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.041Z", "created_at": "2026-09-26T05:34:46.745Z", "modified": "2026-09-26T05:34:47.733Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:34:47.733Z" }, "description_available": false, "entity_type": "based-on", "fromId": "0eb188e3-885e-4084-abdf-6d4ba0098e64", "from_id": "0eb188e3-885e-4084-abdf-6d4ba0098e64", "from_name": null, "from_type": "Indicator", "id": "3a4a082f-6220-451d-8522-9a2326957e9a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--097b57c2-1e3d-5493-9d86-e760bedd7594", "toId": "746e057f-05ff-48aa-af9c-a0589b31c045", "to_id": "746e057f-05ff-48aa-af9c-a0589b31c045", "to_name": null, "to_type": "IPv4Addr" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.723Z", "created_at": "2026-09-26T05:47:41.154Z", "modified": "2026-09-26T05:47:41.427Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:47:41.427Z" }, "description_available": false, "entity_type": "indicates", "fromId": "de51cd6f-4b7a-4c4b-9b3d-d5094f650356", "from_id": "de51cd6f-4b7a-4c4b-9b3d-d5094f650356", "from_name": null, "from_type": "Indicator", "id": "3ab743af-c2d5-4b13-95e7-822da611cfd2", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--9ce6fd1d-c676-596a-b264-b4a85a0f2138", "toId": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_id": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_name": "TernDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.027Z", "created_at": "2026-09-26T05:55:30.588Z", "modified": "2026-09-26T05:55:30.814Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:55:30.814Z" }, "description_available": false, "entity_type": "indicates", "fromId": "cd0c196b-8e17-4794-80e8-7129d42950e2", "from_id": "cd0c196b-8e17-4794-80e8-7129d42950e2", "from_name": null, "from_type": "Indicator", "id": "3ab97804-0311-4736-91a7-cf36fa14e544", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--1cbfcda2-357a-5e91-b86f-def9cbb06fd8", "toId": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_id": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_name": "STOWAWAY", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.098Z", "created_at": "2026-09-26T05:58:14.218Z", "modified": "2026-09-26T05:58:14.571Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:58:14.571Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d7f88a85-9ab3-45b8-982b-294d838461a6", "from_id": "d7f88a85-9ab3-45b8-982b-294d838461a6", "from_name": null, "from_type": "Indicator", "id": "3af65636-fac1-4d38-9dfd-7fcfdf497fd7", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--0d4dad0e-b9eb-5e1a-acc7-81efd968816d", "toId": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_id": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_name": "STOWAWAY", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.175Z", "created_at": "2026-09-26T05:59:33.913Z", "modified": "2026-09-26T05:59:34.112Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:59:34.112Z" }, "description_available": false, "entity_type": "indicates", "fromId": "350ff6fa-1c04-4870-b345-041e0d3d6d92", "from_id": "350ff6fa-1c04-4870-b345-041e0d3d6d92", "from_name": null, "from_type": "Indicator", "id": "3c2696a2-11c0-4be2-bcc8-807f71775744", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--1d7836fa-d54e-5159-90b9-27eafc4d8732", "toId": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_id": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_name": "Spark - S0543", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.433Z", "created_at": "2026-09-26T05:40:34.074Z", "modified": "2026-09-26T05:40:34.390Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:40:34.390Z" }, "description_available": false, "entity_type": "indicates", "fromId": "01c74684-bdd9-45d1-84be-d24d189bcb28", "from_id": "01c74684-bdd9-45d1-84be-d24d189bcb28", "from_name": null, "from_type": "Indicator", "id": "3cae4fc2-da74-45c7-a6d9-c90a015e5516", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--1f63313c-6936-5ee2-b622-9e0e107771f1", "toId": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_id": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_name": "PlugX - S0013", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.766Z", "created_at": "2026-09-26T05:48:55.606Z", "modified": "2026-09-26T05:48:55.896Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:48:55.896Z" }, "description_available": false, "entity_type": "indicates", "fromId": "1a15e67e-da7b-42ec-b24a-d47fd8aa0767", "from_id": "1a15e67e-da7b-42ec-b24a-d47fd8aa0767", "from_name": null, "from_type": "Indicator", "id": "3cca76c9-52ad-4973-b881-bc932c171a11", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--8fa1d993-e9f2-51ac-8a52-4025f2f0ec02", "toId": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_id": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_name": "TernDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.364Z", "created_at": "2026-09-26T06:04:50.049Z", "modified": "2026-09-26T06:04:50.270Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:04:50.270Z" }, "description_available": false, "entity_type": "indicates", "fromId": "3c2ca4de-2c25-4802-a582-ebf285060ed9", "from_id": "3c2ca4de-2c25-4802-a582-ebf285060ed9", "from_name": null, "from_type": "Indicator", "id": "3d772d69-5231-49cd-90ed-db267b89c480", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--a66dce16-b7f3-5258-a102-13e4d47693cf", "toId": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_id": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_name": "Spark - S0543", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.214Z", "created_at": "2026-09-26T05:35:13.319Z", "modified": "2026-09-26T05:35:13.777Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:35:13.777Z" }, "description_available": false, "entity_type": "based-on", "fromId": "6fbf4d94-634a-4763-b0e5-0cbe6e9f67ea", "from_id": "6fbf4d94-634a-4763-b0e5-0cbe6e9f67ea", "from_name": null, "from_type": "Indicator", "id": "3d8194ad-0b38-4136-8f89-e7c6cf65a613", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--4521a1c6-ed5f-5d93-b5c3-33c629da6da1", "toId": "4fac57e7-eef7-47f0-9b98-c7356e554504", "to_id": "4fac57e7-eef7-47f0-9b98-c7356e554504", "to_name": null, "to_type": "IPv4Addr" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.545Z", "created_at": "2026-09-26T05:42:52.466Z", "modified": "2026-09-26T05:42:52.726Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:42:52.726Z" }, "description_available": false, "entity_type": "indicates", "fromId": "653baf3a-7205-44e8-bf30-e40825fbf42a", "from_id": "653baf3a-7205-44e8-bf30-e40825fbf42a", "from_name": null, "from_type": "Indicator", "id": "3e2ad08f-3d0c-4207-bf94-e9d91c653e52", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--f14843d0-a26a-5de0-8b3c-2fb64cfef839", "toId": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_id": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_name": "PlugX - S0013", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.551Z", "created_at": "2026-09-26T05:42:59.959Z", "modified": "2026-09-26T05:43:00.169Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:43:00.169Z" }, "description_available": false, "entity_type": "indicates", "fromId": "653baf3a-7205-44e8-bf30-e40825fbf42a", "from_id": "653baf3a-7205-44e8-bf30-e40825fbf42a", "from_name": null, "from_type": "Indicator", "id": "3e3ef9f4-0f15-457f-b0b2-67b1d06e009b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--d80a2e5b-1186-5daf-a61c-1fc264cd086f", "toId": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_id": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_name": "RatelS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.126Z", "created_at": "2026-09-26T05:58:49.792Z", "modified": "2026-09-26T05:58:49.953Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:58:49.953Z" }, "description_available": false, "entity_type": "indicates", "fromId": "52b56463-7f22-48f8-b036-35d89d2dabcb", "from_id": "52b56463-7f22-48f8-b036-35d89d2dabcb", "from_name": null, "from_type": "Indicator", "id": "3e7ff7da-e31b-44f3-b880-57812af1d58f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--e44a09c8-2be1-5038-a6ec-527836f99466", "toId": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_id": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_name": "STOWAWAY", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.366Z", "created_at": "2026-09-26T06:04:50.885Z", "modified": "2026-09-26T06:04:51.009Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:04:51.009Z" }, "description_available": false, "entity_type": "indicates", "fromId": "3c2ca4de-2c25-4802-a582-ebf285060ed9", "from_id": "3c2ca4de-2c25-4802-a582-ebf285060ed9", "from_name": null, "from_type": "Indicator", "id": "3eed3095-d7f8-480a-8f24-b60a0b96e0c7", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--33281def-c0dc-51ea-afdd-36c20122ecba", "toId": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_id": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_name": "CrowDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.883Z", "created_at": "2026-09-26T05:52:36.240Z", "modified": "2026-09-26T05:52:36.555Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:52:36.555Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c77e0b5e-a168-4a6f-993c-bc7076c78285", "from_id": "c77e0b5e-a168-4a6f-993c-bc7076c78285", "from_name": null, "from_type": "Indicator", "id": "3f54ba98-88cd-4c22-ab01-c6eda73d9c52", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--bcc42f0b-3593-552a-a002-e6c473c8ab6f", "toId": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_id": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_name": "HelloBot", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.807Z", "created_at": "2026-09-26T05:49:57.116Z", "modified": "2026-09-26T05:49:57.441Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:49:57.441Z" }, "description_available": false, "entity_type": "indicates", "fromId": "2227cc4b-afc7-4060-b897-a1a458d90abd", "from_id": "2227cc4b-afc7-4060-b897-a1a458d90abd", "from_name": null, "from_type": "Indicator", "id": "3fa28436-683d-4a22-a219-6d70417f6c38", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--b10b4a10-fe50-5aed-b5ca-73c795376bef", "toId": "657ff382-024b-45a4-974a-3e41f1762074", "to_id": "657ff382-024b-45a4-974a-3e41f1762074", "to_name": "Cobalt Strike - S0154", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.997Z", "created_at": "2026-09-26T05:54:52.453Z", "modified": "2026-09-26T05:54:52.782Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:54:52.782Z" }, "description_available": false, "entity_type": "indicates", "fromId": "26da206d-5fde-40ba-bc45-0f24f378263c", "from_id": "26da206d-5fde-40ba-bc45-0f24f378263c", "from_name": null, "from_type": "Indicator", "id": "3fd3af82-1365-47c5-bb13-5c54a9c85381", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--42c424b5-5c00-5178-b9c2-ed7e8a065de9", "toId": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_id": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_name": "Melofee", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.823Z", "created_at": "2026-09-26T05:51:40.759Z", "modified": "2026-09-26T05:51:41.007Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:51:41.007Z" }, "description_available": false, "entity_type": "indicates", "fromId": "10b221ff-1d17-4b38-ae27-73235f136031", "from_id": "10b221ff-1d17-4b38-ae27-73235f136031", "from_name": null, "from_type": "Indicator", "id": "3fd830aa-8d45-4129-a27b-fedb261efc22", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--ed05f9ac-1c83-5d2d-9191-302109569613", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.268Z", "created_at": "2026-09-26T06:02:01.915Z", "modified": "2026-09-26T06:02:02.139Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:02:02.139Z" }, "description_available": false, "entity_type": "indicates", "fromId": "2c0b3e29-5bb5-4044-8031-4f47cd51a008", "from_id": "2c0b3e29-5bb5-4044-8031-4f47cd51a008", "from_name": null, "from_type": "Indicator", "id": "4058d1ef-efa1-4519-9dc5-1418a7a4bf7a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--f155b5a2-3207-58da-a566-846185859c7e", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.539Z", "created_at": "2026-09-26T06:08:52.223Z", "modified": "2026-09-26T06:08:53.085Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:08:53.085Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c9493e20-dc6a-4938-8fee-746005c4ae07", "from_id": "c9493e20-dc6a-4938-8fee-746005c4ae07", "from_name": null, "from_type": "Indicator", "id": "40857acc-f118-45a1-b5b5-066255d85154", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--0887e03c-a4e8-53f3-8c40-0c58440171a0", "toId": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_id": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_name": "Melofee", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.620Z", "created_at": "2026-09-26T06:11:49.257Z", "modified": "2026-09-26T06:11:50.191Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:11:50.191Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d5009423-c128-4583-ac72-3f07f1201db6", "from_id": "d5009423-c128-4583-ac72-3f07f1201db6", "from_name": null, "from_type": "Indicator", "id": "4110a448-8322-4295-a7f4-89b139215b73", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--6291d0fd-842c-5493-b88f-86737b516e4a", "toId": "208a45aa-c18e-4619-9a90-7004849cab40", "to_id": "208a45aa-c18e-4619-9a90-7004849cab40", "to_name": "HemiGate", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.415Z", "created_at": "2026-09-26T05:40:12.409Z", "modified": "2026-09-26T05:40:12.527Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:40:12.527Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d4aa073f-c77f-4db6-a515-5246469cf6b0", "from_id": "d4aa073f-c77f-4db6-a515-5246469cf6b0", "from_name": null, "from_type": "Indicator", "id": "411520b1-187f-4cb2-936c-b8000bab33f9", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--3b26cb63-7c45-516e-a1c2-720eacd21eb9", "toId": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_id": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_name": "STOWAWAY", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.409Z", "created_at": "2026-09-26T05:40:03.877Z", "modified": "2026-09-26T05:40:04.077Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:40:04.077Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d4aa073f-c77f-4db6-a515-5246469cf6b0", "from_id": "d4aa073f-c77f-4db6-a515-5246469cf6b0", "from_name": null, "from_type": "Indicator", "id": "424a6c03-29f6-474e-b41f-eda8722976fa", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--1c0b4506-4d38-5fd2-900b-dbb9d3659e1b", "toId": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_id": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_name": "HelloBot", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.505Z", "created_at": "2026-09-26T05:42:03.132Z", "modified": "2026-09-26T05:42:03.315Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:42:03.315Z" }, "description_available": false, "entity_type": "indicates", "fromId": "435fff26-763c-4528-906f-e8da098d6aee", "from_id": "435fff26-763c-4528-906f-e8da098d6aee", "from_name": null, "from_type": "Indicator", "id": "42573a7f-61f6-499c-9c63-9956ae89c1b0", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--41da902e-aa46-5ece-81d4-354a1255bafb", "toId": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_id": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_name": "Spark - S0543", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.830Z", "created_at": "2026-09-26T05:51:48.492Z", "modified": "2026-09-26T05:51:49.074Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:51:49.074Z" }, "description_available": false, "entity_type": "indicates", "fromId": "10b221ff-1d17-4b38-ae27-73235f136031", "from_id": "10b221ff-1d17-4b38-ae27-73235f136031", "from_name": null, "from_type": "Indicator", "id": "426274ef-009d-424c-b9c7-4e1916a3b885", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--08533a7d-9442-56cb-8c25-439cce595660", "toId": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_id": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_name": "TernDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.297Z", "created_at": "2026-09-26T06:02:26.265Z", "modified": "2026-09-26T06:02:28.853Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:02:28.853Z" }, "description_available": false, "entity_type": "indicates", "fromId": "3b95a828-10fe-4895-a5fa-606043535451", "from_id": "3b95a828-10fe-4895-a5fa-606043535451", "from_name": null, "from_type": "Indicator", "id": "440407bc-d480-4f25-adc4-6b43b17e9587", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--e91fff33-db00-576a-85d9-0c75aa248276", "toId": "208a45aa-c18e-4619-9a90-7004849cab40", "to_id": "208a45aa-c18e-4619-9a90-7004849cab40", "to_name": "HemiGate", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.660Z", "created_at": "2026-09-26T05:46:21.053Z", "modified": "2026-09-26T05:46:21.741Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:46:21.741Z" }, "description_available": false, "entity_type": "indicates", "fromId": "681c2240-1fb8-466d-a533-8f1d8132b27b", "from_id": "681c2240-1fb8-466d-a533-8f1d8132b27b", "from_name": null, "from_type": "Indicator", "id": "441b500e-8b63-48bb-9f6f-7b71707df8f9", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--2f9b8eff-23a2-5ed6-9c6b-f1cf19c4c7f2", "toId": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_id": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_name": "TernDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.006Z", "created_at": "2026-09-26T05:55:01.273Z", "modified": "2026-09-26T05:55:01.459Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:55:01.459Z" }, "description_available": false, "entity_type": "indicates", "fromId": "26da206d-5fde-40ba-bc45-0f24f378263c", "from_id": "26da206d-5fde-40ba-bc45-0f24f378263c", "from_name": null, "from_type": "Indicator", "id": "447479a4-03d0-4ff9-8d9d-6e97d71854c6", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--c832cc00-9dea-509f-b1e2-a4d855d2e880", "toId": "208a45aa-c18e-4619-9a90-7004849cab40", "to_id": "208a45aa-c18e-4619-9a90-7004849cab40", "to_name": "HemiGate", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.390Z", "created_at": "2026-09-26T06:05:22.041Z", "modified": "2026-09-26T06:05:22.379Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:05:22.379Z" }, "description_available": false, "entity_type": "indicates", "fromId": "2d16d740-ae8a-45ff-8a8b-9032f924c3fa", "from_id": "2d16d740-ae8a-45ff-8a8b-9032f924c3fa", "from_name": null, "from_type": "Indicator", "id": "44900498-ea72-454a-96e2-a996539b539a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--bcd05c14-97e1-5cf6-bcba-d43a84ce465a", "toId": "208a45aa-c18e-4619-9a90-7004849cab40", "to_id": "208a45aa-c18e-4619-9a90-7004849cab40", "to_name": "HemiGate", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.962Z", "created_at": "2026-09-26T05:54:02.233Z", "modified": "2026-09-26T05:54:02.439Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:54:02.439Z" }, "description_available": false, "entity_type": "indicates", "fromId": "2497f466-fac3-4bfc-ab1f-5ebcf363283b", "from_id": "2497f466-fac3-4bfc-ab1f-5ebcf363283b", "from_name": null, "from_type": "Indicator", "id": "44ca66c2-a947-4bb5-b422-e2407e12ee47", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--95a2de15-a5f6-51cd-886d-1157e7e6121d", "toId": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_id": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_name": "STOWAWAY", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.810Z", "created_at": "2026-09-26T05:50:01.988Z", "modified": "2026-09-26T05:50:02.323Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:50:02.323Z" }, "description_available": false, "entity_type": "indicates", "fromId": "2227cc4b-afc7-4060-b897-a1a458d90abd", "from_id": "2227cc4b-afc7-4060-b897-a1a458d90abd", "from_name": null, "from_type": "Indicator", "id": "44ff3c93-ba8c-4583-a58d-78ad8286c9e7", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--0534abd1-af1c-5dda-a62a-6888d34b2eb1", "toId": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_id": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_name": "RatelS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.351Z", "created_at": "2026-09-26T05:37:28.813Z", "modified": "2026-09-26T05:37:29.054Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:37:29.054Z" }, "description_available": false, "entity_type": "indicates", "fromId": "94a7b3a6-0b64-4746-86ff-6647d1a2df8d", "from_id": "94a7b3a6-0b64-4746-86ff-6647d1a2df8d", "from_name": null, "from_type": "Indicator", "id": "45096016-5510-4de0-af8e-5e7881d76b99", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--7794b890-7a6a-58e5-b65c-dcc32c087a28", "toId": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_id": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_name": "TernDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.088Z", "created_at": "2026-09-26T05:58:09.699Z", "modified": "2026-09-26T05:58:09.885Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:58:09.885Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d7f88a85-9ab3-45b8-982b-294d838461a6", "from_id": "d7f88a85-9ab3-45b8-982b-294d838461a6", "from_name": null, "from_type": "Indicator", "id": "46ab3fe0-455e-40e2-a52c-66e7fed8968f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--0ea972c7-ca85-5fc7-921e-34c5cd8dadae", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.942Z", "created_at": "2026-09-26T05:53:33.990Z", "modified": "2026-09-26T05:53:34.357Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:53:34.357Z" }, "description_available": false, "entity_type": "indicates", "fromId": "1315ce2a-6659-4f4f-b9b7-e2450564ca9b", "from_id": "1315ce2a-6659-4f4f-b9b7-e2450564ca9b", "from_name": null, "from_type": "Indicator", "id": "46b06129-27a4-4521-9f4e-78ae2d737327", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--6a4d687d-dfa4-54dd-9e41-048cb87117e3", "toId": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_id": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_name": "TernDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.041Z", "created_at": "2026-09-26T05:55:59.796Z", "modified": "2026-09-26T05:56:00.045Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:56:00.045Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ea8ff45b-69d1-4069-bebe-6f7107045959", "from_id": "ea8ff45b-69d1-4069-bebe-6f7107045959", "from_name": null, "from_type": "Indicator", "id": "46bfeafc-0698-4eec-81e5-7064c928ee3f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--cfa67755-edf7-56aa-990b-024d4b1519c8", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.524Z", "created_at": "2026-09-26T06:08:26.278Z", "modified": "2026-09-26T06:08:26.546Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:08:26.546Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c08d31e4-ff5a-45b7-8880-330403eced75", "from_id": "c08d31e4-ff5a-45b7-8880-330403eced75", "from_name": null, "from_type": "Indicator", "id": "46f84bb0-defa-4f1d-8e70-0811e7e7b759", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--b0e4a4b1-e20c-51aa-ab93-db0d646ba6fa", "toId": "657ff382-024b-45a4-974a-3e41f1762074", "to_id": "657ff382-024b-45a4-974a-3e41f1762074", "to_name": "Cobalt Strike - S0154", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.069Z", "created_at": "2026-09-26T05:34:54.196Z", "modified": "2026-09-26T05:34:54.442Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:34:54.442Z" }, "description_available": false, "entity_type": "based-on", "fromId": "de51cd6f-4b7a-4c4b-9b3d-d5094f650356", "from_id": "de51cd6f-4b7a-4c4b-9b3d-d5094f650356", "from_name": null, "from_type": "Indicator", "id": "4715ba22-b7e0-482c-a77e-045e0f2d770e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--b28b012b-8763-58dc-ab7b-78594adf4738", "toId": "5acd99db-1647-4737-931f-6bda9bc2e3fa", "to_id": "5acd99db-1647-4737-931f-6bda9bc2e3fa", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.020Z", "created_at": "2026-09-26T05:34:40.563Z", "modified": "2026-09-26T05:34:41.942Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:34:41.942Z" }, "description_available": false, "entity_type": "based-on", "fromId": "b2490479-1c8f-4288-a8e1-23589e1535cf", "from_id": "b2490479-1c8f-4288-a8e1-23589e1535cf", "from_name": null, "from_type": "Indicator", "id": "47fce5cb-5d4b-452b-a9d6-d0e527b8e1ff", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--f5f11f31-8191-5020-84bc-e98b43ec9714", "toId": "a7c4c835-d970-49b2-8782-cd5a75827218", "to_id": "a7c4c835-d970-49b2-8782-cd5a75827218", "to_name": null, "to_type": "IPv4Addr" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.982Z", "created_at": "2026-09-26T05:54:29.198Z", "modified": "2026-09-26T05:54:29.483Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:54:29.483Z" }, "description_available": false, "entity_type": "indicates", "fromId": "2d8df4da-244f-458a-8c2d-ff67380121e9", "from_id": "2d8df4da-244f-458a-8c2d-ff67380121e9", "from_name": null, "from_type": "Indicator", "id": "480ba280-b3bb-4aad-82b2-bbe06bb261ca", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--6d8b9ae1-0a38-5d5a-91dc-c1dbae063ebe", "toId": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_id": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_name": "Spark - S0543", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.152Z", "created_at": "2026-09-26T05:59:13.606Z", "modified": "2026-09-26T05:59:13.841Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:59:13.841Z" }, "description_available": false, "entity_type": "indicates", "fromId": "56d609d1-e0ef-4633-8cfe-a3e1f792fbff", "from_id": "56d609d1-e0ef-4633-8cfe-a3e1f792fbff", "from_name": null, "from_type": "Indicator", "id": "480ef236-e23b-4a12-a036-97ff5eef620a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--cc279ce7-ed22-5396-983f-90daac58a733", "toId": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_id": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_name": "RatelS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.328Z", "created_at": "2026-09-26T05:37:09.685Z", "modified": "2026-09-26T05:37:09.819Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:37:09.819Z" }, "description_available": false, "entity_type": "indicates", "fromId": "b2490479-1c8f-4288-a8e1-23589e1535cf", "from_id": "b2490479-1c8f-4288-a8e1-23589e1535cf", "from_name": null, "from_type": "Indicator", "id": "4844017c-303c-4477-ae20-8634f4e8b057", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--d3bf68f2-b7e2-596e-bd5a-a17ee1542eb0", "toId": "208a45aa-c18e-4619-9a90-7004849cab40", "to_id": "208a45aa-c18e-4619-9a90-7004849cab40", "to_name": "HemiGate", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.015Z", "created_at": "2026-09-26T05:34:38.798Z", "modified": "2026-09-26T05:34:39.209Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:34:39.209Z" }, "description_available": false, "entity_type": "based-on", "fromId": "48f22366-f0fd-4667-b458-fc531795e8ff", "from_id": "48f22366-f0fd-4667-b458-fc531795e8ff", "from_name": null, "from_type": "Indicator", "id": "48905396-798c-48a1-89fe-a3eb82a51e69", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--9762a0c4-d0cb-59b9-b32a-736cf2131a9d", "toId": "01333910-071d-4b01-b2f4-28b9cbbcb5f6", "to_id": "01333910-071d-4b01-b2f4-28b9cbbcb5f6", "to_name": null, "to_type": "IPv4Addr" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.526Z", "created_at": "2026-09-26T06:08:32.620Z", "modified": "2026-09-26T06:08:32.840Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:08:32.840Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c08d31e4-ff5a-45b7-8880-330403eced75", "from_id": "c08d31e4-ff5a-45b7-8880-330403eced75", "from_name": null, "from_type": "Indicator", "id": "48919551-b91e-41ca-ad8a-45fd661b9a5e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--f05a1f23-a0b9-50a0-baa6-bce66c8cb38c", "toId": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_id": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_name": "TernDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.026Z", "created_at": "2026-09-26T05:55:32.173Z", "modified": "2026-09-26T05:55:32.359Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:55:32.359Z" }, "description_available": false, "entity_type": "indicates", "fromId": "cd0c196b-8e17-4794-80e8-7129d42950e2", "from_id": "cd0c196b-8e17-4794-80e8-7129d42950e2", "from_name": null, "from_type": "Indicator", "id": "4898eb5a-14e5-4c63-af9a-9ca7e796eccf", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--e55d4626-dbdb-571f-8b89-876d97dbe486", "toId": "657ff382-024b-45a4-974a-3e41f1762074", "to_id": "657ff382-024b-45a4-974a-3e41f1762074", "to_name": "Cobalt Strike - S0154", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.412Z", "created_at": "2026-09-26T06:05:52.603Z", "modified": "2026-09-26T06:05:52.775Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:05:52.775Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ac6046d8-f570-4eca-af26-b22ab4b74e00", "from_id": "ac6046d8-f570-4eca-af26-b22ab4b74e00", "from_name": null, "from_type": "Indicator", "id": "48d6c73d-b7dd-4400-b858-972db240fcea", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--d8b9ffdc-0d86-5051-a001-d3a2cae66dba", "toId": "208a45aa-c18e-4619-9a90-7004849cab40", "to_id": "208a45aa-c18e-4619-9a90-7004849cab40", "to_name": "HemiGate", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.764Z", "created_at": "2026-09-26T05:48:47.204Z", "modified": "2026-09-26T05:48:47.428Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:48:47.428Z" }, "description_available": false, "entity_type": "indicates", "fromId": "1a15e67e-da7b-42ec-b24a-d47fd8aa0767", "from_id": "1a15e67e-da7b-42ec-b24a-d47fd8aa0767", "from_name": null, "from_type": "Indicator", "id": "49678e34-734f-430d-b8bf-71c9e725eaa3", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--17a79a5d-ae10-5b28-a2d1-28cd0796382c", "toId": "657ff382-024b-45a4-974a-3e41f1762074", "to_id": "657ff382-024b-45a4-974a-3e41f1762074", "to_name": "Cobalt Strike - S0154", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.071Z", "created_at": "2026-09-26T05:56:27.053Z", "modified": "2026-09-26T05:56:27.279Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:56:27.279Z" }, "description_available": false, "entity_type": "indicates", "fromId": "66f40cca-cc72-4806-beef-47ae23125e5f", "from_id": "66f40cca-cc72-4806-beef-47ae23125e5f", "from_name": null, "from_type": "Indicator", "id": "499193e4-bf81-48b8-aa1a-03e70740cf43", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--37fc8290-d5af-5a1e-94b3-66725b57d20b", "toId": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_id": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_name": "TernDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.291Z", "created_at": "2026-09-26T06:02:20.444Z", "modified": "2026-09-26T06:02:20.670Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:02:20.670Z" }, "description_available": false, "entity_type": "indicates", "fromId": "3b95a828-10fe-4895-a5fa-606043535451", "from_id": "3b95a828-10fe-4895-a5fa-606043535451", "from_name": null, "from_type": "Indicator", "id": "4a646c73-2fe5-4318-8c73-c00fccf60041", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--ee8b6226-ea4a-55df-8ddc-cb7d5ab9bae5", "toId": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_id": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_name": "PlugX - S0013", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.738Z", "created_at": "2026-09-26T05:48:08.514Z", "modified": "2026-09-26T05:48:08.728Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:48:08.728Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ce5e270a-a0f5-4d07-9faf-6493364c1a2b", "from_id": "ce5e270a-a0f5-4d07-9faf-6493364c1a2b", "from_name": null, "from_type": "Indicator", "id": "4abfe298-893d-45d0-96a6-d4d6ae85eec5", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--32dd2e7e-c776-581c-8009-ad9118479ac3", "toId": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_id": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_name": "HelloBot", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.564Z", "created_at": "2026-09-26T06:10:52.156Z", "modified": "2026-09-26T06:10:52.333Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:10:52.333Z" }, "description_available": false, "entity_type": "indicates", "fromId": "6ac03fc4-4c10-4d8f-b546-7ce2b9422c39", "from_id": "6ac03fc4-4c10-4d8f-b546-7ce2b9422c39", "from_name": null, "from_type": "Indicator", "id": "4b804b0e-2604-49f3-90e5-52342c3d27a7", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--743761b9-f6c1-5f28-be91-69070be9218e", "toId": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_id": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_name": "HelloBot", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.617Z", "created_at": "2026-09-26T06:11:47.384Z", "modified": "2026-09-26T06:11:47.625Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:11:47.625Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d5009423-c128-4583-ac72-3f07f1201db6", "from_id": "d5009423-c128-4583-ac72-3f07f1201db6", "from_name": null, "from_type": "Indicator", "id": "4c08f728-1dc7-474a-91e9-89e474703f5c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--238a6e16-9d12-57a7-ab51-e40895247fad", "toId": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_id": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_name": "Spark - S0543", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.387Z", "created_at": "2026-09-26T05:39:31.545Z", "modified": "2026-09-26T05:39:31.695Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:39:31.695Z" }, "description_available": false, "entity_type": "indicates", "fromId": "8c1b4518-8219-46bb-a619-1c69182e4eec", "from_id": "8c1b4518-8219-46bb-a619-1c69182e4eec", "from_name": null, "from_type": "Indicator", "id": "4c2184fe-0b40-4242-9949-1067535ed283", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--b55e87db-2b56-5e66-8384-13fca134bc31", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.694Z", "created_at": "2026-09-26T05:46:59.864Z", "modified": "2026-09-26T05:47:00.290Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:47:00.290Z" }, "description_available": false, "entity_type": "indicates", "fromId": "a7a198b8-f0a3-4221-b768-191720f061b9", "from_id": "a7a198b8-f0a3-4221-b768-191720f061b9", "from_name": null, "from_type": "Indicator", "id": "4c41dd2e-95bf-4cf0-abbc-cc881828bb49", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--b767b5fc-a03a-5cd3-bcca-88a895818111", "toId": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_id": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_name": "Melofee", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.916Z", "created_at": "2026-09-26T05:53:22.348Z", "modified": "2026-09-26T05:53:23.802Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:53:23.802Z" }, "description_available": false, "entity_type": "indicates", "fromId": "fdaa0a79-121c-4e17-91bb-e23da88da18e", "from_id": "fdaa0a79-121c-4e17-91bb-e23da88da18e", "from_name": null, "from_type": "Indicator", "id": "4cb87090-d08b-464d-8cf1-bf6770d56e37", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--f7d6fae1-4a7b-51f2-a7c1-aa8034b5da42", "toId": "657ff382-024b-45a4-974a-3e41f1762074", "to_id": "657ff382-024b-45a4-974a-3e41f1762074", "to_name": "Cobalt Strike - S0154", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.942Z", "created_at": "2026-09-26T05:53:34.638Z", "modified": "2026-09-26T05:53:34.892Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:53:34.892Z" }, "description_available": false, "entity_type": "indicates", "fromId": "1315ce2a-6659-4f4f-b9b7-e2450564ca9b", "from_id": "1315ce2a-6659-4f4f-b9b7-e2450564ca9b", "from_name": null, "from_type": "Indicator", "id": "4d9f976b-af06-4397-a79d-b2c622766f7a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--e0e80ac5-cdc9-539e-a29b-29bcae4edaf4", "toId": "208a45aa-c18e-4619-9a90-7004849cab40", "to_id": "208a45aa-c18e-4619-9a90-7004849cab40", "to_name": "HemiGate", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.366Z", "created_at": "2026-09-26T06:04:51.324Z", "modified": "2026-09-26T06:04:51.463Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:04:51.463Z" }, "description_available": false, "entity_type": "indicates", "fromId": "3c2ca4de-2c25-4802-a582-ebf285060ed9", "from_id": "3c2ca4de-2c25-4802-a582-ebf285060ed9", "from_name": null, "from_type": "Indicator", "id": "4daed144-36d0-46a8-90f8-d0f0b41b8ab3", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--5afbbb10-bb80-50cb-9c92-3f7d9788e86a", "toId": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_id": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_name": "TernDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.342Z", "created_at": "2026-09-26T05:37:16.769Z", "modified": "2026-09-26T05:37:19.198Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:37:19.198Z" }, "description_available": false, "entity_type": "indicates", "fromId": "94a7b3a6-0b64-4746-86ff-6647d1a2df8d", "from_id": "94a7b3a6-0b64-4746-86ff-6647d1a2df8d", "from_name": null, "from_type": "Indicator", "id": "4df13b37-7d30-4fe5-b247-c7f891e1f216", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--783b3af2-7018-5233-842c-47ea22fb1f60", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.145Z", "created_at": "2026-09-26T05:58:59.339Z", "modified": "2026-09-26T05:59:00.547Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:59:00.547Z" }, "description_available": false, "entity_type": "indicates", "fromId": "56d609d1-e0ef-4633-8cfe-a3e1f792fbff", "from_id": "56d609d1-e0ef-4633-8cfe-a3e1f792fbff", "from_name": null, "from_type": "Indicator", "id": "4e0ab6cc-06a9-4aad-9fd7-1012ee57de3e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--827ee96e-18fa-5d51-ae20-734a49f4db4b", "toId": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_id": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_name": "PlugX - S0013", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.004Z", "created_at": "2026-09-26T05:55:06.340Z", "modified": "2026-09-26T05:55:06.631Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:55:06.631Z" }, "description_available": false, "entity_type": "indicates", "fromId": "26da206d-5fde-40ba-bc45-0f24f378263c", "from_id": "26da206d-5fde-40ba-bc45-0f24f378263c", "from_name": null, "from_type": "Indicator", "id": "4e83525f-30c2-41f9-b01a-34b29e1d700a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--0e7e8f47-3439-5f2b-9034-b78ae93ab156", "toId": "657ff382-024b-45a4-974a-3e41f1762074", "to_id": "657ff382-024b-45a4-974a-3e41f1762074", "to_name": "Cobalt Strike - S0154", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.934Z", "created_at": "2026-09-26T05:53:29.721Z", "modified": "2026-09-26T05:53:29.874Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:53:29.874Z" }, "description_available": false, "entity_type": "indicates", "fromId": "1315ce2a-6659-4f4f-b9b7-e2450564ca9b", "from_id": "1315ce2a-6659-4f4f-b9b7-e2450564ca9b", "from_name": null, "from_type": "Indicator", "id": "4f0010ef-33fc-457c-8021-77cee46c6cf9", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--91207f9c-9ea8-5457-968b-00af4dfc659c", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.209Z", "created_at": "2026-09-26T06:00:19.634Z", "modified": "2026-09-26T06:00:19.855Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:00:19.855Z" }, "description_available": false, "entity_type": "indicates", "fromId": "f0b6cabc-d961-4c2b-a9a0-4075ac17972c", "from_id": "f0b6cabc-d961-4c2b-a9a0-4075ac17972c", "from_name": null, "from_type": "Indicator", "id": "501e0cdc-e2c2-4215-8a52-89edf5ab2c09", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--4e458c86-705c-577c-b427-2028725f40fe", "toId": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_id": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_name": "CrowDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.227Z", "created_at": "2026-09-26T06:00:52.503Z", "modified": "2026-09-26T06:00:52.985Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:00:52.985Z" }, "description_available": false, "entity_type": "indicates", "fromId": "aaf834aa-275b-4a6a-9790-6971e8adf52d", "from_id": "aaf834aa-275b-4a6a-9790-6971e8adf52d", "from_name": null, "from_type": "Indicator", "id": "507318a2-1af0-46b8-b6cf-446cdd5978c0", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--34a89c59-937a-55b2-83d6-de8e678b8ae6", "toId": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_id": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_name": "PlugX - S0013", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.681Z", "created_at": "2026-09-26T05:46:40.600Z", "modified": "2026-09-26T05:46:40.852Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:46:40.852Z" }, "description_available": false, "entity_type": "indicates", "fromId": "157ca5cb-7d34-4fc3-83d2-bac13ceb9804", "from_id": "157ca5cb-7d34-4fc3-83d2-bac13ceb9804", "from_name": null, "from_type": "Indicator", "id": "50e0bb96-9da3-4a7f-a219-fd288d6cb775", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--af079e40-fae2-5489-beff-5c8278c364c3", "toId": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_id": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_name": "TernDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.262Z", "created_at": "2026-09-26T05:35:30.998Z", "modified": "2026-09-26T05:35:31.234Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:35:31.234Z" }, "description_available": false, "entity_type": "indicates", "fromId": "f7f8f4c3-42b1-433b-a4ab-f67c83968004", "from_id": "f7f8f4c3-42b1-433b-a4ab-f67c83968004", "from_name": null, "from_type": "Indicator", "id": "514362fc-7375-4bcc-b50b-3d809d44f164", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--7d21929d-b108-5e10-abf6-aa327b0c1f65", "toId": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_id": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_name": "STOWAWAY", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.381Z", "created_at": "2026-09-26T06:05:12.796Z", "modified": "2026-09-26T06:05:13.035Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:05:13.035Z" }, "description_available": false, "entity_type": "indicates", "fromId": "2d16d740-ae8a-45ff-8a8b-9032f924c3fa", "from_id": "2d16d740-ae8a-45ff-8a8b-9032f924c3fa", "from_name": null, "from_type": "Indicator", "id": "51790d48-b3d2-4f46-bc70-af4f2b822daa", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--6a1d8887-6933-5138-afec-9309297d32ef", "toId": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_id": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_name": "Melofee", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.216Z", "created_at": "2026-09-26T05:35:13.381Z", "modified": "2026-09-26T05:35:13.778Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:35:13.778Z" }, "description_available": false, "entity_type": "based-on", "fromId": "95ef732a-5859-4b75-a4ea-fd3cfe3f1618", "from_id": "95ef732a-5859-4b75-a4ea-fd3cfe3f1618", "from_name": null, "from_type": "Indicator", "id": "51fd0bf5-f5fb-471b-afd2-6bf2c0a58c5c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--d3b31f0a-302a-521f-b820-fef059788419", "toId": "b43b9fe9-5ab2-4d09-bb77-e585675093c6", "to_id": "b43b9fe9-5ab2-4d09-bb77-e585675093c6", "to_name": null, "to_type": "Url" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.518Z", "created_at": "2026-09-26T06:08:18.077Z", "modified": "2026-09-26T06:08:18.402Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:08:18.402Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c08d31e4-ff5a-45b7-8880-330403eced75", "from_id": "c08d31e4-ff5a-45b7-8880-330403eced75", "from_name": null, "from_type": "Indicator", "id": "52067268-a9d4-42da-b6d7-8ff4681e06de", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--e590e4c2-87db-5bd3-b935-0a2d26d55491", "toId": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_id": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_name": "Melofee", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.438Z", "created_at": "2026-09-26T05:40:38.943Z", "modified": "2026-09-26T05:40:39.150Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:40:39.150Z" }, "description_available": false, "entity_type": "indicates", "fromId": "01c74684-bdd9-45d1-84be-d24d189bcb28", "from_id": "01c74684-bdd9-45d1-84be-d24d189bcb28", "from_name": null, "from_type": "Indicator", "id": "532fad84-c04c-493e-a412-69bceab77a08", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--c41db669-46dd-55b4-bddd-24fb8168ef06", "toId": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_id": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_name": "CrowDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.609Z", "created_at": "2026-09-26T05:45:10.100Z", "modified": "2026-09-26T05:45:10.335Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:45:10.335Z" }, "description_available": false, "entity_type": "indicates", "fromId": "3be1760f-af98-4d5c-80e2-c0338b71f391", "from_id": "3be1760f-af98-4d5c-80e2-c0338b71f391", "from_name": null, "from_type": "Indicator", "id": "539c669d-8db6-40e5-9367-04faac6b2056", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--8a4e93fb-dfc5-56d9-ad34-a619bb781645", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.226Z", "created_at": "2026-09-26T06:00:46.360Z", "modified": "2026-09-26T06:00:46.784Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:00:46.784Z" }, "description_available": false, "entity_type": "indicates", "fromId": "aaf834aa-275b-4a6a-9790-6971e8adf52d", "from_id": "aaf834aa-275b-4a6a-9790-6971e8adf52d", "from_name": null, "from_type": "Indicator", "id": "53a1a880-d9ae-48ef-b2cf-6743f7560fcb", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--4b99ac7a-ef3a-5ef1-b9a7-10b18005eb65", "toId": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_id": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_name": "HelloBot", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.108Z", "created_at": "2026-09-26T05:35:01.163Z", "modified": "2026-09-26T05:35:02.124Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:35:02.124Z" }, "description_available": false, "entity_type": "based-on", "fromId": "2d8df4da-244f-458a-8c2d-ff67380121e9", "from_id": "2d8df4da-244f-458a-8c2d-ff67380121e9", "from_name": null, "from_type": "Indicator", "id": "53c73180-6950-41bc-ae97-55725fae3dfe", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--49b99d09-beff-570b-9b4e-531ac43fc450", "toId": "b2074404-2769-4ab5-8041-fea559804907", "to_id": "b2074404-2769-4ab5-8041-fea559804907", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.964Z", "created_at": "2026-09-26T05:54:03.078Z", "modified": "2026-09-26T05:54:03.239Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:54:03.239Z" }, "description_available": false, "entity_type": "indicates", "fromId": "2497f466-fac3-4bfc-ab1f-5ebcf363283b", "from_id": "2497f466-fac3-4bfc-ab1f-5ebcf363283b", "from_name": null, "from_type": "Indicator", "id": "53c84fd8-5a4c-4aaa-aaca-9340c5ad22eb", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--c4418a2b-eec4-55b8-a446-57c56e958fb4", "toId": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_id": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_name": "RatelS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.455Z", "created_at": "2026-09-26T05:41:00.174Z", "modified": "2026-09-26T05:41:00.415Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:41:00.415Z" }, "description_available": false, "entity_type": "indicates", "fromId": "4ff9e994-0564-43c3-8240-004f20eb7d3f", "from_id": "4ff9e994-0564-43c3-8240-004f20eb7d3f", "from_name": null, "from_type": "Indicator", "id": "54fbb0f9-188e-4ec4-96dd-ce8f335062e3", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--57b49cd5-465d-5abd-a49b-b42f23e399ab", "toId": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_id": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_name": "PlugX - S0013", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.176Z", "created_at": "2026-09-26T05:59:38.682Z", "modified": "2026-09-26T05:59:39.154Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:59:39.154Z" }, "description_available": false, "entity_type": "indicates", "fromId": "350ff6fa-1c04-4870-b345-041e0d3d6d92", "from_id": "350ff6fa-1c04-4870-b345-041e0d3d6d92", "from_name": null, "from_type": "Indicator", "id": "5516abd5-ce93-4ea2-8dc5-f63279ef3398", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--948ebe90-d93a-51a6-8214-ceb8ba5d3a72", "toId": "657ff382-024b-45a4-974a-3e41f1762074", "to_id": "657ff382-024b-45a4-974a-3e41f1762074", "to_name": "Cobalt Strike - S0154", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.788Z", "created_at": "2026-09-26T05:49:23.484Z", "modified": "2026-09-26T05:49:23.779Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:49:23.779Z" }, "description_available": false, "entity_type": "indicates", "fromId": "8134c07a-eec8-489c-80e7-aca40ccc6268", "from_id": "8134c07a-eec8-489c-80e7-aca40ccc6268", "from_name": null, "from_type": "Indicator", "id": "5588b38b-b86e-4d91-b768-72a0f3f928ae", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--a0cdf047-1b07-5160-8cf2-325bbc794d67", "toId": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_id": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_name": "RatelS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.228Z", "created_at": "2026-09-26T05:35:17.544Z", "modified": "2026-09-26T05:35:18.023Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:35:18.023Z" }, "description_available": false, "entity_type": "based-on", "fromId": "313c8419-28b4-4ef9-9855-91d315819bf8", "from_id": "313c8419-28b4-4ef9-9855-91d315819bf8", "from_name": null, "from_type": "Indicator", "id": "55af0117-26e7-4ab6-ba11-731304547c55", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--bde7bc4d-df5f-5d01-b11d-1d756737965b", "toId": "cd7ff8be-11f3-4197-9332-31bb24712c8c", "to_id": "cd7ff8be-11f3-4197-9332-31bb24712c8c", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.050Z", "created_at": "2026-09-26T05:56:02.721Z", "modified": "2026-09-26T05:56:03.647Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:56:03.647Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ea8ff45b-69d1-4069-bebe-6f7107045959", "from_id": "ea8ff45b-69d1-4069-bebe-6f7107045959", "from_name": null, "from_type": "Indicator", "id": "565d1a51-52ac-43ba-8d43-7ddbd123a1af", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--e539b381-2eee-5c48-ad2d-973709769b2f", "toId": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_id": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_name": "RatelS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.319Z", "created_at": "2026-09-26T06:03:12.513Z", "modified": "2026-09-26T06:03:16.972Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:03:16.972Z" }, "description_available": false, "entity_type": "indicates", "fromId": "6fbf4d94-634a-4763-b0e5-0cbe6e9f67ea", "from_id": "6fbf4d94-634a-4763-b0e5-0cbe6e9f67ea", "from_name": null, "from_type": "Indicator", "id": "5736905b-78d3-430f-b352-3b1ef40e597d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--5eb472e9-5da8-5a8a-9b88-6e2338b2dfda", "toId": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_id": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_name": "RatelS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.295Z", "created_at": "2026-09-26T06:02:23.371Z", "modified": "2026-09-26T06:02:23.647Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:02:23.647Z" }, "description_available": false, "entity_type": "indicates", "fromId": "3b95a828-10fe-4895-a5fa-606043535451", "from_id": "3b95a828-10fe-4895-a5fa-606043535451", "from_name": null, "from_type": "Indicator", "id": "5857927b-e760-42d8-9c40-1da61f3ae502", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--394df163-c365-587e-b1d0-c56be0349457", "toId": "657ff382-024b-45a4-974a-3e41f1762074", "to_id": "657ff382-024b-45a4-974a-3e41f1762074", "to_name": "Cobalt Strike - S0154", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.673Z", "created_at": "2026-09-26T05:46:35.724Z", "modified": "2026-09-26T05:46:36.098Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:46:36.098Z" }, "description_available": false, "entity_type": "indicates", "fromId": "157ca5cb-7d34-4fc3-83d2-bac13ceb9804", "from_id": "157ca5cb-7d34-4fc3-83d2-bac13ceb9804", "from_name": null, "from_type": "Indicator", "id": "58b36085-9a5b-4eed-b1ea-f74e7b89cba6", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--f6f4a276-e5ae-57e4-9c78-bdb700cd5eae", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.458Z", "created_at": "2026-09-26T06:06:53.482Z", "modified": "2026-09-26T06:06:53.700Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:06:53.700Z" }, "description_available": false, "entity_type": "indicates", "fromId": "5330b1c5-bebb-4760-ae47-12dd0e0d1e23", "from_id": "5330b1c5-bebb-4760-ae47-12dd0e0d1e23", "from_name": null, "from_type": "Indicator", "id": "597412da-58cb-4775-aa21-2595f054cc80", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--e70112fe-e229-5955-b3e0-142fdeaa835d", "toId": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_id": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_name": "STOWAWAY", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.282Z", "created_at": "2026-09-26T05:35:58.932Z", "modified": "2026-09-26T05:35:59.088Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:35:59.088Z" }, "description_available": false, "entity_type": "indicates", "fromId": "48f22366-f0fd-4667-b458-fc531795e8ff", "from_id": "48f22366-f0fd-4667-b458-fc531795e8ff", "from_name": null, "from_type": "Indicator", "id": "5a1309c6-d5d4-4024-b31d-d9c013428169", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--539154f1-840d-5a4e-a0b8-197e38e9b565", "toId": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_id": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_name": "Spark - S0543", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.846Z", "created_at": "2026-09-26T05:52:08.969Z", "modified": "2026-09-26T05:52:09.166Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:52:09.166Z" }, "description_available": false, "entity_type": "indicates", "fromId": "6ae45569-c03b-471f-80ff-50d7a804075a", "from_id": "6ae45569-c03b-471f-80ff-50d7a804075a", "from_name": null, "from_type": "Indicator", "id": "5a75714d-47f1-4062-971b-b73212c1de45", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--f9650a76-223b-563c-835c-1dcdd1a56273", "toId": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_id": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_name": "PlugX - S0013", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.367Z", "created_at": "2026-09-26T06:04:51.718Z", "modified": "2026-09-26T06:04:51.898Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:04:51.898Z" }, "description_available": false, "entity_type": "indicates", "fromId": "3c2ca4de-2c25-4802-a582-ebf285060ed9", "from_id": "3c2ca4de-2c25-4802-a582-ebf285060ed9", "from_name": null, "from_type": "Indicator", "id": "5aa6a7da-1ecc-4b27-98ba-e381f76dd45e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--97ca2ec5-efa9-5b6e-93e9-89d46aade0d1", "toId": "208a45aa-c18e-4619-9a90-7004849cab40", "to_id": "208a45aa-c18e-4619-9a90-7004849cab40", "to_name": "HemiGate", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.453Z", "created_at": "2026-09-26T05:41:02.683Z", "modified": "2026-09-26T05:41:02.988Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:41:02.988Z" }, "description_available": false, "entity_type": "indicates", "fromId": "4ff9e994-0564-43c3-8240-004f20eb7d3f", "from_id": "4ff9e994-0564-43c3-8240-004f20eb7d3f", "from_name": null, "from_type": "Indicator", "id": "5acd01e8-51dc-4bcd-95fd-637e0fb4b7c3", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--c4e2f505-7b85-5e6a-9393-a25c947e6d27", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.852Z", "created_at": "2026-09-26T05:52:16.858Z", "modified": "2026-09-26T05:52:17.053Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:52:17.053Z" }, "description_available": false, "entity_type": "indicates", "fromId": "6ae45569-c03b-471f-80ff-50d7a804075a", "from_id": "6ae45569-c03b-471f-80ff-50d7a804075a", "from_name": null, "from_type": "Indicator", "id": "5af2487d-4e47-4b5c-bdf2-052ff2652547", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--bc29029c-4f4b-5f10-84d7-4816d0ee3f52", "toId": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_id": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_name": "STOWAWAY", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.297Z", "created_at": "2026-09-26T05:36:16.147Z", "modified": "2026-09-26T05:36:16.341Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:36:16.341Z" }, "description_available": false, "entity_type": "indicates", "fromId": "20bc512e-2f63-438d-bcee-abdf39614bf5", "from_id": "20bc512e-2f63-438d-bcee-abdf39614bf5", "from_name": null, "from_type": "Indicator", "id": "5b08ee51-e92d-4d2d-90e0-05e8286ad495", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--47d4a283-acb5-5653-bb95-7e74fb92ca21", "toId": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_id": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_name": "Melofee", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.411Z", "created_at": "2026-09-26T06:05:51.776Z", "modified": "2026-09-26T06:05:51.918Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:05:51.918Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ac6046d8-f570-4eca-af26-b22ab4b74e00", "from_id": "ac6046d8-f570-4eca-af26-b22ab4b74e00", "from_name": null, "from_type": "Indicator", "id": "5b4a9769-9df5-49fe-884c-119fa8696ed6", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--07d6a01e-a301-59c0-8156-815c3fb6fff0", "toId": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_id": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_name": "CrowDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.351Z", "created_at": "2026-09-26T05:37:30.349Z", "modified": "2026-09-26T05:37:30.777Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:37:30.777Z" }, "description_available": false, "entity_type": "indicates", "fromId": "94a7b3a6-0b64-4746-86ff-6647d1a2df8d", "from_id": "94a7b3a6-0b64-4746-86ff-6647d1a2df8d", "from_name": null, "from_type": "Indicator", "id": "5b926a7a-1a18-499e-b363-46f003ef9b7d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--e05a7850-fa7c-5e5f-8375-b58e265acc2f", "toId": "208a45aa-c18e-4619-9a90-7004849cab40", "to_id": "208a45aa-c18e-4619-9a90-7004849cab40", "to_name": "HemiGate", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.063Z", "created_at": "2026-09-26T05:34:53.161Z", "modified": "2026-09-26T05:34:53.819Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:34:53.819Z" }, "description_available": false, "entity_type": "based-on", "fromId": "157ca5cb-7d34-4fc3-83d2-bac13ceb9804", "from_id": "157ca5cb-7d34-4fc3-83d2-bac13ceb9804", "from_name": null, "from_type": "Indicator", "id": "5bc17f67-02a4-431f-859c-08b7a64156a7", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--330b7742-0779-5685-8485-f34b878d7ea8", "toId": "ffe798a7-54cc-419f-8e75-b8a9ec869d0d", "to_id": "ffe798a7-54cc-419f-8e75-b8a9ec869d0d", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.019Z", "created_at": "2026-09-26T05:55:20.975Z", "modified": "2026-09-26T05:55:22.748Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:55:22.748Z" }, "description_available": false, "entity_type": "indicates", "fromId": "cd0c196b-8e17-4794-80e8-7129d42950e2", "from_id": "cd0c196b-8e17-4794-80e8-7129d42950e2", "from_name": null, "from_type": "Indicator", "id": "5bc29c4c-d72d-406f-9432-a319b6e1e381", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--4cf3b272-ce97-5eb1-9157-559524f112e5", "toId": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_id": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_name": "Melofee", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.527Z", "created_at": "2026-09-26T06:08:31.104Z", "modified": "2026-09-26T06:08:31.408Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:08:31.408Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c08d31e4-ff5a-45b7-8880-330403eced75", "from_id": "c08d31e4-ff5a-45b7-8880-330403eced75", "from_name": null, "from_type": "Indicator", "id": "5c79e8ac-57f0-4f69-95be-34e6a6e92dc4", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--b68cdad1-1e4c-51fb-beb3-4508770a189d", "toId": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_id": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_name": "RatelS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.985Z", "created_at": "2026-09-26T05:54:35.572Z", "modified": "2026-09-26T05:54:37.453Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:54:37.453Z" }, "description_available": false, "entity_type": "indicates", "fromId": "2d8df4da-244f-458a-8c2d-ff67380121e9", "from_id": "2d8df4da-244f-458a-8c2d-ff67380121e9", "from_name": null, "from_type": "Indicator", "id": "5c7afa0d-f36f-4956-abf8-fd2c9efa7443", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--f7fe62b6-6d32-572f-b34c-95cc2c9701b8", "toId": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_id": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_name": "RatelS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.244Z", "created_at": "2026-09-26T05:35:18.616Z", "modified": "2026-09-26T05:35:19.025Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:35:19.025Z" }, "description_available": false, "entity_type": "based-on", "fromId": "c9493e20-dc6a-4938-8fee-746005c4ae07", "from_id": "c9493e20-dc6a-4938-8fee-746005c4ae07", "from_name": null, "from_type": "Indicator", "id": "5cec560c-9773-4276-92b3-ae07d9ca98de", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--b86d0b96-b431-53d4-98e8-456e70fd48d2", "toId": "dd7ebe8e-4dea-4c48-88b8-1ca32915aa4c", "to_id": "dd7ebe8e-4dea-4c48-88b8-1ca32915aa4c", "to_name": null, "to_type": "Hostname" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.482Z", "created_at": "2026-09-26T06:07:25.255Z", "modified": "2026-09-26T06:07:26.909Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:07:26.909Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d7d77ca0-8c06-4de9-bacb-a526f344e2e9", "from_id": "d7d77ca0-8c06-4de9-bacb-a526f344e2e9", "from_name": null, "from_type": "Indicator", "id": "5d254b22-5921-4932-b804-28ba9d53d150", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--71f30d81-8557-5ac6-b8a0-c78376289bbd", "toId": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_id": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_name": "TernDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.394Z", "created_at": "2026-09-26T05:39:38.425Z", "modified": "2026-09-26T05:39:38.537Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:39:38.537Z" }, "description_available": false, "entity_type": "indicates", "fromId": "8c1b4518-8219-46bb-a619-1c69182e4eec", "from_id": "8c1b4518-8219-46bb-a619-1c69182e4eec", "from_name": null, "from_type": "Indicator", "id": "5d2e69e4-5661-4239-8c51-1a98d80bf0a1", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--7b9b9b67-da23-524c-b5f0-88629dddcb8e", "toId": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_id": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_name": "TernDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.343Z", "created_at": "2026-09-26T06:04:27.760Z", "modified": "2026-09-26T06:04:27.992Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:04:27.992Z" }, "description_available": false, "entity_type": "indicates", "fromId": "95ef732a-5859-4b75-a4ea-fd3cfe3f1618", "from_id": "95ef732a-5859-4b75-a4ea-fd3cfe3f1618", "from_name": null, "from_type": "Indicator", "id": "5d424ad8-f9d1-4931-a613-6fe57ec20260", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--60b6d04d-d452-5592-bb6e-0a2b64e6bc40", "toId": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_id": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_name": "STOWAWAY", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.437Z", "created_at": "2026-09-26T05:40:38.209Z", "modified": "2026-09-26T05:40:38.350Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:40:38.350Z" }, "description_available": false, "entity_type": "indicates", "fromId": "01c74684-bdd9-45d1-84be-d24d189bcb28", "from_id": "01c74684-bdd9-45d1-84be-d24d189bcb28", "from_name": null, "from_type": "Indicator", "id": "5d99c392-2871-47e8-90b7-669d79ea30b3", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--1070b234-2e62-52e8-8652-cc50a72f11db", "toId": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_id": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_name": "Spark - S0543", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.694Z", "created_at": "2026-09-26T05:47:06.311Z", "modified": "2026-09-26T05:47:06.739Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:47:06.739Z" }, "description_available": false, "entity_type": "indicates", "fromId": "a7a198b8-f0a3-4221-b768-191720f061b9", "from_id": "a7a198b8-f0a3-4221-b768-191720f061b9", "from_name": null, "from_type": "Indicator", "id": "5d9f9ac1-250c-4050-90ed-58fcc04c2d30", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--0597786c-f813-56c9-9e2d-f96bdd245661", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.087Z", "created_at": "2026-09-26T05:58:06.299Z", "modified": "2026-09-26T05:58:06.520Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:58:06.520Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d7f88a85-9ab3-45b8-982b-294d838461a6", "from_id": "d7f88a85-9ab3-45b8-982b-294d838461a6", "from_name": null, "from_type": "Indicator", "id": "5dc54ce5-67bd-46dd-91d5-8df9ba71a746", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--333541f8-223d-5e17-9065-9537eb4aa937", "toId": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_id": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_name": "Melofee", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.338Z", "created_at": "2026-09-26T06:04:24.972Z", "modified": "2026-09-26T06:04:26.312Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:04:26.312Z" }, "description_available": false, "entity_type": "indicates", "fromId": "95ef732a-5859-4b75-a4ea-fd3cfe3f1618", "from_id": "95ef732a-5859-4b75-a4ea-fd3cfe3f1618", "from_name": null, "from_type": "Indicator", "id": "5e04cf84-2ed8-46e6-92f3-76614b708e5f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--29976696-e4fa-5e78-b3b0-130759530125", "toId": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_id": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_name": "HelloBot", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.586Z", "created_at": "2026-09-26T06:11:20.071Z", "modified": "2026-09-26T06:11:20.329Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:11:20.329Z" }, "description_available": false, "entity_type": "indicates", "fromId": "e82e98a0-5491-4b41-82dd-1ffa975dde57", "from_id": "e82e98a0-5491-4b41-82dd-1ffa975dde57", "from_name": null, "from_type": "Indicator", "id": "5e7d27fe-7fa1-4796-a6a9-4165048d0c40", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--91824bac-923d-5608-a578-d2d88559e372", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.414Z", "created_at": "2026-09-26T05:40:07.695Z", "modified": "2026-09-26T05:40:08.752Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:40:08.752Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d4aa073f-c77f-4db6-a515-5246469cf6b0", "from_id": "d4aa073f-c77f-4db6-a515-5246469cf6b0", "from_name": null, "from_type": "Indicator", "id": "5f503c5a-2611-47ae-9c00-f3922475a623", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--bc930058-4e52-571a-a741-ed8e842d3ad2", "toId": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_id": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_name": "Spark - S0543", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.702Z", "created_at": "2026-09-26T05:47:09.698Z", "modified": "2026-09-26T05:47:11.938Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:47:11.938Z" }, "description_available": false, "entity_type": "indicates", "fromId": "a7a198b8-f0a3-4221-b768-191720f061b9", "from_id": "a7a198b8-f0a3-4221-b768-191720f061b9", "from_name": null, "from_type": "Indicator", "id": "5f70251c-95ea-4f48-b673-05bbecd75600", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--9bce41cf-90b9-5db2-a5dd-825714cf66f1", "toId": "208a45aa-c18e-4619-9a90-7004849cab40", "to_id": "208a45aa-c18e-4619-9a90-7004849cab40", "to_name": "HemiGate", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.978Z", "created_at": "2026-09-26T05:54:26.464Z", "modified": "2026-09-26T05:54:26.811Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:54:26.811Z" }, "description_available": false, "entity_type": "indicates", "fromId": "2d8df4da-244f-458a-8c2d-ff67380121e9", "from_id": "2d8df4da-244f-458a-8c2d-ff67380121e9", "from_name": null, "from_type": "Indicator", "id": "61013cff-4d07-4b10-ab3a-1045ebe36487", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--be372b45-1ac2-5180-8a49-16a8373cfe86", "toId": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_id": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_name": "PlugX - S0013", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.069Z", "created_at": "2026-09-26T05:56:23.361Z", "modified": "2026-09-26T05:56:23.627Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:56:23.627Z" }, "description_available": false, "entity_type": "indicates", "fromId": "66f40cca-cc72-4806-beef-47ae23125e5f", "from_id": "66f40cca-cc72-4806-beef-47ae23125e5f", "from_name": null, "from_type": "Indicator", "id": "612b40c2-13aa-445f-9513-b5b7c128b43d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--62d6f715-10ba-557b-bf36-c0e923d53e62", "toId": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_id": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_name": "Spark - S0543", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.285Z", "created_at": "2026-09-26T05:36:06.261Z", "modified": "2026-09-26T05:36:06.488Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:36:06.488Z" }, "description_available": false, "entity_type": "indicates", "fromId": "48f22366-f0fd-4667-b458-fc531795e8ff", "from_id": "48f22366-f0fd-4667-b458-fc531795e8ff", "from_name": null, "from_type": "Indicator", "id": "614e21da-bfa9-4f2a-8e56-1a502632d253", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--7e871d1f-985c-59b5-83da-bceb83392db4", "toId": "208a45aa-c18e-4619-9a90-7004849cab40", "to_id": "208a45aa-c18e-4619-9a90-7004849cab40", "to_name": "HemiGate", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.548Z", "created_at": "2026-09-26T06:09:02.895Z", "modified": "2026-09-26T06:09:03.179Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:09:03.179Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c9493e20-dc6a-4938-8fee-746005c4ae07", "from_id": "c9493e20-dc6a-4938-8fee-746005c4ae07", "from_name": null, "from_type": "Indicator", "id": "61e3373a-e12b-404f-9901-d4f0e7e2d094", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--8e8714ae-5799-5f90-aee1-d55ad6d59eb7", "toId": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_id": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_name": "CrowDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.822Z", "created_at": "2026-09-26T05:51:37.742Z", "modified": "2026-09-26T05:51:39.406Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:51:39.406Z" }, "description_available": false, "entity_type": "indicates", "fromId": "10b221ff-1d17-4b38-ae27-73235f136031", "from_id": "10b221ff-1d17-4b38-ae27-73235f136031", "from_name": null, "from_type": "Indicator", "id": "62fe086e-7306-40c2-a68f-f064932ea038", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--e371b0c8-8d5e-5c65-b38c-649d8e76e07c", "toId": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_id": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_name": "Melofee", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.344Z", "created_at": "2026-09-26T06:04:28.519Z", "modified": "2026-09-26T06:04:28.785Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:04:28.785Z" }, "description_available": false, "entity_type": "indicates", "fromId": "95ef732a-5859-4b75-a4ea-fd3cfe3f1618", "from_id": "95ef732a-5859-4b75-a4ea-fd3cfe3f1618", "from_name": null, "from_type": "Indicator", "id": "636c1823-ba26-408d-9467-6696024e4cff", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--5ac01b34-f90d-58f1-881e-3abc273689e0", "toId": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_id": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_name": "CrowDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.659Z", "created_at": "2026-09-26T05:46:08.009Z", "modified": "2026-09-26T05:46:08.223Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:46:08.223Z" }, "description_available": false, "entity_type": "indicates", "fromId": "681c2240-1fb8-466d-a533-8f1d8132b27b", "from_id": "681c2240-1fb8-466d-a533-8f1d8132b27b", "from_name": null, "from_type": "Indicator", "id": "63ea3381-1c2a-481e-8027-d8a2c271813d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--a1b8c461-04ea-591e-b9bb-5548162b0388", "toId": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_id": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_name": "CrowDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.744Z", "created_at": "2026-09-26T05:48:14.512Z", "modified": "2026-09-26T05:48:14.720Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:48:14.720Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ce5e270a-a0f5-4d07-9faf-6493364c1a2b", "from_id": "ce5e270a-a0f5-4d07-9faf-6493364c1a2b", "from_name": null, "from_type": "Indicator", "id": "640af4fa-8ad2-4380-a27b-c2b4c65d7ec6", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--b625e1c3-2013-5f11-8343-89a6a6a1f55b", "toId": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_id": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_name": "TernDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.806Z", "created_at": "2026-09-26T05:49:50.011Z", "modified": "2026-09-26T05:49:50.256Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:49:50.256Z" }, "description_available": false, "entity_type": "indicates", "fromId": "2227cc4b-afc7-4060-b897-a1a458d90abd", "from_id": "2227cc4b-afc7-4060-b897-a1a458d90abd", "from_name": null, "from_type": "Indicator", "id": "64f432ac-6d73-4169-bbfc-4d7d5161691b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--51483f27-73f9-50f7-ad7e-fb8a69122e5f", "toId": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_id": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_name": "Spark - S0543", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.329Z", "created_at": "2026-09-26T05:37:06.358Z", "modified": "2026-09-26T05:37:06.524Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:37:06.524Z" }, "description_available": false, "entity_type": "indicates", "fromId": "b2490479-1c8f-4288-a8e1-23589e1535cf", "from_id": "b2490479-1c8f-4288-a8e1-23589e1535cf", "from_name": null, "from_type": "Indicator", "id": "65bee30e-524b-4553-b73b-a7307e424a44", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--e632e97e-7abe-59ec-8e38-2fa76bc85b67", "toId": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_id": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_name": "RatelS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.248Z", "created_at": "2026-09-26T05:35:19.169Z", "modified": "2026-09-26T05:35:19.362Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:35:19.362Z" }, "description_available": false, "entity_type": "based-on", "fromId": "6ac03fc4-4c10-4d8f-b546-7ce2b9422c39", "from_id": "6ac03fc4-4c10-4d8f-b546-7ce2b9422c39", "from_name": null, "from_type": "Indicator", "id": "65cc3585-4dee-4dbb-aacf-23527f470660", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--e997c771-04ad-55ca-95fa-235007f75749", "toId": "d5ef1d29-2c13-4e41-ac4d-39f613e66cbb", "to_id": "d5ef1d29-2c13-4e41-ac4d-39f613e66cbb", "to_name": null, "to_type": "Hostname" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.432Z", "created_at": "2026-09-26T05:40:33.591Z", "modified": "2026-09-26T05:40:33.850Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:40:33.850Z" }, "description_available": false, "entity_type": "indicates", "fromId": "01c74684-bdd9-45d1-84be-d24d189bcb28", "from_id": "01c74684-bdd9-45d1-84be-d24d189bcb28", "from_name": null, "from_type": "Indicator", "id": "6669e2bc-023b-4642-8918-c608a704ba5a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--03dc7458-9fbc-56b2-8050-e0feb7b6858a", "toId": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_id": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_name": "HelloBot", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.743Z", "created_at": "2026-09-26T05:48:11.494Z", "modified": "2026-09-26T05:48:13.024Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:48:13.024Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ce5e270a-a0f5-4d07-9faf-6493364c1a2b", "from_id": "ce5e270a-a0f5-4d07-9faf-6493364c1a2b", "from_name": null, "from_type": "Indicator", "id": "670400b0-16e3-44aa-9ee5-6eb08af6e4f7", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--23d1ccf7-05a0-5d39-b290-7acb616b699d", "toId": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_id": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_name": "STOWAWAY", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.915Z", "created_at": "2026-09-26T05:53:07.083Z", "modified": "2026-09-26T05:53:07.328Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:53:07.328Z" }, "description_available": false, "entity_type": "indicates", "fromId": "fdaa0a79-121c-4e17-91bb-e23da88da18e", "from_id": "fdaa0a79-121c-4e17-91bb-e23da88da18e", "from_name": null, "from_type": "Indicator", "id": "67644db5-d229-426d-9d80-954e0f28976c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--f81554c6-698d-5a23-b6a5-b008cd1a8c46", "toId": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_id": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_name": "Spark - S0543", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.737Z", "created_at": "2026-09-26T05:48:03.351Z", "modified": "2026-09-26T05:48:05.412Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:48:05.412Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ce5e270a-a0f5-4d07-9faf-6493364c1a2b", "from_id": "ce5e270a-a0f5-4d07-9faf-6493364c1a2b", "from_name": null, "from_type": "Indicator", "id": "67bd62ff-9efb-4c8d-9125-4dbcd64be23d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--71aef1f6-1b13-50d4-9064-e238b98749b2", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.824Z", "created_at": "2026-09-26T05:51:42.961Z", "modified": "2026-09-26T05:51:43.186Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:51:43.186Z" }, "description_available": false, "entity_type": "indicates", "fromId": "10b221ff-1d17-4b38-ae27-73235f136031", "from_id": "10b221ff-1d17-4b38-ae27-73235f136031", "from_name": null, "from_type": "Indicator", "id": "67db80c5-7bd1-4c29-98f5-c3aeef45ec38", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--ab14aeba-20f3-5f8d-8e59-94575d198966", "toId": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_id": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_name": "PlugX - S0013", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.128Z", "created_at": "2026-09-26T05:58:39.190Z", "modified": "2026-09-26T05:58:39.318Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:58:39.318Z" }, "description_available": false, "entity_type": "indicates", "fromId": "52b56463-7f22-48f8-b036-35d89d2dabcb", "from_id": "52b56463-7f22-48f8-b036-35d89d2dabcb", "from_name": null, "from_type": "Indicator", "id": "67f63d33-d8d2-4528-a7fd-845329f1186e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--e9954435-d63c-57e1-a434-1d1bf2f0dbe3", "toId": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_id": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_name": "TernDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.632Z", "created_at": "2026-09-26T05:45:39.458Z", "modified": "2026-09-26T05:45:39.658Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:45:39.658Z" }, "description_available": false, "entity_type": "indicates", "fromId": "cdadaaa5-0866-4957-b6d7-c64be31a1cf9", "from_id": "cdadaaa5-0866-4957-b6d7-c64be31a1cf9", "from_name": null, "from_type": "Indicator", "id": "681f5faa-cfbc-4f3c-a827-c670ca6f88b1", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--4231535a-bf64-567b-9352-e1ca6831b057", "toId": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_id": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_name": "PlugX - S0013", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.145Z", "created_at": "2026-09-26T05:59:01.207Z", "modified": "2026-09-26T05:59:01.597Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:59:01.597Z" }, "description_available": false, "entity_type": "indicates", "fromId": "56d609d1-e0ef-4633-8cfe-a3e1f792fbff", "from_id": "56d609d1-e0ef-4633-8cfe-a3e1f792fbff", "from_name": null, "from_type": "Indicator", "id": "6836c588-831d-43bc-87a6-2086d98ee300", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--8f67cf3c-f41e-5998-8078-ca55ceb897de", "toId": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_id": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_name": "HelloBot", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.170Z", "created_at": "2026-09-26T05:59:33.159Z", "modified": "2026-09-26T05:59:33.352Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:59:33.352Z" }, "description_available": false, "entity_type": "indicates", "fromId": "350ff6fa-1c04-4870-b345-041e0d3d6d92", "from_id": "350ff6fa-1c04-4870-b345-041e0d3d6d92", "from_name": null, "from_type": "Indicator", "id": "6854288d-79b6-4829-b201-a1e7503a5aaa", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--355bca49-794d-5890-a671-c39ee8d46d2f", "toId": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_id": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_name": "HelloBot", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.573Z", "created_at": "2026-09-26T05:43:26.835Z", "modified": "2026-09-26T05:43:27.057Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:43:27.057Z" }, "description_available": false, "entity_type": "indicates", "fromId": "b5ad9feb-b128-47fb-9914-8319d0f48229", "from_id": "b5ad9feb-b128-47fb-9914-8319d0f48229", "from_name": null, "from_type": "Indicator", "id": "685965f3-e6e5-4e52-a9b7-1a3a8de24134", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--a0537cd2-70d8-5eec-8e2b-e8d63ea467ea", "toId": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_id": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_name": "RatelS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.758Z", "created_at": "2026-09-26T05:48:45.778Z", "modified": "2026-09-26T05:48:46.288Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:48:46.288Z" }, "description_available": false, "entity_type": "indicates", "fromId": "1a15e67e-da7b-42ec-b24a-d47fd8aa0767", "from_id": "1a15e67e-da7b-42ec-b24a-d47fd8aa0767", "from_name": null, "from_type": "Indicator", "id": "686705a2-f709-4d66-9eaa-21db3547b5c0", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--354fb93d-ea00-5dd1-92d2-245e097e6b53", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.610Z", "created_at": "2026-09-26T05:45:12.766Z", "modified": "2026-09-26T05:45:12.915Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:45:12.915Z" }, "description_available": false, "entity_type": "indicates", "fromId": "3be1760f-af98-4d5c-80e2-c0338b71f391", "from_id": "3be1760f-af98-4d5c-80e2-c0338b71f391", "from_name": null, "from_type": "Indicator", "id": "68cad652-f703-4cae-960d-175809c5a7fe", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--4a79689f-13f3-5306-bb00-73f8e9c969b0", "toId": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_id": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_name": "HelloBot", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.231Z", "created_at": "2026-09-26T06:00:53.535Z", "modified": "2026-09-26T06:00:53.835Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:00:53.835Z" }, "description_available": false, "entity_type": "indicates", "fromId": "aaf834aa-275b-4a6a-9790-6971e8adf52d", "from_id": "aaf834aa-275b-4a6a-9790-6971e8adf52d", "from_name": null, "from_type": "Indicator", "id": "68e1c32f-7284-455a-b54b-aed3c3e437d6", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--fc107848-78ad-5302-a934-6e51948a3f57", "toId": "657ff382-024b-45a4-974a-3e41f1762074", "to_id": "657ff382-024b-45a4-974a-3e41f1762074", "to_name": "Cobalt Strike - S0154", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.547Z", "created_at": "2026-09-26T06:08:59.075Z", "modified": "2026-09-26T06:08:59.343Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:08:59.343Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c9493e20-dc6a-4938-8fee-746005c4ae07", "from_id": "c9493e20-dc6a-4938-8fee-746005c4ae07", "from_name": null, "from_type": "Indicator", "id": "69406991-1784-42d1-b594-f8795c69033f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--8288b131-8dad-5ce0-a87b-72eab734b217", "toId": "657ff382-024b-45a4-974a-3e41f1762074", "to_id": "657ff382-024b-45a4-974a-3e41f1762074", "to_name": "Cobalt Strike - S0154", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.984Z", "created_at": "2026-09-26T05:54:32.006Z", "modified": "2026-09-26T05:54:32.194Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:54:32.194Z" }, "description_available": false, "entity_type": "indicates", "fromId": "2d8df4da-244f-458a-8c2d-ff67380121e9", "from_id": "2d8df4da-244f-458a-8c2d-ff67380121e9", "from_name": null, "from_type": "Indicator", "id": "69663afd-a2f9-4472-97a8-2d7fba25b61f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--d8c9d8b9-13c5-5d73-8dd0-0297addc1ad5", "toId": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_id": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_name": "TernDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.273Z", "created_at": "2026-09-26T06:02:03.073Z", "modified": "2026-09-26T06:02:03.264Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:02:03.264Z" }, "description_available": false, "entity_type": "indicates", "fromId": "2c0b3e29-5bb5-4044-8031-4f47cd51a008", "from_id": "2c0b3e29-5bb5-4044-8031-4f47cd51a008", "from_name": null, "from_type": "Indicator", "id": "69ec260d-ac2c-40c3-abdb-9ebbe5bb5957", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--0b22e148-c46c-5a5f-9e6b-38a5613675fa", "toId": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_id": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_name": "Spark - S0543", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.371Z", "created_at": "2026-09-26T05:39:10.815Z", "modified": "2026-09-26T05:39:11.939Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:39:11.939Z" }, "description_available": false, "entity_type": "indicates", "fromId": "eb51ab90-3d38-4f58-84c1-b0700196508c", "from_id": "eb51ab90-3d38-4f58-84c1-b0700196508c", "from_name": null, "from_type": "Indicator", "id": "6a578990-823c-4297-a888-aaccac52bd57", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--d71f2ea0-ce86-5772-bc2b-37ec64e66c35", "toId": "657ff382-024b-45a4-974a-3e41f1762074", "to_id": "657ff382-024b-45a4-974a-3e41f1762074", "to_name": "Cobalt Strike - S0154", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.070Z", "created_at": "2026-09-26T05:57:57.143Z", "modified": "2026-09-26T05:57:57.292Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:57:57.292Z" }, "description_available": false, "entity_type": "indicates", "fromId": "66f40cca-cc72-4806-beef-47ae23125e5f", "from_id": "66f40cca-cc72-4806-beef-47ae23125e5f", "from_name": null, "from_type": "Indicator", "id": "6a6c0627-53f9-4dc7-bb2d-02c952d20cb0", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--fb0b5a64-8d0c-5c57-a605-227e95737506", "toId": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_id": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_name": "STOWAWAY", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.053Z", "created_at": "2026-09-26T05:34:51.772Z", "modified": "2026-09-26T05:34:52.328Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:34:52.328Z" }, "description_available": false, "entity_type": "based-on", "fromId": "3be1760f-af98-4d5c-80e2-c0338b71f391", "from_id": "3be1760f-af98-4d5c-80e2-c0338b71f391", "from_name": null, "from_type": "Indicator", "id": "6b0ecbbd-cce7-452e-8cb7-35d1c2470148", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--51aa9b15-a506-5de2-a3e8-bbf1f3339f30", "toId": "2055a094-ceaf-4dfb-aba7-f26e1663bc4a", "to_id": "2055a094-ceaf-4dfb-aba7-f26e1663bc4a", "to_name": null, "to_type": "IPv4Addr" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.570Z", "created_at": "2026-09-26T06:10:54.959Z", "modified": "2026-09-26T06:10:55.229Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:10:55.229Z" }, "description_available": false, "entity_type": "indicates", "fromId": "6ac03fc4-4c10-4d8f-b546-7ce2b9422c39", "from_id": "6ac03fc4-4c10-4d8f-b546-7ce2b9422c39", "from_name": null, "from_type": "Indicator", "id": "6b60e3b8-ef3b-4327-bf9e-5dba9e517059", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--d0577d46-5576-528d-96ed-b83fc1ac9d91", "toId": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_id": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_name": "STOWAWAY", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.345Z", "created_at": "2026-09-26T06:04:38.688Z", "modified": "2026-09-26T06:04:38.844Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:04:38.844Z" }, "description_available": false, "entity_type": "indicates", "fromId": "95ef732a-5859-4b75-a4ea-fd3cfe3f1618", "from_id": "95ef732a-5859-4b75-a4ea-fd3cfe3f1618", "from_name": null, "from_type": "Indicator", "id": "6bcd64fb-a2e5-4a3c-b55f-288fa8cca161", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--249cba4e-3fba-53a9-92fa-56e4212ec3aa", "toId": "208a45aa-c18e-4619-9a90-7004849cab40", "to_id": "208a45aa-c18e-4619-9a90-7004849cab40", "to_name": "HemiGate", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.955Z", "created_at": "2026-09-26T05:53:56.874Z", "modified": "2026-09-26T05:53:57.112Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:53:57.112Z" }, "description_available": false, "entity_type": "indicates", "fromId": "2497f466-fac3-4bfc-ab1f-5ebcf363283b", "from_id": "2497f466-fac3-4bfc-ab1f-5ebcf363283b", "from_name": null, "from_type": "Indicator", "id": "6c70eab4-96e8-4daf-af3d-bf78a524bd30", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--a8239366-54cf-50cd-a1d6-3a1be74afd49", "toId": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_id": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_name": "Melofee", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.389Z", "created_at": "2026-09-26T06:05:25.223Z", "modified": "2026-09-26T06:05:25.453Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:05:25.453Z" }, "description_available": false, "entity_type": "indicates", "fromId": "2d16d740-ae8a-45ff-8a8b-9032f924c3fa", "from_id": "2d16d740-ae8a-45ff-8a8b-9032f924c3fa", "from_name": null, "from_type": "Indicator", "id": "6df32ce9-5ced-407f-a599-7a19ab8c957b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--70c3856f-6343-5e9e-afa1-67fef06c9cb4", "toId": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_id": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_name": "CrowDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.850Z", "created_at": "2026-09-26T05:52:12.145Z", "modified": "2026-09-26T05:52:12.514Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:52:12.514Z" }, "description_available": false, "entity_type": "indicates", "fromId": "6ae45569-c03b-471f-80ff-50d7a804075a", "from_id": "6ae45569-c03b-471f-80ff-50d7a804075a", "from_name": null, "from_type": "Indicator", "id": "6e26f9a6-d98f-4a87-996f-a600efec5cdc", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--b05d0c9a-f6e9-54f9-a3ef-02e4b0c45442", "toId": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_id": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_name": "Spark - S0543", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.295Z", "created_at": "2026-09-26T06:02:23.889Z", "modified": "2026-09-26T06:02:24.106Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:02:24.106Z" }, "description_available": false, "entity_type": "indicates", "fromId": "3b95a828-10fe-4895-a5fa-606043535451", "from_id": "3b95a828-10fe-4895-a5fa-606043535451", "from_name": null, "from_type": "Indicator", "id": "6e9cee4f-1acd-4bde-b4ef-6a1a2c85fe1d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--90681d26-68e8-5d83-a37d-615011eb4d7d", "toId": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_id": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_name": "STOWAWAY", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.064Z", "created_at": "2026-09-26T05:56:18.385Z", "modified": "2026-09-26T05:56:18.656Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:56:18.656Z" }, "description_available": false, "entity_type": "indicates", "fromId": "66f40cca-cc72-4806-beef-47ae23125e5f", "from_id": "66f40cca-cc72-4806-beef-47ae23125e5f", "from_name": null, "from_type": "Indicator", "id": "6ec02d50-8453-49d8-8519-f3aa1da81cd7", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--da753dc7-e650-5b08-aab9-6c91e1387aca", "toId": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_id": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_name": "HelloBot", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.961Z", "created_at": "2026-09-26T05:54:03.486Z", "modified": "2026-09-26T05:54:03.666Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:54:03.666Z" }, "description_available": false, "entity_type": "indicates", "fromId": "2497f466-fac3-4bfc-ab1f-5ebcf363283b", "from_id": "2497f466-fac3-4bfc-ab1f-5ebcf363283b", "from_name": null, "from_type": "Indicator", "id": "6ef84598-2918-4d5c-8668-d166eb6765bf", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--afbec7f5-390b-5fca-b1ef-f199be00f08f", "toId": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_id": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_name": "Spark - S0543", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.328Z", "created_at": "2026-09-26T05:37:01.538Z", "modified": "2026-09-26T05:37:01.933Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:37:01.933Z" }, "description_available": false, "entity_type": "indicates", "fromId": "b2490479-1c8f-4288-a8e1-23589e1535cf", "from_id": "b2490479-1c8f-4288-a8e1-23589e1535cf", "from_name": null, "from_type": "Indicator", "id": "6f222a4a-08cb-49b7-90fd-98e5aeb51604", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--39997e89-a795-5aaa-ba73-731ca6964fe8", "toId": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_id": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_name": "TernDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.594Z", "created_at": "2026-09-26T06:11:21.891Z", "modified": "2026-09-26T06:11:22.062Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:11:22.062Z" }, "description_available": false, "entity_type": "indicates", "fromId": "e82e98a0-5491-4b41-82dd-1ffa975dde57", "from_id": "e82e98a0-5491-4b41-82dd-1ffa975dde57", "from_name": null, "from_type": "Indicator", "id": "6fcb414b-35cc-46c1-a53e-c79b2a883bb3", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--b9a5cccc-f964-558f-a2d2-326a75195864", "toId": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_id": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_name": "CrowDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.263Z", "created_at": "2026-09-26T05:35:32.791Z", "modified": "2026-09-26T05:35:32.924Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:35:32.924Z" }, "description_available": false, "entity_type": "indicates", "fromId": "f7f8f4c3-42b1-433b-a4ab-f67c83968004", "from_id": "f7f8f4c3-42b1-433b-a4ab-f67c83968004", "from_name": null, "from_type": "Indicator", "id": "70e9a628-93f9-4b83-ab7e-e9d66b2c4269", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--c37c3b57-e362-56be-9683-18fa31bd3417", "toId": "208a45aa-c18e-4619-9a90-7004849cab40", "to_id": "208a45aa-c18e-4619-9a90-7004849cab40", "to_name": "HemiGate", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.126Z", "created_at": "2026-09-26T05:58:38.726Z", "modified": "2026-09-26T05:58:38.968Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:58:38.968Z" }, "description_available": false, "entity_type": "indicates", "fromId": "52b56463-7f22-48f8-b036-35d89d2dabcb", "from_id": "52b56463-7f22-48f8-b036-35d89d2dabcb", "from_name": null, "from_type": "Indicator", "id": "711d55e5-f718-412a-bf18-a924facc6e9e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--5700a54e-1f78-5cb8-a9c2-c40b3904cef6", "toId": "657ff382-024b-45a4-974a-3e41f1762074", "to_id": "657ff382-024b-45a4-974a-3e41f1762074", "to_name": "Cobalt Strike - S0154", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.889Z", "created_at": "2026-09-26T05:52:40.360Z", "modified": "2026-09-26T05:52:40.690Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:52:40.690Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c77e0b5e-a168-4a6f-993c-bc7076c78285", "from_id": "c77e0b5e-a168-4a6f-993c-bc7076c78285", "from_name": null, "from_type": "Indicator", "id": "7146c468-dcd8-4205-b9d0-1ed105f1d4c9", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--9716c039-ff1a-5dcc-9ec4-6be71937de14", "toId": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_id": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_name": "Spark - S0543", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.127Z", "created_at": "2026-09-26T05:58:40.787Z", "modified": "2026-09-26T05:58:41.015Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:58:41.015Z" }, "description_available": false, "entity_type": "indicates", "fromId": "52b56463-7f22-48f8-b036-35d89d2dabcb", "from_id": "52b56463-7f22-48f8-b036-35d89d2dabcb", "from_name": null, "from_type": "Indicator", "id": "719f0c8b-d115-42ba-8820-8308290f1106", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--e44c8363-1bc1-5536-83e4-9c377f25068a", "toId": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_id": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_name": "CrowDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.484Z", "created_at": "2026-09-26T05:41:47.415Z", "modified": "2026-09-26T05:41:47.572Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:41:47.572Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c2dcc828-9ae2-404f-a201-0074f26085ba", "from_id": "c2dcc828-9ae2-404f-a201-0074f26085ba", "from_name": null, "from_type": "Indicator", "id": "72e795d4-b444-4fce-b8d8-10264e074317", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--030f94b8-d421-5c4d-a0d2-be46c6bf2593", "toId": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_id": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_name": "CrowDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.652Z", "created_at": "2026-09-26T05:46:02.431Z", "modified": "2026-09-26T05:46:02.788Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:46:02.788Z" }, "description_available": false, "entity_type": "indicates", "fromId": "681c2240-1fb8-466d-a533-8f1d8132b27b", "from_id": "681c2240-1fb8-466d-a533-8f1d8132b27b", "from_name": null, "from_type": "Indicator", "id": "730a0816-29f2-481c-a2c0-f78638d41add", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--e63d55e9-8a64-5e35-a583-2c18f51eee23", "toId": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_id": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_name": "Melofee", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.765Z", "created_at": "2026-09-26T05:48:51.594Z", "modified": "2026-09-26T05:48:51.888Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:48:51.888Z" }, "description_available": false, "entity_type": "indicates", "fromId": "1a15e67e-da7b-42ec-b24a-d47fd8aa0767", "from_id": "1a15e67e-da7b-42ec-b24a-d47fd8aa0767", "from_name": null, "from_type": "Indicator", "id": "7320e21b-9642-4421-951f-8ae7fcc752ca", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--f173bec7-346a-5ade-8d20-359ef5d7ae43", "toId": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_id": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_name": "STOWAWAY", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.072Z", "created_at": "2026-09-26T05:56:30.070Z", "modified": "2026-09-26T05:56:30.430Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:56:30.430Z" }, "description_available": false, "entity_type": "indicates", "fromId": "66f40cca-cc72-4806-beef-47ae23125e5f", "from_id": "66f40cca-cc72-4806-beef-47ae23125e5f", "from_name": null, "from_type": "Indicator", "id": "74c1dbb2-6384-4b76-a9e5-5a632b4af05c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--12970187-7ae4-5ab6-9e78-777c109d5f07", "toId": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_id": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_name": "RatelS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.486Z", "created_at": "2026-09-26T05:41:37.050Z", "modified": "2026-09-26T05:41:37.287Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:41:37.287Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c2dcc828-9ae2-404f-a201-0074f26085ba", "from_id": "c2dcc828-9ae2-404f-a201-0074f26085ba", "from_name": null, "from_type": "Indicator", "id": "74efc2e5-4ac6-4fa1-ab03-ac31d9f7ca50", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--d0c0e540-29ca-54d8-85ed-e6970f52e987", "toId": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_id": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_name": "RatelS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.636Z", "created_at": "2026-09-26T05:45:42.799Z", "modified": "2026-09-26T05:45:43.181Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:45:43.181Z" }, "description_available": false, "entity_type": "indicates", "fromId": "cdadaaa5-0866-4957-b6d7-c64be31a1cf9", "from_id": "cdadaaa5-0866-4957-b6d7-c64be31a1cf9", "from_name": null, "from_type": "Indicator", "id": "75467f5e-5629-4d34-9483-dd5d10b432e1", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--3cf781b1-5a2e-55eb-80b7-03dea7d5d1b5", "toId": "657ff382-024b-45a4-974a-3e41f1762074", "to_id": "657ff382-024b-45a4-974a-3e41f1762074", "to_name": "Cobalt Strike - S0154", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.049Z", "created_at": "2026-09-26T05:56:02.108Z", "modified": "2026-09-26T05:56:02.453Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:56:02.453Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ea8ff45b-69d1-4069-bebe-6f7107045959", "from_id": "ea8ff45b-69d1-4069-bebe-6f7107045959", "from_name": null, "from_type": "Indicator", "id": "75531304-3e46-4b0c-b248-66817fa48476", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--03315440-055a-5715-854e-a1e93641cc0a", "toId": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_id": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_name": "TernDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.393Z", "created_at": "2026-09-26T05:40:00.972Z", "modified": "2026-09-26T05:40:01.204Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:40:01.204Z" }, "description_available": false, "entity_type": "indicates", "fromId": "8c1b4518-8219-46bb-a619-1c69182e4eec", "from_id": "8c1b4518-8219-46bb-a619-1c69182e4eec", "from_name": null, "from_type": "Indicator", "id": "75886903-0ade-478b-90b9-289183140487", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--f8a26efb-34bb-5885-a4e9-116f09ba6768", "toId": "657ff382-024b-45a4-974a-3e41f1762074", "to_id": "657ff382-024b-45a4-974a-3e41f1762074", "to_name": "Cobalt Strike - S0154", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.277Z", "created_at": "2026-09-26T05:35:55.102Z", "modified": "2026-09-26T05:35:55.278Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:35:55.278Z" }, "description_available": false, "entity_type": "indicates", "fromId": "48f22366-f0fd-4667-b458-fc531795e8ff", "from_id": "48f22366-f0fd-4667-b458-fc531795e8ff", "from_name": null, "from_type": "Indicator", "id": "75c89bb1-83a5-4341-a0db-ebd0e15eeeac", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--bf97b029-b6ff-5f76-80e1-f27336fc30d4", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.764Z", "created_at": "2026-09-26T05:48:46.603Z", "modified": "2026-09-26T05:48:46.774Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:48:46.774Z" }, "description_available": false, "entity_type": "indicates", "fromId": "1a15e67e-da7b-42ec-b24a-d47fd8aa0767", "from_id": "1a15e67e-da7b-42ec-b24a-d47fd8aa0767", "from_name": null, "from_type": "Indicator", "id": "76dbba25-0b3b-4145-a970-4ed22a682258", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--4cd9da9a-d09c-5534-95ed-80cf0779cb45", "toId": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_id": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_name": "Spark - S0543", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.462Z", "created_at": "2026-09-26T05:41:07.714Z", "modified": "2026-09-26T05:41:07.906Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:41:07.906Z" }, "description_available": false, "entity_type": "indicates", "fromId": "4ff9e994-0564-43c3-8240-004f20eb7d3f", "from_id": "4ff9e994-0564-43c3-8240-004f20eb7d3f", "from_name": null, "from_type": "Indicator", "id": "777d442a-1e5b-4df3-8003-7e84ad9dd1f0", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--ff59dd70-b110-5075-8d4e-354428b934d4", "toId": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_id": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_name": "RatelS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.700Z", "created_at": "2026-09-26T05:47:19.308Z", "modified": "2026-09-26T05:47:19.685Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:47:19.685Z" }, "description_available": false, "entity_type": "indicates", "fromId": "a7a198b8-f0a3-4221-b768-191720f061b9", "from_id": "a7a198b8-f0a3-4221-b768-191720f061b9", "from_name": null, "from_type": "Indicator", "id": "779d1434-b2c5-435a-988f-57d38ce3db5e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--8db6e734-5596-564f-880a-1217260126a5", "toId": "657ff382-024b-45a4-974a-3e41f1762074", "to_id": "657ff382-024b-45a4-974a-3e41f1762074", "to_name": "Cobalt Strike - S0154", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.296Z", "created_at": "2026-09-26T06:02:24.411Z", "modified": "2026-09-26T06:02:24.678Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:02:24.678Z" }, "description_available": false, "entity_type": "indicates", "fromId": "3b95a828-10fe-4895-a5fa-606043535451", "from_id": "3b95a828-10fe-4895-a5fa-606043535451", "from_name": null, "from_type": "Indicator", "id": "77b0b7f2-0c2c-45c3-989f-926e191f54d7", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--d7f96bc4-9889-5b36-8e1a-ffaf952ed99d", "toId": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_id": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_name": "CrowDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.416Z", "created_at": "2026-09-26T05:40:13.010Z", "modified": "2026-09-26T05:40:13.177Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:40:13.177Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d4aa073f-c77f-4db6-a515-5246469cf6b0", "from_id": "d4aa073f-c77f-4db6-a515-5246469cf6b0", "from_name": null, "from_type": "Indicator", "id": "780fe7fa-e34e-4381-8dcc-00412825ff3d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--937a9d40-ab51-5dd4-8faa-9151dad2070a", "toId": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_id": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_name": "CrowDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.027Z", "created_at": "2026-09-26T05:55:33.231Z", "modified": "2026-09-26T05:55:33.465Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:55:33.465Z" }, "description_available": false, "entity_type": "indicates", "fromId": "cd0c196b-8e17-4794-80e8-7129d42950e2", "from_id": "cd0c196b-8e17-4794-80e8-7129d42950e2", "from_name": null, "from_type": "Indicator", "id": "7821d50b-b6a2-40e5-b217-962c01b2b4c5", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--244fb682-a304-5520-920f-b3fa78d3447d", "toId": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_id": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_name": "CrowDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.434Z", "created_at": "2026-09-26T06:06:18.100Z", "modified": "2026-09-26T06:06:19.056Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:06:19.056Z" }, "description_available": false, "entity_type": "indicates", "fromId": "313c8419-28b4-4ef9-9855-91d315819bf8", "from_id": "313c8419-28b4-4ef9-9855-91d315819bf8", "from_name": null, "from_type": "Indicator", "id": "782cac3b-5018-4e23-b6c9-2c23f22c2ffd", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--73334cbf-3e6d-5f68-b824-090876ea7e16", "toId": "657ff382-024b-45a4-974a-3e41f1762074", "to_id": "657ff382-024b-45a4-974a-3e41f1762074", "to_name": "Cobalt Strike - S0154", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.306Z", "created_at": "2026-09-26T05:36:22.864Z", "modified": "2026-09-26T05:36:23.165Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:36:23.165Z" }, "description_available": false, "entity_type": "indicates", "fromId": "20bc512e-2f63-438d-bcee-abdf39614bf5", "from_id": "20bc512e-2f63-438d-bcee-abdf39614bf5", "from_name": null, "from_type": "Indicator", "id": "785f3d8c-fc63-4780-8c36-50608eee3354", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--8fe9260f-3f4d-5cd5-8e9f-36c49e56232b", "toId": "208a45aa-c18e-4619-9a90-7004849cab40", "to_id": "208a45aa-c18e-4619-9a90-7004849cab40", "to_name": "HemiGate", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.029Z", "created_at": "2026-09-26T05:34:43.217Z", "modified": "2026-09-26T05:34:43.931Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:34:43.931Z" }, "description_available": false, "entity_type": "based-on", "fromId": "d4aa073f-c77f-4db6-a515-5246469cf6b0", "from_id": "d4aa073f-c77f-4db6-a515-5246469cf6b0", "from_name": null, "from_type": "Indicator", "id": "7922f2f6-6a2f-4a5c-825c-258d6a519beb", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--5949e176-ea2a-5896-8f79-054a2a405a56", "toId": "f4f85fd2-e8e3-4f88-9173-9680e5c6e9ae", "to_id": "f4f85fd2-e8e3-4f88-9173-9680e5c6e9ae", "to_name": null, "to_type": "IPv4Addr" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.588Z", "created_at": "2026-09-26T06:11:16.146Z", "modified": "2026-09-26T06:11:16.332Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:11:16.332Z" }, "description_available": false, "entity_type": "indicates", "fromId": "e82e98a0-5491-4b41-82dd-1ffa975dde57", "from_id": "e82e98a0-5491-4b41-82dd-1ffa975dde57", "from_name": null, "from_type": "Indicator", "id": "7a034438-1708-4ef4-93b3-38397901d5de", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--e7fadce7-7e05-512f-a3f9-6fc8a4c75f8a", "toId": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_id": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_name": "HelloBot", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.550Z", "created_at": "2026-09-26T05:42:58.717Z", "modified": "2026-09-26T05:42:58.944Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:42:58.944Z" }, "description_available": false, "entity_type": "indicates", "fromId": "653baf3a-7205-44e8-bf30-e40825fbf42a", "from_id": "653baf3a-7205-44e8-bf30-e40825fbf42a", "from_name": null, "from_type": "Indicator", "id": "7aed80fa-e316-41e2-bef4-e828b71638ff", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--202a1ea2-bb5b-5d73-baac-85cd528362f4", "toId": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_id": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_name": "TernDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.306Z", "created_at": "2026-09-26T05:36:23.326Z", "modified": "2026-09-26T05:36:23.478Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:36:23.478Z" }, "description_available": false, "entity_type": "indicates", "fromId": "20bc512e-2f63-438d-bcee-abdf39614bf5", "from_id": "20bc512e-2f63-438d-bcee-abdf39614bf5", "from_name": null, "from_type": "Indicator", "id": "7afb651f-ee4f-4beb-b101-9bf8dff2c1a8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--1fe071ae-074d-56b1-8931-be79c78d847c", "toId": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_id": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_name": "RatelS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.594Z", "created_at": "2026-09-26T06:11:21.468Z", "modified": "2026-09-26T06:11:21.646Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:11:21.646Z" }, "description_available": false, "entity_type": "indicates", "fromId": "e82e98a0-5491-4b41-82dd-1ffa975dde57", "from_id": "e82e98a0-5491-4b41-82dd-1ffa975dde57", "from_name": null, "from_type": "Indicator", "id": "7b268527-27dc-406f-aeaf-47c01d8b9771", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--164163d3-d530-55ef-a14f-385cca7bfdd5", "toId": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_id": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_name": "STOWAWAY", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.320Z", "created_at": "2026-09-26T05:36:50.128Z", "modified": "2026-09-26T05:36:50.365Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:36:50.365Z" }, "description_available": false, "entity_type": "indicates", "fromId": "b2490479-1c8f-4288-a8e1-23589e1535cf", "from_id": "b2490479-1c8f-4288-a8e1-23589e1535cf", "from_name": null, "from_type": "Indicator", "id": "7bf29c91-2b34-48cb-ba49-e3db2e48c03b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--3f7e55f2-c1bd-5156-a77a-c9cfe8974c17", "toId": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_id": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_name": "HelloBot", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.319Z", "created_at": "2026-09-26T05:36:46.350Z", "modified": "2026-09-26T05:36:49.471Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:36:49.471Z" }, "description_available": false, "entity_type": "indicates", "fromId": "b2490479-1c8f-4288-a8e1-23589e1535cf", "from_id": "b2490479-1c8f-4288-a8e1-23589e1535cf", "from_name": null, "from_type": "Indicator", "id": "7c58819c-78c0-42ab-a3ba-4d95be0af4ec", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--4d14d589-c4a5-51ac-b329-098005be6b2a", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.483Z", "created_at": "2026-09-26T06:07:24.106Z", "modified": "2026-09-26T06:07:24.276Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:07:24.276Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d7d77ca0-8c06-4de9-bacb-a526f344e2e9", "from_id": "d7d77ca0-8c06-4de9-bacb-a526f344e2e9", "from_name": null, "from_type": "Indicator", "id": "7c628b91-c8a1-49ba-be75-560fe35317fd", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--3698e3f6-e6bb-5e05-a88e-a8eb77a65974", "toId": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_id": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_name": "RatelS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.855Z", "created_at": "2026-09-26T05:52:16.065Z", "modified": "2026-09-26T05:52:16.217Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:52:16.217Z" }, "description_available": false, "entity_type": "indicates", "fromId": "6ae45569-c03b-471f-80ff-50d7a804075a", "from_id": "6ae45569-c03b-471f-80ff-50d7a804075a", "from_name": null, "from_type": "Indicator", "id": "7c8c204b-f18b-4e83-b3e1-8c2ac34d1aab", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--bc2fad42-1540-5163-8585-f04890f0c389", "toId": "208a45aa-c18e-4619-9a90-7004849cab40", "to_id": "208a45aa-c18e-4619-9a90-7004849cab40", "to_name": "HemiGate", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.372Z", "created_at": "2026-09-26T05:39:04.063Z", "modified": "2026-09-26T05:39:04.240Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:39:04.240Z" }, "description_available": false, "entity_type": "indicates", "fromId": "eb51ab90-3d38-4f58-84c1-b0700196508c", "from_id": "eb51ab90-3d38-4f58-84c1-b0700196508c", "from_name": null, "from_type": "Indicator", "id": "7cc7f407-e6f1-45dc-9038-a96b1dd3947a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--92291add-808f-58a5-b0df-ea07012a7c29", "toId": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_id": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_name": "STOWAWAY", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.410Z", "created_at": "2026-09-26T06:05:57.075Z", "modified": "2026-09-26T06:05:57.393Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:05:57.393Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ac6046d8-f570-4eca-af26-b22ab4b74e00", "from_id": "ac6046d8-f570-4eca-af26-b22ab4b74e00", "from_name": null, "from_type": "Indicator", "id": "7d00f682-32cb-42db-9d49-c22b2a4adc93", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--d4fe0493-6fd2-5b0e-97dc-61ee00cfbc3d", "toId": "657ff382-024b-45a4-974a-3e41f1762074", "to_id": "657ff382-024b-45a4-974a-3e41f1762074", "to_name": "Cobalt Strike - S0154", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.522Z", "created_at": "2026-09-26T05:42:24.340Z", "modified": "2026-09-26T05:42:25.020Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:42:25.020Z" }, "description_available": false, "entity_type": "indicates", "fromId": "0eb188e3-885e-4084-abdf-6d4ba0098e64", "from_id": "0eb188e3-885e-4084-abdf-6d4ba0098e64", "from_name": null, "from_type": "Indicator", "id": "7d19b453-1baa-4063-94ec-b992a2ba2356", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--6967bae1-65e2-5530-aba7-9bd5e8c6971d", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.237Z", "created_at": "2026-09-26T05:35:18.345Z", "modified": "2026-09-26T05:35:18.718Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:35:18.718Z" }, "description_available": false, "entity_type": "based-on", "fromId": "781e0e33-439f-46a6-b565-9c9e6287a0ff", "from_id": "781e0e33-439f-46a6-b565-9c9e6287a0ff", "from_name": null, "from_type": "Indicator", "id": "7d21f513-b2f7-401b-8941-4b04215ef730", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--75808a9d-f3df-57bb-9c67-93eb11e59233", "toId": "65928f13-af58-4e92-87d2-583157b8a75a", "to_id": "65928f13-af58-4e92-87d2-583157b8a75a", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.595Z", "created_at": "2026-09-26T05:44:25.149Z", "modified": "2026-09-26T05:44:30.445Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:44:30.445Z" }, "description_available": false, "entity_type": "indicates", "fromId": "610b3366-3a08-4e4d-9f45-c8543a783a7f", "from_id": "610b3366-3a08-4e4d-9f45-c8543a783a7f", "from_name": null, "from_type": "Indicator", "id": "7dbc98b1-4a85-48bb-b6aa-189a3744a712", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--681a4a08-c958-516f-a75b-4461f33e0990", "toId": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_id": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_name": "RatelS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.326Z", "created_at": "2026-09-26T05:36:54.140Z", "modified": "2026-09-26T05:36:54.648Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:36:54.648Z" }, "description_available": false, "entity_type": "indicates", "fromId": "b2490479-1c8f-4288-a8e1-23589e1535cf", "from_id": "b2490479-1c8f-4288-a8e1-23589e1535cf", "from_name": null, "from_type": "Indicator", "id": "7dc2afde-20a8-4e2b-b1a8-24659133b175", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--5ca19b0c-a8ba-53e9-a376-9f0308d032f8", "toId": "657ff382-024b-45a4-974a-3e41f1762074", "to_id": "657ff382-024b-45a4-974a-3e41f1762074", "to_name": "Cobalt Strike - S0154", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.661Z", "created_at": "2026-09-26T05:46:09.146Z", "modified": "2026-09-26T05:46:09.398Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:46:09.398Z" }, "description_available": false, "entity_type": "indicates", "fromId": "681c2240-1fb8-466d-a533-8f1d8132b27b", "from_id": "681c2240-1fb8-466d-a533-8f1d8132b27b", "from_name": null, "from_type": "Indicator", "id": "7eef7211-88d2-4e63-ad3e-c6b44a9bbcc8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--4e0739b5-b5a0-5fe2-bcc6-75ca2a4e0d31", "toId": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_id": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_name": "RatelS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.211Z", "created_at": "2026-09-26T05:35:13.114Z", "modified": "2026-09-26T05:35:13.454Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:35:13.454Z" }, "description_available": false, "entity_type": "based-on", "fromId": "3b95a828-10fe-4895-a5fa-606043535451", "from_id": "3b95a828-10fe-4895-a5fa-606043535451", "from_name": null, "from_type": "Indicator", "id": "7f221b7e-fd92-4211-9418-4de0deac198f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--684297d8-db53-5965-a734-e3da032aae1e", "toId": "3f67326c-9dfe-411f-ad47-f5aa047fb1dd", "to_id": "3f67326c-9dfe-411f-ad47-f5aa047fb1dd", "to_name": null, "to_type": "IPv4Addr" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.548Z", "created_at": "2026-09-26T05:42:57.406Z", "modified": "2026-09-26T05:42:57.644Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:42:57.644Z" }, "description_available": false, "entity_type": "indicates", "fromId": "653baf3a-7205-44e8-bf30-e40825fbf42a", "from_id": "653baf3a-7205-44e8-bf30-e40825fbf42a", "from_name": null, "from_type": "Indicator", "id": "7fb46f96-88b7-43b3-9902-437c4fa3ceeb", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--53555128-8ea6-5913-85f1-eed19c99f3bd", "toId": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_id": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_name": "Spark - S0543", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.504Z", "created_at": "2026-09-26T06:07:55.786Z", "modified": "2026-09-26T06:07:55.966Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:07:55.966Z" }, "description_available": false, "entity_type": "indicates", "fromId": "781e0e33-439f-46a6-b565-9c9e6287a0ff", "from_id": "781e0e33-439f-46a6-b565-9c9e6287a0ff", "from_name": null, "from_type": "Indicator", "id": "806283ff-5c48-451c-83ad-9fc5d0240b3d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--e6ba5dac-0da8-5a23-b560-6dec2059a99f", "toId": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_id": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_name": "CrowDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.639Z", "created_at": "2026-09-26T05:45:49.498Z", "modified": "2026-09-26T05:45:49.860Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:45:49.860Z" }, "description_available": false, "entity_type": "indicates", "fromId": "cdadaaa5-0866-4957-b6d7-c64be31a1cf9", "from_id": "cdadaaa5-0866-4957-b6d7-c64be31a1cf9", "from_name": null, "from_type": "Indicator", "id": "80c8b810-6fbb-43e9-a359-a400082d24f2", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--1bfadf10-a1a8-5e45-bf95-16bae4f55643", "toId": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_id": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_name": "RatelS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.660Z", "created_at": "2026-09-26T05:46:08.555Z", "modified": "2026-09-26T05:46:08.810Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:46:08.810Z" }, "description_available": false, "entity_type": "indicates", "fromId": "681c2240-1fb8-466d-a533-8f1d8132b27b", "from_id": "681c2240-1fb8-466d-a533-8f1d8132b27b", "from_name": null, "from_type": "Indicator", "id": "8108f9af-5934-4210-871d-926ef0800de9", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--12c4e233-cf0a-5fd0-b840-ac642c91cebb", "toId": "208a45aa-c18e-4619-9a90-7004849cab40", "to_id": "208a45aa-c18e-4619-9a90-7004849cab40", "to_name": "HemiGate", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.274Z", "created_at": "2026-09-26T06:02:03.581Z", "modified": "2026-09-26T06:02:03.924Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:02:03.924Z" }, "description_available": false, "entity_type": "indicates", "fromId": "2c0b3e29-5bb5-4044-8031-4f47cd51a008", "from_id": "2c0b3e29-5bb5-4044-8031-4f47cd51a008", "from_name": null, "from_type": "Indicator", "id": "81461f25-0689-4283-9d6f-097c3f8ead73", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--acead905-db84-5aa3-b1d5-54a67d225fa0", "toId": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_id": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_name": "STOWAWAY", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.550Z", "created_at": "2026-09-26T05:43:09.873Z", "modified": "2026-09-26T05:43:10.030Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:43:10.030Z" }, "description_available": false, "entity_type": "indicates", "fromId": "653baf3a-7205-44e8-bf30-e40825fbf42a", "from_id": "653baf3a-7205-44e8-bf30-e40825fbf42a", "from_name": null, "from_type": "Indicator", "id": "814dbad9-6e96-460b-81af-216770b3294d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--f1c5dd01-3c6a-5f0b-8ace-daa8430040e3", "toId": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_id": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_name": "CrowDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.311Z", "created_at": "2026-09-26T06:02:49.338Z", "modified": "2026-09-26T06:02:49.631Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:02:49.631Z" }, "description_available": false, "entity_type": "indicates", "fromId": "6fbf4d94-634a-4763-b0e5-0cbe6e9f67ea", "from_id": "6fbf4d94-634a-4763-b0e5-0cbe6e9f67ea", "from_name": null, "from_type": "Indicator", "id": "81c57d99-d7bc-4e9d-9aec-077d04a2b15f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--93b93b09-fcff-5a7d-85f2-61c3b72b01ea", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.359Z", "created_at": "2026-09-26T06:04:48.636Z", "modified": "2026-09-26T06:04:48.839Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:04:48.839Z" }, "description_available": false, "entity_type": "indicates", "fromId": "3c2ca4de-2c25-4802-a582-ebf285060ed9", "from_id": "3c2ca4de-2c25-4802-a582-ebf285060ed9", "from_name": null, "from_type": "Indicator", "id": "82005f10-0911-44b5-a62f-721ce4aea77a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--1b53ae4d-0f66-5139-949b-65ec69760f86", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.051Z", "created_at": "2026-09-26T05:34:50.196Z", "modified": "2026-09-26T05:34:52.052Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:34:52.052Z" }, "description_available": false, "entity_type": "based-on", "fromId": "610b3366-3a08-4e4d-9f45-c8543a783a7f", "from_id": "610b3366-3a08-4e4d-9f45-c8543a783a7f", "from_name": null, "from_type": "Indicator", "id": "82304f19-d58d-49d5-9745-d74cd4cc308c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--65f8a36a-9d40-529b-881e-34a2b9e9b193", "toId": "c693aaa8-d711-4326-9843-d33513ceb248", "to_id": "c693aaa8-d711-4326-9843-d33513ceb248", "to_name": null, "to_type": "IPv4Addr" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.049Z", "created_at": "2026-09-26T05:56:07.698Z", "modified": "2026-09-26T05:56:07.972Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:56:07.972Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ea8ff45b-69d1-4069-bebe-6f7107045959", "from_id": "ea8ff45b-69d1-4069-bebe-6f7107045959", "from_name": null, "from_type": "Indicator", "id": "826d7dff-4197-4de4-988f-dcb7c8b25654", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--2911363b-0754-5d1d-8442-bf38a302ac5f", "toId": "208a45aa-c18e-4619-9a90-7004849cab40", "to_id": "208a45aa-c18e-4619-9a90-7004849cab40", "to_name": "HemiGate", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.047Z", "created_at": "2026-09-26T05:56:00.492Z", "modified": "2026-09-26T05:56:00.745Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:56:00.745Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ea8ff45b-69d1-4069-bebe-6f7107045959", "from_id": "ea8ff45b-69d1-4069-bebe-6f7107045959", "from_name": null, "from_type": "Indicator", "id": "82c12560-e3a7-43f3-bd43-bc035dce4ab4", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--ed5df72f-4683-5ec9-bfd5-affdd0e89d22", "toId": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_id": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_name": "Spark - S0543", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.066Z", "created_at": "2026-09-26T05:34:53.499Z", "modified": "2026-09-26T05:34:53.884Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:34:53.884Z" }, "description_available": false, "entity_type": "based-on", "fromId": "a7a198b8-f0a3-4221-b768-191720f061b9", "from_id": "a7a198b8-f0a3-4221-b768-191720f061b9", "from_name": null, "from_type": "Indicator", "id": "82de3825-8dbb-4a67-a27e-de29585fc5f1", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--9b91cb68-2a52-54dd-ab8c-e478f22bbffd", "toId": "ea1778a7-5b4b-491f-b4b4-49c709df6453", "to_id": "ea1778a7-5b4b-491f-b4b4-49c709df6453", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.788Z", "created_at": "2026-09-26T05:49:21.948Z", "modified": "2026-09-26T05:49:22.135Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:49:22.135Z" }, "description_available": false, "entity_type": "indicates", "fromId": "8134c07a-eec8-489c-80e7-aca40ccc6268", "from_id": "8134c07a-eec8-489c-80e7-aca40ccc6268", "from_name": null, "from_type": "Indicator", "id": "82eefbd3-f5ce-45e1-b2c0-38afed95e7fa", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--14ad9724-e724-57cb-bb56-b3c5229e7e9e", "toId": "208a45aa-c18e-4619-9a90-7004849cab40", "to_id": "208a45aa-c18e-4619-9a90-7004849cab40", "to_name": "HemiGate", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.507Z", "created_at": "2026-09-26T05:42:05.038Z", "modified": "2026-09-26T05:42:05.250Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:42:05.250Z" }, "description_available": false, "entity_type": "indicates", "fromId": "435fff26-763c-4528-906f-e8da098d6aee", "from_id": "435fff26-763c-4528-906f-e8da098d6aee", "from_name": null, "from_type": "Indicator", "id": "830376b4-d51b-4d06-ba60-51a9838bf331", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--34200f12-2013-59ef-9c9a-e83f39321104", "toId": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_id": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_name": "TernDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.458Z", "created_at": "2026-09-26T06:06:55.872Z", "modified": "2026-09-26T06:06:56.013Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:06:56.013Z" }, "description_available": false, "entity_type": "indicates", "fromId": "5330b1c5-bebb-4760-ae47-12dd0e0d1e23", "from_id": "5330b1c5-bebb-4760-ae47-12dd0e0d1e23", "from_name": null, "from_type": "Indicator", "id": "8329ca1f-dfb2-42d7-8196-223839ef0075", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--785cd9ec-6a52-5381-a49d-36a1913a72e7", "toId": "657ff382-024b-45a4-974a-3e41f1762074", "to_id": "657ff382-024b-45a4-974a-3e41f1762074", "to_name": "Cobalt Strike - S0154", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.100Z", "created_at": "2026-09-26T05:58:14.986Z", "modified": "2026-09-26T05:58:15.145Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:58:15.145Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d7f88a85-9ab3-45b8-982b-294d838461a6", "from_id": "d7f88a85-9ab3-45b8-982b-294d838461a6", "from_name": null, "from_type": "Indicator", "id": "8349bd80-029a-48c4-8e5f-7e1cbd75c471", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--ff022531-d572-5f31-afd1-5ee8f14f0333", "toId": "208a45aa-c18e-4619-9a90-7004849cab40", "to_id": "208a45aa-c18e-4619-9a90-7004849cab40", "to_name": "HemiGate", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.000Z", "created_at": "2026-09-26T05:54:54.566Z", "modified": "2026-09-26T05:54:54.889Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:54:54.889Z" }, "description_available": false, "entity_type": "indicates", "fromId": "26da206d-5fde-40ba-bc45-0f24f378263c", "from_id": "26da206d-5fde-40ba-bc45-0f24f378263c", "from_name": null, "from_type": "Indicator", "id": "843dfb80-1398-464f-aec5-7a19fa025388", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--674b2f1d-4d18-5ab8-9966-9cd9d5e4f36a", "toId": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_id": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_name": "PlugX - S0013", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.275Z", "created_at": "2026-09-26T06:02:05.125Z", "modified": "2026-09-26T06:02:05.567Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:02:05.567Z" }, "description_available": false, "entity_type": "indicates", "fromId": "2c0b3e29-5bb5-4044-8031-4f47cd51a008", "from_id": "2c0b3e29-5bb5-4044-8031-4f47cd51a008", "from_name": null, "from_type": "Indicator", "id": "847df81d-945d-4e5f-a95a-9fc43155876d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--63407cc1-077a-5450-8bc3-f9dac3b850c7", "toId": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_id": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_name": "CrowDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.410Z", "created_at": "2026-09-26T06:05:55.675Z", "modified": "2026-09-26T06:05:56.364Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:05:56.364Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ac6046d8-f570-4eca-af26-b22ab4b74e00", "from_id": "ac6046d8-f570-4eca-af26-b22ab4b74e00", "from_name": null, "from_type": "Indicator", "id": "84f380d4-1561-415b-86a6-bc15c3e36f49", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--b699780d-a89b-512b-93b6-c809835f8cee", "toId": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_id": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_name": "STOWAWAY", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.586Z", "created_at": "2026-09-26T05:43:42.809Z", "modified": "2026-09-26T05:43:43.144Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:43:43.144Z" }, "description_available": false, "entity_type": "indicates", "fromId": "610b3366-3a08-4e4d-9f45-c8543a783a7f", "from_id": "610b3366-3a08-4e4d-9f45-c8543a783a7f", "from_name": null, "from_type": "Indicator", "id": "85346518-0951-494f-9f17-2f7eab58fce2", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--663a58dd-7aa8-57e3-be24-57c12f0605f9", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.253Z", "created_at": "2026-09-26T06:01:26.616Z", "modified": "2026-09-26T06:01:28.426Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:01:28.426Z" }, "description_available": false, "entity_type": "indicates", "fromId": "09acd2d3-2afb-4de1-a147-7ae7904d3859", "from_id": "09acd2d3-2afb-4de1-a147-7ae7904d3859", "from_name": null, "from_type": "Indicator", "id": "85fd4bb0-186d-4940-bad9-fc34aaffd3a7", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--ab754ed0-4c88-525f-9d89-1f213743a8c1", "toId": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_id": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_name": "STOWAWAY", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.592Z", "created_at": "2026-09-26T05:43:43.658Z", "modified": "2026-09-26T05:43:43.935Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:43:43.935Z" }, "description_available": false, "entity_type": "indicates", "fromId": "610b3366-3a08-4e4d-9f45-c8543a783a7f", "from_id": "610b3366-3a08-4e4d-9f45-c8543a783a7f", "from_name": null, "from_type": "Indicator", "id": "87317edf-e5d9-45f3-b8f9-2de14e5b98f3", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--b28f065c-d2c9-544f-8e82-4735ff488051", "toId": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_id": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_name": "Spark - S0543", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.483Z", "created_at": "2026-09-26T06:07:23.422Z", "modified": "2026-09-26T06:07:23.633Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:07:23.633Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d7d77ca0-8c06-4de9-bacb-a526f344e2e9", "from_id": "d7d77ca0-8c06-4de9-bacb-a526f344e2e9", "from_name": null, "from_type": "Indicator", "id": "875302b1-6cb9-41a6-bf11-ff41c15eabef", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--42a532ea-ac2e-5764-8f28-a51c6321c4cc", "toId": "208a45aa-c18e-4619-9a90-7004849cab40", "to_id": "208a45aa-c18e-4619-9a90-7004849cab40", "to_name": "HemiGate", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.047Z", "created_at": "2026-09-26T05:56:00.928Z", "modified": "2026-09-26T05:56:01.069Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:56:01.069Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ea8ff45b-69d1-4069-bebe-6f7107045959", "from_id": "ea8ff45b-69d1-4069-bebe-6f7107045959", "from_name": null, "from_type": "Indicator", "id": "878392fa-9066-4820-a4b3-a4854afdc751", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--edb2767d-668e-5f82-8cd8-02ed7d1ceec7", "toId": "657ff382-024b-45a4-974a-3e41f1762074", "to_id": "657ff382-024b-45a4-974a-3e41f1762074", "to_name": "Cobalt Strike - S0154", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.781Z", "created_at": "2026-09-26T05:49:10.361Z", "modified": "2026-09-26T05:49:10.643Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:49:10.643Z" }, "description_available": false, "entity_type": "indicates", "fromId": "8134c07a-eec8-489c-80e7-aca40ccc6268", "from_id": "8134c07a-eec8-489c-80e7-aca40ccc6268", "from_name": null, "from_type": "Indicator", "id": "878718ce-e908-4f09-b008-395fb8cb855b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--41175289-2d0d-5c50-9771-8907f90b5a90", "toId": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_id": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_name": "HelloBot", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.526Z", "created_at": "2026-09-26T06:08:29.431Z", "modified": "2026-09-26T06:08:30.794Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:08:30.794Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c08d31e4-ff5a-45b7-8880-330403eced75", "from_id": "c08d31e4-ff5a-45b7-8880-330403eced75", "from_name": null, "from_type": "Indicator", "id": "88caad35-71f5-48cc-b709-53a02716af8a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--8c5ced21-3ae1-5154-a49e-d82576e54b24", "toId": "208a45aa-c18e-4619-9a90-7004849cab40", "to_id": "208a45aa-c18e-4619-9a90-7004849cab40", "to_name": "HemiGate", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.118Z", "created_at": "2026-09-26T05:58:37.455Z", "modified": "2026-09-26T05:58:37.657Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:58:37.657Z" }, "description_available": false, "entity_type": "indicates", "fromId": "52b56463-7f22-48f8-b036-35d89d2dabcb", "from_id": "52b56463-7f22-48f8-b036-35d89d2dabcb", "from_name": null, "from_type": "Indicator", "id": "88e2104a-8900-4f40-8132-7b493f186185", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--f44bf577-9007-5a05-abc7-a53e23a7e9ce", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.233Z", "created_at": "2026-09-26T06:00:54.828Z", "modified": "2026-09-26T06:00:55.077Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:00:55.077Z" }, "description_available": false, "entity_type": "indicates", "fromId": "aaf834aa-275b-4a6a-9790-6971e8adf52d", "from_id": "aaf834aa-275b-4a6a-9790-6971e8adf52d", "from_name": null, "from_type": "Indicator", "id": "8934c3cd-2ad8-434c-8319-3a46b0fa8e40", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--4c3bba60-b8ef-55d0-90f7-d4e669ed4504", "toId": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_id": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_name": "TernDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.615Z", "created_at": "2026-09-26T05:45:16.154Z", "modified": "2026-09-26T05:45:16.328Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:45:16.328Z" }, "description_available": false, "entity_type": "indicates", "fromId": "3be1760f-af98-4d5c-80e2-c0338b71f391", "from_id": "3be1760f-af98-4d5c-80e2-c0338b71f391", "from_name": null, "from_type": "Indicator", "id": "8a1e1257-212a-4089-ad11-d106b4e084ba", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--32e2a126-8fd7-571e-b570-96716542831f", "toId": "657ff382-024b-45a4-974a-3e41f1762074", "to_id": "657ff382-024b-45a4-974a-3e41f1762074", "to_name": "Cobalt Strike - S0154", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.025Z", "created_at": "2026-09-26T05:55:29.705Z", "modified": "2026-09-26T05:55:30.315Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:55:30.315Z" }, "description_available": false, "entity_type": "indicates", "fromId": "cd0c196b-8e17-4794-80e8-7129d42950e2", "from_id": "cd0c196b-8e17-4794-80e8-7129d42950e2", "from_name": null, "from_type": "Indicator", "id": "8a1ee604-fcea-4784-909e-248b13e98ab7", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--2c6cf155-3901-5c0a-a105-8c94cbdab22a", "toId": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_id": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_name": "Spark - S0543", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.484Z", "created_at": "2026-09-26T05:41:34.258Z", "modified": "2026-09-26T05:41:34.812Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:41:34.812Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c2dcc828-9ae2-404f-a201-0074f26085ba", "from_id": "c2dcc828-9ae2-404f-a201-0074f26085ba", "from_name": null, "from_type": "Indicator", "id": "8a7dd9c7-2c2f-490c-9a49-d9482ca99137", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--8ff004ea-aaab-51c5-a325-3b1f74001768", "toId": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_id": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_name": "STOWAWAY", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.303Z", "created_at": "2026-09-26T05:36:21.077Z", "modified": "2026-09-26T05:36:21.292Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:36:21.292Z" }, "description_available": false, "entity_type": "indicates", "fromId": "20bc512e-2f63-438d-bcee-abdf39614bf5", "from_id": "20bc512e-2f63-438d-bcee-abdf39614bf5", "from_name": null, "from_type": "Indicator", "id": "8a95db1e-6238-4285-af01-540f8d56aaa3", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--49d79197-3b79-574a-a67e-6cd6585d68ee", "toId": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_id": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_name": "Spark - S0543", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.638Z", "created_at": "2026-09-26T05:45:44.671Z", "modified": "2026-09-26T05:45:44.926Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:45:44.926Z" }, "description_available": false, "entity_type": "indicates", "fromId": "cdadaaa5-0866-4957-b6d7-c64be31a1cf9", "from_id": "cdadaaa5-0866-4957-b6d7-c64be31a1cf9", "from_name": null, "from_type": "Indicator", "id": "8aa0bbf2-0314-4316-b48e-c57a2a53b45d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--c469848e-d1c1-567e-8d73-e1a45edea547", "toId": "208a45aa-c18e-4619-9a90-7004849cab40", "to_id": "208a45aa-c18e-4619-9a90-7004849cab40", "to_name": "HemiGate", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.373Z", "created_at": "2026-09-26T05:39:05.126Z", "modified": "2026-09-26T05:39:07.528Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:39:07.528Z" }, "description_available": false, "entity_type": "indicates", "fromId": "eb51ab90-3d38-4f58-84c1-b0700196508c", "from_id": "eb51ab90-3d38-4f58-84c1-b0700196508c", "from_name": null, "from_type": "Indicator", "id": "8aabb31d-2ed4-4ee7-bcf3-e086153565cc", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--362dba0e-c0bc-54af-bb65-96cb88b7120b", "toId": "208a45aa-c18e-4619-9a90-7004849cab40", "to_id": "208a45aa-c18e-4619-9a90-7004849cab40", "to_name": "HemiGate", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.700Z", "created_at": "2026-09-26T05:47:08.062Z", "modified": "2026-09-26T05:47:08.283Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:47:08.283Z" }, "description_available": false, "entity_type": "indicates", "fromId": "a7a198b8-f0a3-4221-b768-191720f061b9", "from_id": "a7a198b8-f0a3-4221-b768-191720f061b9", "from_name": null, "from_type": "Indicator", "id": "8b7261e6-81ea-4f4c-8ed5-caa649ee80f9", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--d94cb4e5-5cf0-5643-b522-aaa71cffc8f4", "toId": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_id": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_name": "Spark - S0543", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.241Z", "created_at": "2026-09-26T05:35:18.563Z", "modified": "2026-09-26T05:35:18.913Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:35:18.913Z" }, "description_available": false, "entity_type": "based-on", "fromId": "c08d31e4-ff5a-45b7-8880-330403eced75", "from_id": "c08d31e4-ff5a-45b7-8880-330403eced75", "from_name": null, "from_type": "Indicator", "id": "8bbf7bff-a620-49c7-9d84-d7e196f66f0f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--68f6acc8-cfdb-5529-b68f-f71e213703ad", "toId": "c60babc6-0b39-4b6d-8c38-a1a13fde2bba", "to_id": "c60babc6-0b39-4b6d-8c38-a1a13fde2bba", "to_name": null, "to_type": "Hostname" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.941Z", "created_at": "2026-09-26T05:53:40.573Z", "modified": "2026-09-26T05:53:40.901Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:53:40.901Z" }, "description_available": false, "entity_type": "indicates", "fromId": "1315ce2a-6659-4f4f-b9b7-e2450564ca9b", "from_id": "1315ce2a-6659-4f4f-b9b7-e2450564ca9b", "from_name": null, "from_type": "Indicator", "id": "8bea3728-d405-4dbf-95ef-ad03b9da3352", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--a25ad514-40df-5f52-9820-6dc8743abf3b", "toId": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_id": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_name": "STOWAWAY", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.277Z", "created_at": "2026-09-26T06:02:13.010Z", "modified": "2026-09-26T06:02:13.174Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:02:13.174Z" }, "description_available": false, "entity_type": "indicates", "fromId": "2c0b3e29-5bb5-4044-8031-4f47cd51a008", "from_id": "2c0b3e29-5bb5-4044-8031-4f47cd51a008", "from_name": null, "from_type": "Indicator", "id": "8cc4d522-2a02-49c8-88db-e1cb95f66fdf", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--8f60e6ab-8bfd-54d3-80ad-9dd1fb394792", "toId": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_id": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_name": "RatelS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.253Z", "created_at": "2026-09-26T06:01:28.679Z", "modified": "2026-09-26T06:01:29.670Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:01:29.670Z" }, "description_available": false, "entity_type": "indicates", "fromId": "09acd2d3-2afb-4de1-a147-7ae7904d3859", "from_id": "09acd2d3-2afb-4de1-a147-7ae7904d3859", "from_name": null, "from_type": "Indicator", "id": "8cd92c4a-cc34-4896-918c-551768ee8c55", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--6bed7a39-3b82-5c1a-8ee3-8e07c1255410", "toId": "657ff382-024b-45a4-974a-3e41f1762074", "to_id": "657ff382-024b-45a4-974a-3e41f1762074", "to_name": "Cobalt Strike - S0154", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.352Z", "created_at": "2026-09-26T05:37:32.369Z", "modified": "2026-09-26T05:37:33.482Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:37:33.482Z" }, "description_available": false, "entity_type": "indicates", "fromId": "94a7b3a6-0b64-4746-86ff-6647d1a2df8d", "from_id": "94a7b3a6-0b64-4746-86ff-6647d1a2df8d", "from_name": null, "from_type": "Indicator", "id": "8d0f913b-0f1b-4bd8-af3f-bf76af59beda", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--7a5d2a1b-3b36-56ae-9503-a30c99706881", "toId": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_id": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_name": "RatelS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.410Z", "created_at": "2026-09-26T05:40:05.400Z", "modified": "2026-09-26T05:40:05.660Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:40:05.660Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d4aa073f-c77f-4db6-a515-5246469cf6b0", "from_id": "d4aa073f-c77f-4db6-a515-5246469cf6b0", "from_name": null, "from_type": "Indicator", "id": "8d1c50b7-e6b5-42a9-b896-ff2374f44cea", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--e55094cc-9b98-586b-b896-fc88880bc7ec", "toId": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_id": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_name": "PlugX - S0013", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.296Z", "created_at": "2026-09-26T06:02:25.062Z", "modified": "2026-09-26T06:02:25.352Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:02:25.352Z" }, "description_available": false, "entity_type": "indicates", "fromId": "3b95a828-10fe-4895-a5fa-606043535451", "from_id": "3b95a828-10fe-4895-a5fa-606043535451", "from_name": null, "from_type": "Indicator", "id": "8dc4b93a-89d1-449c-b783-8ba2c0c8b717", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--ea9fd065-4a80-505c-874c-13a4247407eb", "toId": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_id": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_name": "TernDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.652Z", "created_at": "2026-09-26T05:46:05.644Z", "modified": "2026-09-26T05:46:05.938Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:46:05.938Z" }, "description_available": false, "entity_type": "indicates", "fromId": "681c2240-1fb8-466d-a533-8f1d8132b27b", "from_id": "681c2240-1fb8-466d-a533-8f1d8132b27b", "from_name": null, "from_type": "Indicator", "id": "8e09e82b-da3e-453a-ad71-90d9400362be", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--3234ed95-b304-50be-a38f-af5021da5037", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.523Z", "created_at": "2026-09-26T06:08:25.522Z", "modified": "2026-09-26T06:08:25.680Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:08:25.680Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c08d31e4-ff5a-45b7-8880-330403eced75", "from_id": "c08d31e4-ff5a-45b7-8880-330403eced75", "from_name": null, "from_type": "Indicator", "id": "8e94b213-0975-46cf-bea4-dba7eaac17ec", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--918b0704-c4bb-5787-9e00-7dea7e434ea0", "toId": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_id": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_name": "Spark - S0543", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.089Z", "created_at": "2026-09-26T05:58:06.797Z", "modified": "2026-09-26T05:58:07.027Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:58:07.027Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d7f88a85-9ab3-45b8-982b-294d838461a6", "from_id": "d7f88a85-9ab3-45b8-982b-294d838461a6", "from_name": null, "from_type": "Indicator", "id": "8f06ca83-2134-4aaf-8e6a-7cd1f7d940dc", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--2098ceac-f818-5129-88d1-6bdf758dcbb9", "toId": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_id": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_name": "HelloBot", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.695Z", "created_at": "2026-09-26T05:47:05.626Z", "modified": "2026-09-26T05:47:05.924Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:47:05.924Z" }, "description_available": false, "entity_type": "indicates", "fromId": "a7a198b8-f0a3-4221-b768-191720f061b9", "from_id": "a7a198b8-f0a3-4221-b768-191720f061b9", "from_name": null, "from_type": "Indicator", "id": "8f14185c-f481-4f36-9fc1-772e52e32dcd", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--6c66fa08-7761-53ec-bbe8-6789be90b7a5", "toId": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_id": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_name": "HelloBot", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.208Z", "created_at": "2026-09-26T06:00:10.361Z", "modified": "2026-09-26T06:00:15.262Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:00:15.262Z" }, "description_available": false, "entity_type": "indicates", "fromId": "f0b6cabc-d961-4c2b-a9a0-4075ac17972c", "from_id": "f0b6cabc-d961-4c2b-a9a0-4075ac17972c", "from_name": null, "from_type": "Indicator", "id": "8f6323dc-ab2f-4d9d-9c93-a82d85eba106", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--0234ef7d-8429-5d69-838a-516af9e257c2", "toId": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_id": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_name": "STOWAWAY", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.717Z", "created_at": "2026-09-26T05:47:36.284Z", "modified": "2026-09-26T05:47:36.565Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:47:36.565Z" }, "description_available": false, "entity_type": "indicates", "fromId": "de51cd6f-4b7a-4c4b-9b3d-d5094f650356", "from_id": "de51cd6f-4b7a-4c4b-9b3d-d5094f650356", "from_name": null, "from_type": "Indicator", "id": "8fbd0fdf-746f-4a13-9a77-d6dcb88fac14", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--43f08461-9362-5bd2-a30c-bfb88c37e2c6", "toId": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_id": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_name": "HelloBot", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.892Z", "created_at": "2026-09-26T05:52:41.813Z", "modified": "2026-09-26T05:52:41.999Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:52:41.999Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c77e0b5e-a168-4a6f-993c-bc7076c78285", "from_id": "c77e0b5e-a168-4a6f-993c-bc7076c78285", "from_name": null, "from_type": "Indicator", "id": "8ff8458e-20bc-4444-a8f3-69df5a4e837a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--6c127e86-f13d-5012-ba6c-74bdeb9de1a9", "toId": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_id": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_name": "TernDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.225Z", "created_at": "2026-09-26T06:00:45.142Z", "modified": "2026-09-26T06:00:45.507Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:00:45.507Z" }, "description_available": false, "entity_type": "indicates", "fromId": "aaf834aa-275b-4a6a-9790-6971e8adf52d", "from_id": "aaf834aa-275b-4a6a-9790-6971e8adf52d", "from_name": null, "from_type": "Indicator", "id": "9018e952-1c9c-4bd6-b29c-b512657f6920", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--23fee6d3-ebb2-502a-98e0-8c4c0cd50d2d", "toId": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_id": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_name": "Melofee", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.415Z", "created_at": "2026-09-26T05:40:09.585Z", "modified": "2026-09-26T05:40:10.053Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:40:10.053Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d4aa073f-c77f-4db6-a515-5246469cf6b0", "from_id": "d4aa073f-c77f-4db6-a515-5246469cf6b0", "from_name": null, "from_type": "Indicator", "id": "9049d3bb-37b9-4408-9029-c22cb7df93eb", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--0242d758-b67c-57ec-83e7-42362b0996cd", "toId": "657ff382-024b-45a4-974a-3e41f1762074", "to_id": "657ff382-024b-45a4-974a-3e41f1762074", "to_name": "Cobalt Strike - S0154", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.151Z", "created_at": "2026-09-26T05:59:06.818Z", "modified": "2026-09-26T05:59:07.115Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:59:07.115Z" }, "description_available": false, "entity_type": "indicates", "fromId": "56d609d1-e0ef-4633-8cfe-a3e1f792fbff", "from_id": "56d609d1-e0ef-4633-8cfe-a3e1f792fbff", "from_name": null, "from_type": "Indicator", "id": "9094586d-9bff-4a3f-92b1-b0f03591e989", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--1339a48f-4f04-5f6e-94ee-00fb72567c26", "toId": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_id": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_name": "TernDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.934Z", "created_at": "2026-09-26T05:53:28.032Z", "modified": "2026-09-26T05:53:28.432Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:53:28.432Z" }, "description_available": false, "entity_type": "indicates", "fromId": "1315ce2a-6659-4f4f-b9b7-e2450564ca9b", "from_id": "1315ce2a-6659-4f4f-b9b7-e2450564ca9b", "from_name": null, "from_type": "Indicator", "id": "90e8641f-3221-4b93-a60b-b4d00c4281b3", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--ecdafddf-0668-5100-818c-b85579e3563b", "toId": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_id": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_name": "Melofee", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.508Z", "created_at": "2026-09-26T05:42:07.544Z", "modified": "2026-09-26T05:42:07.994Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:42:07.994Z" }, "description_available": false, "entity_type": "indicates", "fromId": "435fff26-763c-4528-906f-e8da098d6aee", "from_id": "435fff26-763c-4528-906f-e8da098d6aee", "from_name": null, "from_type": "Indicator", "id": "91fbff82-b8d2-4346-9cf5-09b96d7e6a41", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--14f7af6c-44ea-5ca0-82f8-4e1c24ff7c88", "toId": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_id": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_name": "RatelS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.178Z", "created_at": "2026-09-26T05:59:45.895Z", "modified": "2026-09-26T05:59:47.390Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:59:47.390Z" }, "description_available": false, "entity_type": "indicates", "fromId": "350ff6fa-1c04-4870-b345-041e0d3d6d92", "from_id": "350ff6fa-1c04-4870-b345-041e0d3d6d92", "from_name": null, "from_type": "Indicator", "id": "9203cc60-77e0-4f01-9864-7b1ea95f2abe", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--da5d4481-b450-5c27-98d6-a0dd3aca9176", "toId": "208a45aa-c18e-4619-9a90-7004849cab40", "to_id": "208a45aa-c18e-4619-9a90-7004849cab40", "to_name": "HemiGate", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.637Z", "created_at": "2026-09-26T05:45:43.406Z", "modified": "2026-09-26T05:45:43.617Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:45:43.617Z" }, "description_available": false, "entity_type": "indicates", "fromId": "cdadaaa5-0866-4957-b6d7-c64be31a1cf9", "from_id": "cdadaaa5-0866-4957-b6d7-c64be31a1cf9", "from_name": null, "from_type": "Indicator", "id": "9252b6ad-f541-4f4d-9180-753e7fd4b974", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--f0f0ae30-9424-56eb-ae0b-3ba1a3d38f87", "toId": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_id": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_name": "CrowDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.594Z", "created_at": "2026-09-26T05:43:45.890Z", "modified": "2026-09-26T05:43:46.127Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:43:46.127Z" }, "description_available": false, "entity_type": "indicates", "fromId": "610b3366-3a08-4e4d-9f45-c8543a783a7f", "from_id": "610b3366-3a08-4e4d-9f45-c8543a783a7f", "from_name": null, "from_type": "Indicator", "id": "92715728-2ee8-4a75-9560-2b37c2b3aa42", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--18e7226d-0e58-5fdf-b38b-b89778829276", "toId": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_id": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_name": "CrowDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.565Z", "created_at": "2026-09-26T06:10:48.248Z", "modified": "2026-09-26T06:10:50.668Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:10:50.668Z" }, "description_available": false, "entity_type": "indicates", "fromId": "6ac03fc4-4c10-4d8f-b546-7ce2b9422c39", "from_id": "6ac03fc4-4c10-4d8f-b546-7ce2b9422c39", "from_name": null, "from_type": "Indicator", "id": "92c67300-b21c-4aa5-9523-c8aec21c6579", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--8f8c19cd-071a-503c-a7bb-7c0006bbf534", "toId": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_id": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_name": "PlugX - S0013", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.268Z", "created_at": "2026-09-26T06:01:56.761Z", "modified": "2026-09-26T06:01:56.992Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:01:56.992Z" }, "description_available": false, "entity_type": "indicates", "fromId": "2c0b3e29-5bb5-4044-8031-4f47cd51a008", "from_id": "2c0b3e29-5bb5-4044-8031-4f47cd51a008", "from_name": null, "from_type": "Indicator", "id": "933e9f49-07c6-47af-ae89-80fc01925152", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--d0583b71-8062-5295-b41d-42382e495573", "toId": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_id": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_name": "Melofee", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.786Z", "created_at": "2026-09-26T05:49:19.892Z", "modified": "2026-09-26T05:49:20.128Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:49:20.128Z" }, "description_available": false, "entity_type": "indicates", "fromId": "8134c07a-eec8-489c-80e7-aca40ccc6268", "from_id": "8134c07a-eec8-489c-80e7-aca40ccc6268", "from_name": null, "from_type": "Indicator", "id": "93640203-39f1-4d05-b446-14f03fea1bb5", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--1ac5051d-f202-51f6-937d-d94c248bbe08", "toId": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_id": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_name": "STOWAWAY", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.374Z", "created_at": "2026-09-26T05:39:07.806Z", "modified": "2026-09-26T05:39:08.024Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:39:08.024Z" }, "description_available": false, "entity_type": "indicates", "fromId": "eb51ab90-3d38-4f58-84c1-b0700196508c", "from_id": "eb51ab90-3d38-4f58-84c1-b0700196508c", "from_name": null, "from_type": "Indicator", "id": "9375e29b-15d3-469f-868a-cd24d8f4b777", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--7838d058-2f83-51b7-b31b-cf70bef9c72c", "toId": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_id": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_name": "RatelS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.498Z", "created_at": "2026-09-26T06:07:49.937Z", "modified": "2026-09-26T06:07:50.131Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:07:50.131Z" }, "description_available": false, "entity_type": "indicates", "fromId": "781e0e33-439f-46a6-b565-9c9e6287a0ff", "from_id": "781e0e33-439f-46a6-b565-9c9e6287a0ff", "from_name": null, "from_type": "Indicator", "id": "93f34a9f-8431-43d4-942a-2f68509853d7", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--98c9b9e5-e964-50fa-89a5-52499655b05b", "toId": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_id": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_name": "HelloBot", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.276Z", "created_at": "2026-09-26T05:35:53.689Z", "modified": "2026-09-26T05:35:53.880Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:35:53.880Z" }, "description_available": false, "entity_type": "indicates", "fromId": "48f22366-f0fd-4667-b458-fc531795e8ff", "from_id": "48f22366-f0fd-4667-b458-fc531795e8ff", "from_name": null, "from_type": "Indicator", "id": "945f34c2-57cf-4e3c-90cf-4048a7f97c1a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--96bd0f93-77bc-5694-b3e1-1b17aa753f17", "toId": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_id": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_name": "Melofee", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.178Z", "created_at": "2026-09-26T05:59:40.322Z", "modified": "2026-09-26T05:59:40.488Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:59:40.488Z" }, "description_available": false, "entity_type": "indicates", "fromId": "350ff6fa-1c04-4870-b345-041e0d3d6d92", "from_id": "350ff6fa-1c04-4870-b345-041e0d3d6d92", "from_name": null, "from_type": "Indicator", "id": "94baa6fa-f69d-4ebc-81df-ca1b8a13ddbe", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--3cbdcec7-5538-5072-8a60-df8098c3e853", "toId": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_id": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_name": "TernDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.349Z", "created_at": "2026-09-26T05:37:27.538Z", "modified": "2026-09-26T05:37:27.831Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:37:27.831Z" }, "description_available": false, "entity_type": "indicates", "fromId": "94a7b3a6-0b64-4746-86ff-6647d1a2df8d", "from_id": "94a7b3a6-0b64-4746-86ff-6647d1a2df8d", "from_name": null, "from_type": "Indicator", "id": "94d3b0ea-2f93-45bd-af44-1a626a549417", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--e2e4d8b1-4894-5c81-b40f-86c101cadf6c", "toId": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_id": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_name": "Spark - S0543", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.090Z", "created_at": "2026-09-26T05:34:55.280Z", "modified": "2026-09-26T05:34:57.169Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:34:57.169Z" }, "description_available": false, "entity_type": "based-on", "fromId": "10b221ff-1d17-4b38-ae27-73235f136031", "from_id": "10b221ff-1d17-4b38-ae27-73235f136031", "from_name": null, "from_type": "Indicator", "id": "95c5716e-58c9-4fe7-984b-48bfd622cff8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--5e7cde26-1205-562e-9c6c-f82dc606d9f4", "toId": "526752ca-7f3b-4cb8-b0ec-5bd2ab4cd5d4", "to_id": "526752ca-7f3b-4cb8-b0ec-5bd2ab4cd5d4", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.390Z", "created_at": "2026-09-26T06:05:22.635Z", "modified": "2026-09-26T06:05:23.323Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:05:23.323Z" }, "description_available": false, "entity_type": "indicates", "fromId": "2d16d740-ae8a-45ff-8a8b-9032f924c3fa", "from_id": "2d16d740-ae8a-45ff-8a8b-9032f924c3fa", "from_name": null, "from_type": "Indicator", "id": "95d341d4-fe59-4d8c-90e5-d4925e64edde", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--0850880a-1b53-55b5-814f-4b668183eab6", "toId": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_id": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_name": "RatelS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.405Z", "created_at": "2026-09-26T06:05:43.762Z", "modified": "2026-09-26T06:05:45.101Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:05:45.101Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ac6046d8-f570-4eca-af26-b22ab4b74e00", "from_id": "ac6046d8-f570-4eca-af26-b22ab4b74e00", "from_name": null, "from_type": "Indicator", "id": "966c71fc-f582-4f52-9257-352f2f6cdfeb", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--fa46439c-148b-563b-bb0d-53b5bfefadc9", "toId": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_id": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_name": "PlugX - S0013", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.168Z", "created_at": "2026-09-26T05:59:30.050Z", "modified": "2026-09-26T05:59:30.252Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:59:30.252Z" }, "description_available": false, "entity_type": "indicates", "fromId": "350ff6fa-1c04-4870-b345-041e0d3d6d92", "from_id": "350ff6fa-1c04-4870-b345-041e0d3d6d92", "from_name": null, "from_type": "Indicator", "id": "969f9aa8-b9f8-44e4-9d2f-c8a3eacac765", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--dcef30cb-85d0-5749-b108-a92d838a4973", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.461Z", "created_at": "2026-09-26T05:41:04.980Z", "modified": "2026-09-26T05:41:06.319Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:41:06.319Z" }, "description_available": false, "entity_type": "indicates", "fromId": "4ff9e994-0564-43c3-8240-004f20eb7d3f", "from_id": "4ff9e994-0564-43c3-8240-004f20eb7d3f", "from_name": null, "from_type": "Indicator", "id": "96c3de0f-bf22-4b70-89b7-7010bed2e685", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--724af624-f92d-5d31-a2a2-230ba2976e3a", "toId": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_id": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_name": "TernDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.078Z", "created_at": "2026-09-26T05:34:54.342Z", "modified": "2026-09-26T05:34:54.886Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:34:54.886Z" }, "description_available": false, "entity_type": "based-on", "fromId": "1a15e67e-da7b-42ec-b24a-d47fd8aa0767", "from_id": "1a15e67e-da7b-42ec-b24a-d47fd8aa0767", "from_name": null, "from_type": "Indicator", "id": "97a3616d-75df-4eed-8ab6-bca35b3c7a34", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--70d80fff-7aa8-5129-8c53-433fce042a9b", "toId": "016f544e-e59c-4260-b22d-e1c41b3acf25", "to_id": "016f544e-e59c-4260-b22d-e1c41b3acf25", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.007Z", "created_at": "2026-09-26T05:55:01.687Z", "modified": "2026-09-26T05:55:02.224Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:55:02.224Z" }, "description_available": false, "entity_type": "indicates", "fromId": "26da206d-5fde-40ba-bc45-0f24f378263c", "from_id": "26da206d-5fde-40ba-bc45-0f24f378263c", "from_name": null, "from_type": "Indicator", "id": "97d5c00b-31c2-406f-b695-d38ad23a45c4", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--879762fb-180f-584f-a63b-d7bc0102b4a2", "toId": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_id": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_name": "RatelS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.680Z", "created_at": "2026-09-26T05:47:00.105Z", "modified": "2026-09-26T05:47:00.465Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:47:00.465Z" }, "description_available": false, "entity_type": "indicates", "fromId": "157ca5cb-7d34-4fc3-83d2-bac13ceb9804", "from_id": "157ca5cb-7d34-4fc3-83d2-bac13ceb9804", "from_name": null, "from_type": "Indicator", "id": "9881eccf-b86d-4e9c-9e53-9c7a47bd42fe", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--02f6f527-1049-53ea-b818-24d9865bd5f8", "toId": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_id": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_name": "CrowDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.274Z", "created_at": "2026-09-26T06:02:12.652Z", "modified": "2026-09-26T06:02:12.817Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:02:12.817Z" }, "description_available": false, "entity_type": "indicates", "fromId": "2c0b3e29-5bb5-4044-8031-4f47cd51a008", "from_id": "2c0b3e29-5bb5-4044-8031-4f47cd51a008", "from_name": null, "from_type": "Indicator", "id": "9a89348a-c608-4322-a787-1e243f91dda2", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--04a868c2-2f75-5450-bde6-001b4ef8ab4f", "toId": "657ff382-024b-45a4-974a-3e41f1762074", "to_id": "657ff382-024b-45a4-974a-3e41f1762074", "to_name": "Cobalt Strike - S0154", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.099Z", "created_at": "2026-09-26T05:34:59.291Z", "modified": "2026-09-26T05:34:59.906Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:34:59.906Z" }, "description_available": false, "entity_type": "based-on", "fromId": "fdaa0a79-121c-4e17-91bb-e23da88da18e", "from_id": "fdaa0a79-121c-4e17-91bb-e23da88da18e", "from_name": null, "from_type": "Indicator", "id": "9af78d72-5a13-416d-a5bd-8ed9c3b803b7", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--04d183be-55b0-5bc0-83ed-62bc8c4b6a63", "toId": "9d5b7e5a-f4bb-4233-b9d0-269de30e7216", "to_id": "9d5b7e5a-f4bb-4233-b9d0-269de30e7216", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.476Z", "created_at": "2026-09-26T06:07:17.845Z", "modified": "2026-09-26T06:07:18.012Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:07:18.012Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d7d77ca0-8c06-4de9-bacb-a526f344e2e9", "from_id": "d7d77ca0-8c06-4de9-bacb-a526f344e2e9", "from_name": null, "from_type": "Indicator", "id": "9b090d72-9fb8-43d2-a45c-ee8dbbeb36c5", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--a431868d-aeb4-528b-a583-452a549419c1", "toId": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_id": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_name": "PlugX - S0013", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.957Z", "created_at": "2026-09-26T05:53:58.941Z", "modified": "2026-09-26T05:53:59.130Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:53:59.130Z" }, "description_available": false, "entity_type": "indicates", "fromId": "2497f466-fac3-4bfc-ab1f-5ebcf363283b", "from_id": "2497f466-fac3-4bfc-ab1f-5ebcf363283b", "from_name": null, "from_type": "Indicator", "id": "9b212e2f-8aa8-4c6c-8d67-4c4012a127e2", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--152448d2-c0bb-5e76-a539-0ac9aa48fd4a", "toId": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_id": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_name": "HelloBot", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.503Z", "created_at": "2026-09-26T06:08:02.407Z", "modified": "2026-09-26T06:08:02.816Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:08:02.816Z" }, "description_available": false, "entity_type": "indicates", "fromId": "781e0e33-439f-46a6-b565-9c9e6287a0ff", "from_id": "781e0e33-439f-46a6-b565-9c9e6287a0ff", "from_name": null, "from_type": "Indicator", "id": "9bd0336d-e36e-4c61-919b-e8fc86cf78a0", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--94157fbc-222b-5eb9-8f6e-bfe403c80ec6", "toId": "657ff382-024b-45a4-974a-3e41f1762074", "to_id": "657ff382-024b-45a4-974a-3e41f1762074", "to_name": "Cobalt Strike - S0154", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.963Z", "created_at": "2026-09-26T05:54:02.638Z", "modified": "2026-09-26T05:54:02.844Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:54:02.844Z" }, "description_available": false, "entity_type": "indicates", "fromId": "2497f466-fac3-4bfc-ab1f-5ebcf363283b", "from_id": "2497f466-fac3-4bfc-ab1f-5ebcf363283b", "from_name": null, "from_type": "Indicator", "id": "9c31d022-2632-4dbf-a5e3-e09c72b29168", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--c62c2365-d1e8-5910-9c85-f04313fa320b", "toId": "208a45aa-c18e-4619-9a90-7004849cab40", "to_id": "208a45aa-c18e-4619-9a90-7004849cab40", "to_name": "HemiGate", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.221Z", "created_at": "2026-09-26T05:35:14.190Z", "modified": "2026-09-26T05:35:17.006Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:35:17.006Z" }, "description_available": false, "entity_type": "based-on", "fromId": "2d16d740-ae8a-45ff-8a8b-9032f924c3fa", "from_id": "2d16d740-ae8a-45ff-8a8b-9032f924c3fa", "from_name": null, "from_type": "Indicator", "id": "9c37069e-6647-4ecd-9b7c-42c04a9971b0", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--e606d137-89cd-5d06-804b-efe07fdf8870", "toId": "9c508525-38f5-4ad0-a0d5-897383007809", "to_id": "9c508525-38f5-4ad0-a0d5-897383007809", "to_name": null, "to_type": "Url" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.983Z", "created_at": "2026-09-26T05:54:32.438Z", "modified": "2026-09-26T05:54:32.672Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:54:32.672Z" }, "description_available": false, "entity_type": "indicates", "fromId": "2d8df4da-244f-458a-8c2d-ff67380121e9", "from_id": "2d8df4da-244f-458a-8c2d-ff67380121e9", "from_name": null, "from_type": "Indicator", "id": "9cd95106-5474-4c61-aaaa-302605ecdccd", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--00f66cce-8a08-5825-8280-bcf4a5d6e6e2", "toId": "657ff382-024b-45a4-974a-3e41f1762074", "to_id": "657ff382-024b-45a4-974a-3e41f1762074", "to_name": "Cobalt Strike - S0154", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.284Z", "created_at": "2026-09-26T05:35:59.711Z", "modified": "2026-09-26T05:35:59.853Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:35:59.853Z" }, "description_available": false, "entity_type": "indicates", "fromId": "48f22366-f0fd-4667-b458-fc531795e8ff", "from_id": "48f22366-f0fd-4667-b458-fc531795e8ff", "from_name": null, "from_type": "Indicator", "id": "9cdd62ad-4c28-4f8f-8bba-79ec576b7761", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--8b65ddac-e5f7-59bc-9d6d-bfa4077ca280", "toId": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_id": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_name": "CrowDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.096Z", "created_at": "2026-09-26T05:34:58.874Z", "modified": "2026-09-26T05:34:59.230Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:34:59.230Z" }, "description_available": false, "entity_type": "based-on", "fromId": "c77e0b5e-a168-4a6f-993c-bc7076c78285", "from_id": "c77e0b5e-a168-4a6f-993c-bc7076c78285", "from_name": null, "from_type": "Indicator", "id": "9ea15482-fc51-4f96-bbdd-1904b6b72f55", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--c22db8dd-1f59-5263-8ef1-0c8ebff20b1a", "toId": "f05ee10f-9e6f-4994-b588-c172a138f88e", "to_id": "f05ee10f-9e6f-4994-b588-c172a138f88e", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.299Z", "created_at": "2026-09-26T05:36:18.309Z", "modified": "2026-09-26T05:36:18.478Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:36:18.478Z" }, "description_available": false, "entity_type": "indicates", "fromId": "20bc512e-2f63-438d-bcee-abdf39614bf5", "from_id": "20bc512e-2f63-438d-bcee-abdf39614bf5", "from_name": null, "from_type": "Indicator", "id": "9ec9ebdd-7e97-4ea3-b507-3973944a7c84", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--f68a2f47-fa96-5ffb-980e-5c8edefdbc78", "toId": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_id": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_name": "PlugX - S0013", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.099Z", "created_at": "2026-09-26T05:58:12.511Z", "modified": "2026-09-26T05:58:12.687Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:58:12.687Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d7f88a85-9ab3-45b8-982b-294d838461a6", "from_id": "d7f88a85-9ab3-45b8-982b-294d838461a6", "from_name": null, "from_type": "Indicator", "id": "9ed408cb-b7ff-47cd-b7e6-3c0948cab486", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--f8ca09d4-e0cc-5770-8562-56f7801a47f1", "toId": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_id": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_name": "CrowDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.940Z", "created_at": "2026-09-26T05:53:31.957Z", "modified": "2026-09-26T05:53:32.165Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:53:32.165Z" }, "description_available": false, "entity_type": "indicates", "fromId": "1315ce2a-6659-4f4f-b9b7-e2450564ca9b", "from_id": "1315ce2a-6659-4f4f-b9b7-e2450564ca9b", "from_name": null, "from_type": "Indicator", "id": "9ed7dad9-6b54-4ea8-8fed-cd63dd0c7d8a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--08fea26e-45db-58f4-979b-16e86be519f9", "toId": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_id": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_name": "Spark - S0543", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.060Z", "created_at": "2026-09-26T05:34:53.094Z", "modified": "2026-09-26T05:34:53.817Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:34:53.817Z" }, "description_available": false, "entity_type": "based-on", "fromId": "681c2240-1fb8-466d-a533-8f1d8132b27b", "from_id": "681c2240-1fb8-466d-a533-8f1d8132b27b", "from_name": null, "from_type": "Indicator", "id": "9f0030f3-fe26-45dc-b0a9-01e72ae7d31f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--877a8df3-94bd-5783-b2dd-a28b26d43a73", "toId": "057c7c24-a4a7-4440-b9e0-342673290da3", "to_id": "057c7c24-a4a7-4440-b9e0-342673290da3", "to_name": null, "to_type": "IPv4Addr" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.619Z", "created_at": "2026-09-26T06:11:54.989Z", "modified": "2026-09-26T06:11:55.310Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:11:55.310Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d5009423-c128-4583-ac72-3f07f1201db6", "from_id": "d5009423-c128-4583-ac72-3f07f1201db6", "from_name": null, "from_type": "Indicator", "id": "9fe5face-b5bf-4ef4-ac9b-c19feae80160", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--bb6159ef-348f-5e3a-875c-192a35ad4f45", "toId": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_id": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_name": "TernDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.117Z", "created_at": "2026-09-26T05:58:34.499Z", "modified": "2026-09-26T05:58:34.698Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:58:34.698Z" }, "description_available": false, "entity_type": "indicates", "fromId": "52b56463-7f22-48f8-b036-35d89d2dabcb", "from_id": "52b56463-7f22-48f8-b036-35d89d2dabcb", "from_name": null, "from_type": "Indicator", "id": "a0d7b44d-169e-413b-8ec4-89a21bb72cfb", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--a7fe654c-2f7a-5196-bf45-f5b659f32f4a", "toId": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_id": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_name": "Melofee", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.325Z", "created_at": "2026-09-26T05:36:53.516Z", "modified": "2026-09-26T05:36:53.694Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:36:53.694Z" }, "description_available": false, "entity_type": "indicates", "fromId": "b2490479-1c8f-4288-a8e1-23589e1535cf", "from_id": "b2490479-1c8f-4288-a8e1-23589e1535cf", "from_name": null, "from_type": "Indicator", "id": "a12ab7ca-52a4-4b47-ac92-5442871beeb5", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--a0f11c41-3299-5d06-9e81-280b3dbb2b65", "toId": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_id": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_name": "Spark - S0543", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.572Z", "created_at": "2026-09-26T05:43:25.636Z", "modified": "2026-09-26T05:43:26.228Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:43:26.228Z" }, "description_available": false, "entity_type": "indicates", "fromId": "b5ad9feb-b128-47fb-9914-8319d0f48229", "from_id": "b5ad9feb-b128-47fb-9914-8319d0f48229", "from_name": null, "from_type": "Indicator", "id": "a13c6a9a-f2de-4704-a549-c18448f21e79", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--4322f82b-ffd3-5555-85ca-007a7264cd0c", "toId": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_id": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_name": "TernDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.343Z", "created_at": "2026-09-26T05:37:23.349Z", "modified": "2026-09-26T05:37:24.796Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:37:24.796Z" }, "description_available": false, "entity_type": "indicates", "fromId": "94a7b3a6-0b64-4746-86ff-6647d1a2df8d", "from_id": "94a7b3a6-0b64-4746-86ff-6647d1a2df8d", "from_name": null, "from_type": "Indicator", "id": "a17a0151-5f62-45a4-aba3-73204b148d75", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--ab88c17b-70be-5936-963d-f955cbdccd33", "toId": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_id": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_name": "HelloBot", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.917Z", "created_at": "2026-09-26T05:53:28.304Z", "modified": "2026-09-26T05:53:28.619Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:53:28.619Z" }, "description_available": false, "entity_type": "indicates", "fromId": "fdaa0a79-121c-4e17-91bb-e23da88da18e", "from_id": "fdaa0a79-121c-4e17-91bb-e23da88da18e", "from_name": null, "from_type": "Indicator", "id": "a186c2cb-1177-4e14-b836-fbd7fc7f3cd1", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--3924c9d1-2f61-5499-ab5f-077defe52593", "toId": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_id": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_name": "CrowDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.717Z", "created_at": "2026-09-26T05:47:37.629Z", "modified": "2026-09-26T05:47:38.123Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:47:38.123Z" }, "description_available": false, "entity_type": "indicates", "fromId": "de51cd6f-4b7a-4c4b-9b3d-d5094f650356", "from_id": "de51cd6f-4b7a-4c4b-9b3d-d5094f650356", "from_name": null, "from_type": "Indicator", "id": "a1aee11f-e3db-4609-9620-9c253a2d827d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--e92941f0-8dad-52a8-b476-7703c3045370", "toId": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_id": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_name": "PlugX - S0013", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.616Z", "created_at": "2026-09-26T05:45:18.086Z", "modified": "2026-09-26T05:45:20.113Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:45:20.113Z" }, "description_available": false, "entity_type": "indicates", "fromId": "3be1760f-af98-4d5c-80e2-c0338b71f391", "from_id": "3be1760f-af98-4d5c-80e2-c0338b71f391", "from_name": null, "from_type": "Indicator", "id": "a1fc3a67-5e6d-4973-8544-f5a0d5a241b8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--e540048e-a75e-56dd-8556-6ae1ae2d1aa6", "toId": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_id": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_name": "TernDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.038Z", "created_at": "2026-09-26T05:34:46.064Z", "modified": "2026-09-26T05:34:46.686Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:34:46.686Z" }, "description_available": false, "entity_type": "based-on", "fromId": "435fff26-763c-4528-906f-e8da098d6aee", "from_id": "435fff26-763c-4528-906f-e8da098d6aee", "from_name": null, "from_type": "Indicator", "id": "a21ebfb4-07c4-434e-b58d-ba229dda90d8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--48405b34-da87-5f9d-945a-5bfe6c72fb96", "toId": "8e14af81-a523-423f-9f91-478260788646", "to_id": "8e14af81-a523-423f-9f91-478260788646", "to_name": null, "to_type": "IPv4Addr" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.549Z", "created_at": "2026-09-26T05:42:57.941Z", "modified": "2026-09-26T05:42:58.177Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:42:58.177Z" }, "description_available": false, "entity_type": "indicates", "fromId": "653baf3a-7205-44e8-bf30-e40825fbf42a", "from_id": "653baf3a-7205-44e8-bf30-e40825fbf42a", "from_name": null, "from_type": "Indicator", "id": "a29a76ff-16f3-4473-84ef-233c32e95deb", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--05b5f121-15db-5e6c-bcc4-0535254f2148", "toId": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_id": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_name": "STOWAWAY", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.609Z", "created_at": "2026-09-26T05:45:14.562Z", "modified": "2026-09-26T05:45:14.886Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:45:14.886Z" }, "description_available": false, "entity_type": "indicates", "fromId": "3be1760f-af98-4d5c-80e2-c0338b71f391", "from_id": "3be1760f-af98-4d5c-80e2-c0338b71f391", "from_name": null, "from_type": "Indicator", "id": "a2a7a34a-ecec-4f46-a988-0526af18f3e9", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--08d0b17b-5484-5081-bbc4-9799e924a5c1", "toId": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_id": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_name": "Melofee", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.343Z", "created_at": "2026-09-26T06:04:33.802Z", "modified": "2026-09-26T06:04:34.084Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:04:34.084Z" }, "description_available": false, "entity_type": "indicates", "fromId": "95ef732a-5859-4b75-a4ea-fd3cfe3f1618", "from_id": "95ef732a-5859-4b75-a4ea-fd3cfe3f1618", "from_name": null, "from_type": "Indicator", "id": "a2d2e5c3-4c05-4147-99aa-ec329a57c602", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--edb80840-f264-5ad9-a133-ed8f9d841d08", "toId": "657ff382-024b-45a4-974a-3e41f1762074", "to_id": "657ff382-024b-45a4-974a-3e41f1762074", "to_name": "Cobalt Strike - S0154", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.093Z", "created_at": "2026-09-26T05:34:57.227Z", "modified": "2026-09-26T05:34:59.229Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:34:59.229Z" }, "description_available": false, "entity_type": "based-on", "fromId": "6ae45569-c03b-471f-80ff-50d7a804075a", "from_id": "6ae45569-c03b-471f-80ff-50d7a804075a", "from_name": null, "from_type": "Indicator", "id": "a357ba1a-bb44-4535-87bc-3245c1c69f99", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--71199c26-e243-5e22-9efe-ccb5a3d5d722", "toId": "e61b6017-a6a7-4dfb-a05d-e24eef8b4eec", "to_id": "e61b6017-a6a7-4dfb-a05d-e24eef8b4eec", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.294Z", "created_at": "2026-09-26T06:02:22.991Z", "modified": "2026-09-26T06:02:23.144Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:02:23.144Z" }, "description_available": false, "entity_type": "indicates", "fromId": "3b95a828-10fe-4895-a5fa-606043535451", "from_id": "3b95a828-10fe-4895-a5fa-606043535451", "from_name": null, "from_type": "Indicator", "id": "a3e4dd24-2ddc-47ee-86c4-534fa4e305f8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--12aaf1d4-0b13-5742-bc12-cd2650ca3634", "toId": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_id": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_name": "Spark - S0543", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.119Z", "created_at": "2026-09-26T05:58:35.225Z", "modified": "2026-09-26T05:58:35.380Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:58:35.380Z" }, "description_available": false, "entity_type": "indicates", "fromId": "52b56463-7f22-48f8-b036-35d89d2dabcb", "from_id": "52b56463-7f22-48f8-b036-35d89d2dabcb", "from_name": null, "from_type": "Indicator", "id": "a4479a1e-d151-4104-9fe7-1eebf3c60324", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--760f5e70-f88b-5810-9e3c-dde3116ef2e5", "toId": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_id": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_name": "HelloBot", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.474Z", "created_at": "2026-09-26T06:07:15.660Z", "modified": "2026-09-26T06:07:15.825Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:07:15.825Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d7d77ca0-8c06-4de9-bacb-a526f344e2e9", "from_id": "d7d77ca0-8c06-4de9-bacb-a526f344e2e9", "from_name": null, "from_type": "Indicator", "id": "a476df05-03b1-4900-ab98-93a84422b646", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--0a22e33b-600e-54c1-a1c3-cbb58f91cbea", "toId": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_id": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_name": "Melofee", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.020Z", "created_at": "2026-09-26T05:55:25.424Z", "modified": "2026-09-26T05:55:25.585Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:55:25.585Z" }, "description_available": false, "entity_type": "indicates", "fromId": "cd0c196b-8e17-4794-80e8-7129d42950e2", "from_id": "cd0c196b-8e17-4794-80e8-7129d42950e2", "from_name": null, "from_type": "Indicator", "id": "a4902940-8109-48ae-91d3-3e256cd2ef43", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--2716a830-20d1-5980-8aeb-b90f94c8b1c2", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.935Z", "created_at": "2026-09-26T05:53:30.839Z", "modified": "2026-09-26T05:53:30.957Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:53:30.957Z" }, "description_available": false, "entity_type": "indicates", "fromId": "1315ce2a-6659-4f4f-b9b7-e2450564ca9b", "from_id": "1315ce2a-6659-4f4f-b9b7-e2450564ca9b", "from_name": null, "from_type": "Indicator", "id": "a497b1b9-37f2-4cd2-88c4-e73602a028a1", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--a75f2ecc-84e5-5f97-b565-3e4f75db73e6", "toId": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_id": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_name": "HelloBot", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.099Z", "created_at": "2026-09-26T05:58:18.483Z", "modified": "2026-09-26T05:58:18.690Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:58:18.690Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d7f88a85-9ab3-45b8-982b-294d838461a6", "from_id": "d7f88a85-9ab3-45b8-982b-294d838461a6", "from_name": null, "from_type": "Indicator", "id": "a4a3c662-4551-4d6b-9f53-fc806e604ed8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--76ac5d46-bf25-58bf-88c9-cbf94bbe5423", "toId": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_id": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_name": "TernDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.317Z", "created_at": "2026-09-26T06:02:55.458Z", "modified": "2026-09-26T06:02:56.429Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:02:56.429Z" }, "description_available": false, "entity_type": "indicates", "fromId": "6fbf4d94-634a-4763-b0e5-0cbe6e9f67ea", "from_id": "6fbf4d94-634a-4763-b0e5-0cbe6e9f67ea", "from_name": null, "from_type": "Indicator", "id": "a4b2c0fb-9af5-403b-942f-fff6307bbb77", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--6e3c82eb-3b73-5cac-84ae-a5c61a23f8fe", "toId": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_id": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_name": "STOWAWAY", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.909Z", "created_at": "2026-09-26T05:53:03.434Z", "modified": "2026-09-26T05:53:04.260Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:53:04.260Z" }, "description_available": false, "entity_type": "indicates", "fromId": "fdaa0a79-121c-4e17-91bb-e23da88da18e", "from_id": "fdaa0a79-121c-4e17-91bb-e23da88da18e", "from_name": null, "from_type": "Indicator", "id": "a4bf6aca-117d-4ac5-b405-07ac12eda63d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--d280deaf-8e85-5f5c-9960-c7f1ddabf4e8", "toId": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_id": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_name": "HelloBot", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.360Z", "created_at": "2026-09-26T06:04:44.853Z", "modified": "2026-09-26T06:04:45.884Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:04:45.884Z" }, "description_available": false, "entity_type": "indicates", "fromId": "3c2ca4de-2c25-4802-a582-ebf285060ed9", "from_id": "3c2ca4de-2c25-4802-a582-ebf285060ed9", "from_name": null, "from_type": "Indicator", "id": "a54daae1-54f0-4365-b422-8caca2055ccb", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--21109b0a-dc1a-5d9b-9389-64750f3247fb", "toId": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_id": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_name": "HelloBot", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.505Z", "created_at": "2026-09-26T06:07:57.378Z", "modified": "2026-09-26T06:07:57.749Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:07:57.749Z" }, "description_available": false, "entity_type": "indicates", "fromId": "781e0e33-439f-46a6-b565-9c9e6287a0ff", "from_id": "781e0e33-439f-46a6-b565-9c9e6287a0ff", "from_name": null, "from_type": "Indicator", "id": "a56351b6-3239-4c52-bb50-bee109c35148", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--b5c266fe-ddb3-5187-ba93-375800f4470b", "toId": "208a45aa-c18e-4619-9a90-7004849cab40", "to_id": "208a45aa-c18e-4619-9a90-7004849cab40", "to_name": "HemiGate", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.962Z", "created_at": "2026-09-26T05:54:01.719Z", "modified": "2026-09-26T05:54:02.042Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:54:02.042Z" }, "description_available": false, "entity_type": "indicates", "fromId": "2497f466-fac3-4bfc-ab1f-5ebcf363283b", "from_id": "2497f466-fac3-4bfc-ab1f-5ebcf363283b", "from_name": null, "from_type": "Indicator", "id": "a6de5086-f627-4e1e-9f57-9502b09e4099", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--b55c8243-b57b-57a7-9ebc-44c36ec1b42e", "toId": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_id": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_name": "CrowDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.610Z", "created_at": "2026-09-26T06:11:42.822Z", "modified": "2026-09-26T06:11:43.050Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:11:43.050Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d5009423-c128-4583-ac72-3f07f1201db6", "from_id": "d5009423-c128-4583-ac72-3f07f1201db6", "from_name": null, "from_type": "Indicator", "id": "a6f6a9db-04c1-4bc3-b3b0-c9bcd3a51b5a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--4a65bacb-360a-5eec-be4f-a8da96271199", "toId": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_id": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_name": "Melofee", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.550Z", "created_at": "2026-09-26T06:09:02.258Z", "modified": "2026-09-26T06:09:02.610Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:09:02.610Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c9493e20-dc6a-4938-8fee-746005c4ae07", "from_id": "c9493e20-dc6a-4938-8fee-746005c4ae07", "from_name": null, "from_type": "Indicator", "id": "a754bd96-bd64-46fc-9df6-30da90594176", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--220e9e8f-ca56-5f7d-97f4-924f7e5ef03f", "toId": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_id": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_name": "RatelS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.523Z", "created_at": "2026-09-26T05:42:27.326Z", "modified": "2026-09-26T05:42:27.686Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:42:27.686Z" }, "description_available": false, "entity_type": "indicates", "fromId": "0eb188e3-885e-4084-abdf-6d4ba0098e64", "from_id": "0eb188e3-885e-4084-abdf-6d4ba0098e64", "from_name": null, "from_type": "Indicator", "id": "a8603337-10ff-42c1-9d24-2b0163b7eb3f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--fe02127e-a915-5a75-97c8-a3b96e41aa4c", "toId": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_id": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_name": "PlugX - S0013", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.022Z", "created_at": "2026-09-26T05:55:27.058Z", "modified": "2026-09-26T05:55:28.998Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:55:28.998Z" }, "description_available": false, "entity_type": "indicates", "fromId": "cd0c196b-8e17-4794-80e8-7129d42950e2", "from_id": "cd0c196b-8e17-4794-80e8-7129d42950e2", "from_name": null, "from_type": "Indicator", "id": "a87ea5db-4b1d-45fd-82e1-9d421f7e2c11", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--d443f6aa-9564-5502-86e0-fabf9e1390c3", "toId": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_id": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_name": "PlugX - S0013", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.223Z", "created_at": "2026-09-26T05:35:14.192Z", "modified": "2026-09-26T05:35:17.007Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:35:17.007Z" }, "description_available": false, "entity_type": "based-on", "fromId": "ac6046d8-f570-4eca-af26-b22ab4b74e00", "from_id": "ac6046d8-f570-4eca-af26-b22ab4b74e00", "from_name": null, "from_type": "Indicator", "id": "a89085ac-04be-43c2-8d97-7a3cfb0d7aba", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--34a64bb6-4dae-5cbe-8fc4-ba1d38ffd08e", "toId": "0b49f882-3713-40dc-957f-7e6435f89a00", "to_id": "0b49f882-3713-40dc-957f-7e6435f89a00", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.549Z", "created_at": "2026-09-26T06:09:01.791Z", "modified": "2026-09-26T06:09:01.956Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:09:01.956Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c9493e20-dc6a-4938-8fee-746005c4ae07", "from_id": "c9493e20-dc6a-4938-8fee-746005c4ae07", "from_name": null, "from_type": "Indicator", "id": "a95137a4-8fc6-4161-8214-e8d805071abf", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--95f79a50-d530-5c41-b915-943b821bdba7", "toId": "208a45aa-c18e-4619-9a90-7004849cab40", "to_id": "208a45aa-c18e-4619-9a90-7004849cab40", "to_name": "HemiGate", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.365Z", "created_at": "2026-09-26T06:04:59.384Z", "modified": "2026-09-26T06:04:59.758Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:04:59.758Z" }, "description_available": false, "entity_type": "indicates", "fromId": "3c2ca4de-2c25-4802-a582-ebf285060ed9", "from_id": "3c2ca4de-2c25-4802-a582-ebf285060ed9", "from_name": null, "from_type": "Indicator", "id": "aaa326c4-8a90-4415-bc50-73bd17ad5db7", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--db886e56-e88d-584a-8cc8-62a42391fb7e", "toId": "657ff382-024b-45a4-974a-3e41f1762074", "to_id": "657ff382-024b-45a4-974a-3e41f1762074", "to_name": "Cobalt Strike - S0154", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.310Z", "created_at": "2026-09-26T06:02:52.491Z", "modified": "2026-09-26T06:02:53.059Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:02:53.059Z" }, "description_available": false, "entity_type": "indicates", "fromId": "6fbf4d94-634a-4763-b0e5-0cbe6e9f67ea", "from_id": "6fbf4d94-634a-4763-b0e5-0cbe6e9f67ea", "from_name": null, "from_type": "Indicator", "id": "aae02f08-79e8-4979-8ee0-d5d54ba021e5", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--40c512fe-a157-5401-9262-3ddf0f1d0225", "toId": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_id": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_name": "Melofee", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.528Z", "created_at": "2026-09-26T05:42:31.561Z", "modified": "2026-09-26T05:42:31.729Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:42:31.729Z" }, "description_available": false, "entity_type": "indicates", "fromId": "0eb188e3-885e-4084-abdf-6d4ba0098e64", "from_id": "0eb188e3-885e-4084-abdf-6d4ba0098e64", "from_name": null, "from_type": "Indicator", "id": "ab6048cb-3166-4dab-a36b-d48f278dc595", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--17b3f596-587d-53f6-b72e-ec0945531f0b", "toId": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_id": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_name": "STOWAWAY", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.435Z", "created_at": "2026-09-26T06:06:20.366Z", "modified": "2026-09-26T06:06:20.606Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:06:20.606Z" }, "description_available": false, "entity_type": "indicates", "fromId": "313c8419-28b4-4ef9-9855-91d315819bf8", "from_id": "313c8419-28b4-4ef9-9855-91d315819bf8", "from_name": null, "from_type": "Indicator", "id": "abbd7fba-8aef-4ed4-b648-70ad1fc5f044", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--55c936b7-4ac8-527d-9ee2-971f64ae679f", "toId": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_id": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_name": "CrowDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.716Z", "created_at": "2026-09-26T05:47:37.066Z", "modified": "2026-09-26T05:47:37.316Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:47:37.316Z" }, "description_available": false, "entity_type": "indicates", "fromId": "de51cd6f-4b7a-4c4b-9b3d-d5094f650356", "from_id": "de51cd6f-4b7a-4c4b-9b3d-d5094f650356", "from_name": null, "from_type": "Indicator", "id": "abc18fa0-6de7-476e-929c-4e9514d5429e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--0dd636da-ec82-53b8-a4fa-f0c170f12a7c", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.299Z", "created_at": "2026-09-26T05:36:18.814Z", "modified": "2026-09-26T05:36:19.371Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:36:19.371Z" }, "description_available": false, "entity_type": "indicates", "fromId": "20bc512e-2f63-438d-bcee-abdf39614bf5", "from_id": "20bc512e-2f63-438d-bcee-abdf39614bf5", "from_name": null, "from_type": "Indicator", "id": "abc66d71-5d1b-4cbe-b38e-ba4bf7fe1b70", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--4f63311e-43b2-520a-a881-cdf0f75d2734", "toId": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_id": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_name": "HelloBot", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.143Z", "created_at": "2026-09-26T05:58:58.250Z", "modified": "2026-09-26T05:58:58.492Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:58:58.492Z" }, "description_available": false, "entity_type": "indicates", "fromId": "56d609d1-e0ef-4633-8cfe-a3e1f792fbff", "from_id": "56d609d1-e0ef-4633-8cfe-a3e1f792fbff", "from_name": null, "from_type": "Indicator", "id": "abc7f67d-88b6-4cf0-85ce-0d82e803c722", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--4c4825ce-5f0a-5343-8b38-08a7fd26475d", "toId": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_id": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_name": "Melofee", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.042Z", "created_at": "2026-09-26T05:55:58.915Z", "modified": "2026-09-26T05:55:59.312Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:55:59.312Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ea8ff45b-69d1-4069-bebe-6f7107045959", "from_id": "ea8ff45b-69d1-4069-bebe-6f7107045959", "from_name": null, "from_type": "Indicator", "id": "ac3db980-6bcc-4ffb-99a0-acf11667a7b7", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--14a5cd90-b60a-5617-aa5b-ce62da5552aa", "toId": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_id": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_name": "HelloBot", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.407Z", "created_at": "2026-09-26T05:40:01.473Z", "modified": "2026-09-26T05:40:01.896Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:40:01.896Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d4aa073f-c77f-4db6-a515-5246469cf6b0", "from_id": "d4aa073f-c77f-4db6-a515-5246469cf6b0", "from_name": null, "from_type": "Indicator", "id": "ac3f7b8f-2813-469e-a6e2-af00c3bcad15", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--2daadce1-a9b8-5d56-b831-d952e6d43150", "toId": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_id": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_name": "Melofee", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.261Z", "created_at": "2026-09-26T05:35:30.511Z", "modified": "2026-09-26T05:35:30.694Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:35:30.694Z" }, "description_available": false, "entity_type": "indicates", "fromId": "f7f8f4c3-42b1-433b-a4ab-f67c83968004", "from_id": "f7f8f4c3-42b1-433b-a4ab-f67c83968004", "from_name": null, "from_type": "Indicator", "id": "ac434d15-af17-44d6-9a49-0bf968e9766e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--372afc96-519e-50c9-8cf0-0b0326fcb291", "toId": "657ff382-024b-45a4-974a-3e41f1762074", "to_id": "657ff382-024b-45a4-974a-3e41f1762074", "to_name": "Cobalt Strike - S0154", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.321Z", "created_at": "2026-09-26T05:36:52.625Z", "modified": "2026-09-26T05:36:53.023Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:36:53.023Z" }, "description_available": false, "entity_type": "indicates", "fromId": "b2490479-1c8f-4288-a8e1-23589e1535cf", "from_id": "b2490479-1c8f-4288-a8e1-23589e1535cf", "from_name": null, "from_type": "Indicator", "id": "ac7f353a-4332-44bc-b26f-80a0a4083473", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--15344c8c-e4fd-5012-bb80-1e3dd7e17fa0", "toId": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_id": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_name": "PlugX - S0013", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.290Z", "created_at": "2026-09-26T06:02:21.773Z", "modified": "2026-09-26T06:02:22.160Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:02:22.160Z" }, "description_available": false, "entity_type": "indicates", "fromId": "3b95a828-10fe-4895-a5fa-606043535451", "from_id": "3b95a828-10fe-4895-a5fa-606043535451", "from_name": null, "from_type": "Indicator", "id": "acb32474-67a8-4dfa-8003-3d2187a2f0a3", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--48974241-bb60-5bba-99b5-555f543f4dd0", "toId": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_id": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_name": "HelloBot", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.285Z", "created_at": "2026-09-26T05:36:01.730Z", "modified": "2026-09-26T05:36:01.963Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:36:01.963Z" }, "description_available": false, "entity_type": "indicates", "fromId": "48f22366-f0fd-4667-b458-fc531795e8ff", "from_id": "48f22366-f0fd-4667-b458-fc531795e8ff", "from_name": null, "from_type": "Indicator", "id": "acf9607f-66fb-49b5-bc3f-91d15c39894b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--f80089e9-adf8-5f5f-9035-2a3a14b19d4c", "toId": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_id": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_name": "RatelS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.682Z", "created_at": "2026-09-26T05:46:41.882Z", "modified": "2026-09-26T05:46:42.061Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:46:42.061Z" }, "description_available": false, "entity_type": "indicates", "fromId": "157ca5cb-7d34-4fc3-83d2-bac13ceb9804", "from_id": "157ca5cb-7d34-4fc3-83d2-bac13ceb9804", "from_name": null, "from_type": "Indicator", "id": "ad2a70ca-8cd6-4390-9362-fb72b7387c1a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--80b8a9f4-954f-5439-adc6-7b9d31c60684", "toId": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_id": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_name": "RatelS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.451Z", "created_at": "2026-09-26T06:06:46.253Z", "modified": "2026-09-26T06:06:46.545Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:06:46.545Z" }, "description_available": false, "entity_type": "indicates", "fromId": "5330b1c5-bebb-4760-ae47-12dd0e0d1e23", "from_id": "5330b1c5-bebb-4760-ae47-12dd0e0d1e23", "from_name": null, "from_type": "Indicator", "id": "ad4a45ab-e4c2-4ff9-a29c-b1e94867ba3a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--aed97c07-65e2-5f76-b699-6798af3d22c9", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.115Z", "created_at": "2026-09-26T05:35:03.838Z", "modified": "2026-09-26T05:35:04.288Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:35:04.288Z" }, "description_available": false, "entity_type": "based-on", "fromId": "ea8ff45b-69d1-4069-bebe-6f7107045959", "from_id": "ea8ff45b-69d1-4069-bebe-6f7107045959", "from_name": null, "from_type": "Indicator", "id": "ad6738a4-f8dd-438d-9f01-d1877461514a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--65d3fa4e-bcc1-545d-a23a-257839a9a92b", "toId": "c75f6906-a6e4-4a6f-bedb-eb506639f40f", "to_id": "c75f6906-a6e4-4a6f-bedb-eb506639f40f", "to_name": null, "to_type": "IPv4Addr" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.803Z", "created_at": "2026-09-26T05:49:44.647Z", "modified": "2026-09-26T05:49:44.835Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:49:44.835Z" }, "description_available": false, "entity_type": "indicates", "fromId": "2227cc4b-afc7-4060-b897-a1a458d90abd", "from_id": "2227cc4b-afc7-4060-b897-a1a458d90abd", "from_name": null, "from_type": "Indicator", "id": "adbefe87-39f1-468d-8bd7-ca6fddc89a1e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--2c535828-0350-52a0-856a-cf08bc8181b2", "toId": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_id": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_name": "PlugX - S0013", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.722Z", "created_at": "2026-09-26T05:47:40.587Z", "modified": "2026-09-26T05:47:40.882Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:47:40.882Z" }, "description_available": false, "entity_type": "indicates", "fromId": "de51cd6f-4b7a-4c4b-9b3d-d5094f650356", "from_id": "de51cd6f-4b7a-4c4b-9b3d-d5094f650356", "from_name": null, "from_type": "Indicator", "id": "add0adcd-d066-4354-aeab-204220d5b18a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--3a41d51f-927b-5aef-8e21-8c76866cd3ac", "toId": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_id": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_name": "STOWAWAY", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.908Z", "created_at": "2026-09-26T05:53:02.626Z", "modified": "2026-09-26T05:53:02.759Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:53:02.759Z" }, "description_available": false, "entity_type": "indicates", "fromId": "fdaa0a79-121c-4e17-91bb-e23da88da18e", "from_id": "fdaa0a79-121c-4e17-91bb-e23da88da18e", "from_name": null, "from_type": "Indicator", "id": "adf07070-7ae9-457f-977f-728029311b35", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--e9fdacdd-eccc-52a2-be45-571ce10853ad", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.211Z", "created_at": "2026-09-26T06:00:23.659Z", "modified": "2026-09-26T06:00:24.121Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:00:24.121Z" }, "description_available": false, "entity_type": "indicates", "fromId": "f0b6cabc-d961-4c2b-a9a0-4075ac17972c", "from_id": "f0b6cabc-d961-4c2b-a9a0-4075ac17972c", "from_name": null, "from_type": "Indicator", "id": "ae82c7a0-87a4-4f66-861d-6c2d31a69bf6", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--12e7e999-97af-573c-b34f-8844f6fa842f", "toId": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_id": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_name": "RatelS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.766Z", "created_at": "2026-09-26T05:48:49.557Z", "modified": "2026-09-26T05:48:49.978Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:48:49.978Z" }, "description_available": false, "entity_type": "indicates", "fromId": "1a15e67e-da7b-42ec-b24a-d47fd8aa0767", "from_id": "1a15e67e-da7b-42ec-b24a-d47fd8aa0767", "from_name": null, "from_type": "Indicator", "id": "aeb1c398-4ee8-468d-8b38-49a3bd9966cd", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--c2d3ea95-241d-5e7d-bc37-c9d3b668a9e2", "toId": "208a45aa-c18e-4619-9a90-7004849cab40", "to_id": "208a45aa-c18e-4619-9a90-7004849cab40", "to_name": "HemiGate", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.083Z", "created_at": "2026-09-26T05:34:55.034Z", "modified": "2026-09-26T05:34:55.428Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:34:55.428Z" }, "description_available": false, "entity_type": "based-on", "fromId": "8134c07a-eec8-489c-80e7-aca40ccc6268", "from_id": "8134c07a-eec8-489c-80e7-aca40ccc6268", "from_name": null, "from_type": "Indicator", "id": "af34bc27-84a7-4273-9e5d-c8cf2eef8d5d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--9894e865-591c-5dfa-b8de-66cadb3a1127", "toId": "f9498165-6ce4-46a4-ad53-6692e3059b2e", "to_id": "f9498165-6ce4-46a4-ad53-6692e3059b2e", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.853Z", "created_at": "2026-09-26T05:52:15.101Z", "modified": "2026-09-26T05:52:15.283Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:52:15.283Z" }, "description_available": false, "entity_type": "indicates", "fromId": "6ae45569-c03b-471f-80ff-50d7a804075a", "from_id": "6ae45569-c03b-471f-80ff-50d7a804075a", "from_name": null, "from_type": "Indicator", "id": "afeb8196-c200-4a56-ae00-c2aafe6f32f0", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--13ff21bb-5b37-5af9-a168-2cf05567f9d8", "toId": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_id": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_name": "CrowDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.284Z", "created_at": "2026-09-26T05:36:10.823Z", "modified": "2026-09-26T05:36:11.006Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:36:11.006Z" }, "description_available": false, "entity_type": "indicates", "fromId": "48f22366-f0fd-4667-b458-fc531795e8ff", "from_id": "48f22366-f0fd-4667-b458-fc531795e8ff", "from_name": null, "from_type": "Indicator", "id": "b04ab6b5-c0f2-48cb-bcc8-b7d570463a67", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--56cb8618-d94d-57ab-827c-ff944b1876c8", "toId": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_id": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_name": "TernDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.542Z", "created_at": "2026-09-26T06:08:55.886Z", "modified": "2026-09-26T06:08:56.256Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:08:56.256Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c9493e20-dc6a-4938-8fee-746005c4ae07", "from_id": "c9493e20-dc6a-4938-8fee-746005c4ae07", "from_name": null, "from_type": "Indicator", "id": "b04dd0e3-40a0-40aa-aa3f-52674d873958", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--c3ab90ba-71b5-59be-9dd0-158b2f7f1193", "toId": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_id": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_name": "PlugX - S0013", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.781Z", "created_at": "2026-09-26T05:49:16.466Z", "modified": "2026-09-26T05:49:18.098Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:49:18.098Z" }, "description_available": false, "entity_type": "indicates", "fromId": "8134c07a-eec8-489c-80e7-aca40ccc6268", "from_id": "8134c07a-eec8-489c-80e7-aca40ccc6268", "from_name": null, "from_type": "Indicator", "id": "b08a902a-046d-406a-a668-1b23bbbe0da7", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--44d0538e-7013-5b81-a9f1-bd14224a819d", "toId": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_id": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_name": "PlugX - S0013", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.809Z", "created_at": "2026-09-26T05:49:50.918Z", "modified": "2026-09-26T05:49:51.159Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:49:51.159Z" }, "description_available": false, "entity_type": "indicates", "fromId": "2227cc4b-afc7-4060-b897-a1a458d90abd", "from_id": "2227cc4b-afc7-4060-b897-a1a458d90abd", "from_name": null, "from_type": "Indicator", "id": "b1025217-87b4-4f32-af8f-8ea962d923ea", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--ffdd21f4-ad77-5840-a289-e8421cfcec50", "toId": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_id": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_name": "CrowDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.433Z", "created_at": "2026-09-26T06:06:27.370Z", "modified": "2026-09-26T06:06:27.507Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:06:27.507Z" }, "description_available": false, "entity_type": "indicates", "fromId": "313c8419-28b4-4ef9-9855-91d315819bf8", "from_id": "313c8419-28b4-4ef9-9855-91d315819bf8", "from_name": null, "from_type": "Indicator", "id": "b11441b4-71a2-44ed-a324-c919bc382aba", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--109164a2-f6ab-59dc-8c79-c06cbf45d958", "toId": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_id": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_name": "Spark - S0543", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.563Z", "created_at": "2026-09-26T06:10:46.436Z", "modified": "2026-09-26T06:10:46.790Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:10:46.790Z" }, "description_available": false, "entity_type": "indicates", "fromId": "6ac03fc4-4c10-4d8f-b546-7ce2b9422c39", "from_id": "6ac03fc4-4c10-4d8f-b546-7ce2b9422c39", "from_name": null, "from_type": "Indicator", "id": "b134a9b5-1c62-43cd-9fcc-f43bae72f362", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--8130d862-206a-5d3d-bf32-ddc7f2215d55", "toId": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_id": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_name": "Melofee", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.462Z", "created_at": "2026-09-26T05:41:06.885Z", "modified": "2026-09-26T05:41:07.289Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:41:07.289Z" }, "description_available": false, "entity_type": "indicates", "fromId": "4ff9e994-0564-43c3-8240-004f20eb7d3f", "from_id": "4ff9e994-0564-43c3-8240-004f20eb7d3f", "from_name": null, "from_type": "Indicator", "id": "b16be592-8962-4552-8b11-1360bc1eb0bc", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--c8ebbdb5-4109-5ccb-9534-23c9c3f9fa8a", "toId": "208a45aa-c18e-4619-9a90-7004849cab40", "to_id": "208a45aa-c18e-4619-9a90-7004849cab40", "to_name": "HemiGate", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.721Z", "created_at": "2026-09-26T05:47:39.883Z", "modified": "2026-09-26T05:47:40.355Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:47:40.355Z" }, "description_available": false, "entity_type": "indicates", "fromId": "de51cd6f-4b7a-4c4b-9b3d-d5094f650356", "from_id": "de51cd6f-4b7a-4c4b-9b3d-d5094f650356", "from_name": null, "from_type": "Indicator", "id": "b18858e1-aa8a-4a5a-9bd8-d77072117e4e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--ba4f80a1-8c01-5262-bd42-92c2741ac798", "toId": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_id": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_name": "Spark - S0543", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.209Z", "created_at": "2026-09-26T05:35:12.505Z", "modified": "2026-09-26T05:35:13.011Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:35:13.011Z" }, "description_available": false, "entity_type": "based-on", "fromId": "2c0b3e29-5bb5-4044-8031-4f47cd51a008", "from_id": "2c0b3e29-5bb5-4044-8031-4f47cd51a008", "from_name": null, "from_type": "Indicator", "id": "b1de04c1-cd29-49ff-a107-16415414eccd", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--83f3faf8-0e8c-578d-8817-1e91d89be4f9", "toId": "38a810da-9fd2-4970-952c-20d833c93f6d", "to_id": "38a810da-9fd2-4970-952c-20d833c93f6d", "to_name": null, "to_type": "IPv4Addr" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.388Z", "created_at": "2026-09-26T05:39:32.270Z", "modified": "2026-09-26T05:39:34.003Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:39:34.003Z" }, "description_available": false, "entity_type": "indicates", "fromId": "8c1b4518-8219-46bb-a619-1c69182e4eec", "from_id": "8c1b4518-8219-46bb-a619-1c69182e4eec", "from_name": null, "from_type": "Indicator", "id": "b2552edb-5f1f-438b-9b78-4270289148b1", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--9eba72ca-2952-585e-ba47-45c4ce4697d9", "toId": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_id": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_name": "HelloBot", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.631Z", "created_at": "2026-09-26T05:45:38.833Z", "modified": "2026-09-26T05:45:39.045Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:45:39.045Z" }, "description_available": false, "entity_type": "indicates", "fromId": "cdadaaa5-0866-4957-b6d7-c64be31a1cf9", "from_id": "cdadaaa5-0866-4957-b6d7-c64be31a1cf9", "from_name": null, "from_type": "Indicator", "id": "b3110b4a-e4b4-454c-8f5d-70a0faf6e9af", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--1c6c554b-e7e0-5fe4-9a97-a5345e8bc0c0", "toId": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_id": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_name": "HelloBot", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.097Z", "created_at": "2026-09-26T05:58:30.427Z", "modified": "2026-09-26T05:58:30.589Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:58:30.589Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d7f88a85-9ab3-45b8-982b-294d838461a6", "from_id": "d7f88a85-9ab3-45b8-982b-294d838461a6", "from_name": null, "from_type": "Indicator", "id": "b336f093-ef32-422e-b45f-70c520e8edad", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--adf74858-3257-5c59-885d-e799a74e1b05", "toId": "657ff382-024b-45a4-974a-3e41f1762074", "to_id": "657ff382-024b-45a4-974a-3e41f1762074", "to_name": "Cobalt Strike - S0154", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.569Z", "created_at": "2026-09-26T06:10:56.322Z", "modified": "2026-09-26T06:10:56.505Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:10:56.505Z" }, "description_available": false, "entity_type": "indicates", "fromId": "6ac03fc4-4c10-4d8f-b546-7ce2b9422c39", "from_id": "6ac03fc4-4c10-4d8f-b546-7ce2b9422c39", "from_name": null, "from_type": "Indicator", "id": "b379ebec-79f0-46f8-ae74-c81effb87dc6", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--26a05c7b-e1f6-5ef8-afd6-8b26257efbc0", "toId": "657ff382-024b-45a4-974a-3e41f1762074", "to_id": "657ff382-024b-45a4-974a-3e41f1762074", "to_name": "Cobalt Strike - S0154", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.843Z", "created_at": "2026-09-26T05:52:07.658Z", "modified": "2026-09-26T05:52:08.158Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:52:08.158Z" }, "description_available": false, "entity_type": "indicates", "fromId": "6ae45569-c03b-471f-80ff-50d7a804075a", "from_id": "6ae45569-c03b-471f-80ff-50d7a804075a", "from_name": null, "from_type": "Indicator", "id": "b3c616c4-e77f-4f3b-8aeb-f8aca90d4c91", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--a67993d4-6fa0-5d3c-aa93-4cdc26acba58", "toId": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_id": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_name": "Melofee", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.021Z", "created_at": "2026-09-26T05:55:23.689Z", "modified": "2026-09-26T05:55:24.069Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:55:24.069Z" }, "description_available": false, "entity_type": "indicates", "fromId": "cd0c196b-8e17-4794-80e8-7129d42950e2", "from_id": "cd0c196b-8e17-4794-80e8-7129d42950e2", "from_name": null, "from_type": "Indicator", "id": "b3fd7437-35cf-4d8a-99ba-4bbb5738217d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--70e78605-1500-5c2f-bdd8-77c15218aa91", "toId": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_id": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_name": "HelloBot", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.779Z", "created_at": "2026-09-26T05:49:09.674Z", "modified": "2026-09-26T05:49:10.030Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:49:10.030Z" }, "description_available": false, "entity_type": "indicates", "fromId": "8134c07a-eec8-489c-80e7-aca40ccc6268", "from_id": "8134c07a-eec8-489c-80e7-aca40ccc6268", "from_name": null, "from_type": "Indicator", "id": "b40634aa-0953-4c1e-a700-6fe9542df602", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--1f847af5-a720-546d-ab8c-054b77f9d591", "toId": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_id": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_name": "Melofee", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.809Z", "created_at": "2026-09-26T05:49:51.456Z", "modified": "2026-09-26T05:49:53.021Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:49:53.021Z" }, "description_available": false, "entity_type": "indicates", "fromId": "2227cc4b-afc7-4060-b897-a1a458d90abd", "from_id": "2227cc4b-afc7-4060-b897-a1a458d90abd", "from_name": null, "from_type": "Indicator", "id": "b4c8f3c8-b990-486e-a7ab-ac08e197b425", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--663a3771-adc8-5fee-a24f-f6adf32e12cd", "toId": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_id": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_name": "TernDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.618Z", "created_at": "2026-09-26T05:45:24.760Z", "modified": "2026-09-26T05:45:25.205Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:45:25.205Z" }, "description_available": false, "entity_type": "indicates", "fromId": "3be1760f-af98-4d5c-80e2-c0338b71f391", "from_id": "3be1760f-af98-4d5c-80e2-c0338b71f391", "from_name": null, "from_type": "Indicator", "id": "b4f08bbd-b5cc-49d5-9d7f-cff672e454ce", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--365efeca-05b1-5ecb-a644-69ed09ecfde4", "toId": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_id": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_name": "RatelS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.204Z", "created_at": "2026-09-26T05:35:10.693Z", "modified": "2026-09-26T05:35:12.553Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:35:12.553Z" }, "description_available": false, "entity_type": "based-on", "fromId": "aaf834aa-275b-4a6a-9790-6971e8adf52d", "from_id": "aaf834aa-275b-4a6a-9790-6971e8adf52d", "from_name": null, "from_type": "Indicator", "id": "b5c3666c-3c89-45d2-9ac3-060c98e52a03", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--38267911-7e7a-5ad1-9b82-3f47fcac9d1a", "toId": "3b17245e-fd0a-4e60-aca2-694cccd39c6d", "to_id": "3b17245e-fd0a-4e60-aca2-694cccd39c6d", "to_name": null, "to_type": "IPv4Addr" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.197Z", "created_at": "2026-09-26T05:59:58.432Z", "modified": "2026-09-26T05:59:58.699Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:59:58.699Z" }, "description_available": false, "entity_type": "indicates", "fromId": "f0b6cabc-d961-4c2b-a9a0-4075ac17972c", "from_id": "f0b6cabc-d961-4c2b-a9a0-4075ac17972c", "from_name": null, "from_type": "Indicator", "id": "b5ce6be3-1d11-48eb-b190-275c30ce293d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--13d53c65-940e-5816-808a-925e45eb62a8", "toId": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_id": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_name": "Melofee", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.963Z", "created_at": "2026-09-26T05:54:04.756Z", "modified": "2026-09-26T05:54:04.897Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:54:04.897Z" }, "description_available": false, "entity_type": "indicates", "fromId": "2497f466-fac3-4bfc-ab1f-5ebcf363283b", "from_id": "2497f466-fac3-4bfc-ab1f-5ebcf363283b", "from_name": null, "from_type": "Indicator", "id": "b5ecb867-4518-4fe4-b670-68b7c024c46b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--71578d0a-2a9d-5d31-b7e9-004f3ddbdab2", "toId": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_id": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_name": "TernDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.252Z", "created_at": "2026-09-26T06:01:24.393Z", "modified": "2026-09-26T06:01:25.021Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:01:25.021Z" }, "description_available": false, "entity_type": "indicates", "fromId": "09acd2d3-2afb-4de1-a147-7ae7904d3859", "from_id": "09acd2d3-2afb-4de1-a147-7ae7904d3859", "from_name": null, "from_type": "Indicator", "id": "b6748e36-c250-42f7-8cae-84a757433745", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--c76bda5a-7cde-517b-b891-88700ed81c50", "toId": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_id": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_name": "Spark - S0543", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.572Z", "created_at": "2026-09-26T06:10:58.080Z", "modified": "2026-09-26T06:10:58.249Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:10:58.249Z" }, "description_available": false, "entity_type": "indicates", "fromId": "6ac03fc4-4c10-4d8f-b546-7ce2b9422c39", "from_id": "6ac03fc4-4c10-4d8f-b546-7ce2b9422c39", "from_name": null, "from_type": "Indicator", "id": "b696d227-8f68-4ff9-a15c-ef905cd7cbd4", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--fec5f6b4-937e-59c1-b965-c22cf03d2fd8", "toId": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_id": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_name": "RatelS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.200Z", "created_at": "2026-09-26T05:35:07.017Z", "modified": "2026-09-26T05:35:09.318Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:35:09.318Z" }, "description_available": false, "entity_type": "based-on", "fromId": "350ff6fa-1c04-4870-b345-041e0d3d6d92", "from_id": "350ff6fa-1c04-4870-b345-041e0d3d6d92", "from_name": null, "from_type": "Indicator", "id": "b6affee3-c3a6-4d36-ac05-46f29836fdf6", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--46dc27c7-0a19-5388-9ed0-877f25066328", "toId": "127cff7a-eff6-40a6-a2f5-c5160ba6006e", "to_id": "127cff7a-eff6-40a6-a2f5-c5160ba6006e", "to_name": null, "to_type": "IPv4Addr" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.358Z", "created_at": "2026-09-26T06:04:43.733Z", "modified": "2026-09-26T06:04:44.131Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:04:44.131Z" }, "description_available": false, "entity_type": "indicates", "fromId": "3c2ca4de-2c25-4802-a582-ebf285060ed9", "from_id": "3c2ca4de-2c25-4802-a582-ebf285060ed9", "from_name": null, "from_type": "Indicator", "id": "b724a672-a8c6-41fa-a799-194112988ee0", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--16ce2c52-46ea-599f-b524-a81e3199bc98", "toId": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_id": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_name": "Melofee", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.854Z", "created_at": "2026-09-26T05:52:15.731Z", "modified": "2026-09-26T05:52:15.892Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:52:15.892Z" }, "description_available": false, "entity_type": "indicates", "fromId": "6ae45569-c03b-471f-80ff-50d7a804075a", "from_id": "6ae45569-c03b-471f-80ff-50d7a804075a", "from_name": null, "from_type": "Indicator", "id": "b8337579-8108-416a-9a3b-c946d2e5ec83", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--66791091-87bc-55d0-a232-acca151a8531", "toId": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_id": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_name": "TernDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.543Z", "created_at": "2026-09-26T05:42:55.228Z", "modified": "2026-09-26T05:42:55.503Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:42:55.503Z" }, "description_available": false, "entity_type": "indicates", "fromId": "653baf3a-7205-44e8-bf30-e40825fbf42a", "from_id": "653baf3a-7205-44e8-bf30-e40825fbf42a", "from_name": null, "from_type": "Indicator", "id": "b8688787-e135-492f-8adc-77a66bd189d1", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--7b67f9ff-1fbd-5ba2-8997-4f67c899a9ae", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.736Z", "created_at": "2026-09-26T05:48:07.574Z", "modified": "2026-09-26T05:48:07.837Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:48:07.837Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ce5e270a-a0f5-4d07-9faf-6493364c1a2b", "from_id": "ce5e270a-a0f5-4d07-9faf-6493364c1a2b", "from_name": null, "from_type": "Indicator", "id": "b87bb790-1e04-46fd-928d-e81012fcbfb8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--db526833-b5d2-5997-abe1-ae1a81ff89cf", "toId": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_id": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_name": "Melofee", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.312Z", "created_at": "2026-09-26T06:02:50.433Z", "modified": "2026-09-26T06:02:50.733Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:02:50.733Z" }, "description_available": false, "entity_type": "indicates", "fromId": "6fbf4d94-634a-4763-b0e5-0cbe6e9f67ea", "from_id": "6fbf4d94-634a-4763-b0e5-0cbe6e9f67ea", "from_name": null, "from_type": "Indicator", "id": "b8c55d52-1ed6-41c8-ad4a-0d80c392a4dc", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--bcf5bfc5-a494-54ac-b04b-140d7b49e5e0", "toId": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_id": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_name": "PlugX - S0013", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.907Z", "created_at": "2026-09-26T05:53:00.637Z", "modified": "2026-09-26T05:53:01.004Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:53:01.004Z" }, "description_available": false, "entity_type": "indicates", "fromId": "fdaa0a79-121c-4e17-91bb-e23da88da18e", "from_id": "fdaa0a79-121c-4e17-91bb-e23da88da18e", "from_name": null, "from_type": "Indicator", "id": "b994c6b4-f3a9-4e17-8181-61365ea56e2c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--0e1a4875-8dbb-5f34-961b-e1f13901e3c5", "toId": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_id": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_name": "Melofee", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.983Z", "created_at": "2026-09-26T05:54:31.336Z", "modified": "2026-09-26T05:54:31.719Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:54:31.719Z" }, "description_available": false, "entity_type": "indicates", "fromId": "2d8df4da-244f-458a-8c2d-ff67380121e9", "from_id": "2d8df4da-244f-458a-8c2d-ff67380121e9", "from_name": null, "from_type": "Indicator", "id": "ba1588cb-3e06-47eb-bb01-e7a6451f761c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--b6a2dd61-a63c-566c-86bf-48219c7091a6", "toId": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_id": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_name": "STOWAWAY", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.365Z", "created_at": "2026-09-26T06:04:56.656Z", "modified": "2026-09-26T06:04:56.816Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:04:56.816Z" }, "description_available": false, "entity_type": "indicates", "fromId": "3c2ca4de-2c25-4802-a582-ebf285060ed9", "from_id": "3c2ca4de-2c25-4802-a582-ebf285060ed9", "from_name": null, "from_type": "Indicator", "id": "ba9f37fc-07cc-4b59-9755-9811c2e944a3", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--dfdf530d-08bc-5df0-8962-8110de7a7355", "toId": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_id": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_name": "STOWAWAY", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.342Z", "created_at": "2026-09-26T06:04:27.241Z", "modified": "2026-09-26T06:04:27.466Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:04:27.466Z" }, "description_available": false, "entity_type": "indicates", "fromId": "95ef732a-5859-4b75-a4ea-fd3cfe3f1618", "from_id": "95ef732a-5859-4b75-a4ea-fd3cfe3f1618", "from_name": null, "from_type": "Indicator", "id": "bab4e756-8b05-45b7-9996-73c31858976b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--417db505-42a0-57b6-9b9a-8deeb292354f", "toId": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_id": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_name": "Spark - S0543", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.702Z", "created_at": "2026-09-26T05:47:09.272Z", "modified": "2026-09-26T05:47:09.451Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:47:09.451Z" }, "description_available": false, "entity_type": "indicates", "fromId": "a7a198b8-f0a3-4221-b768-191720f061b9", "from_id": "a7a198b8-f0a3-4221-b768-191720f061b9", "from_name": null, "from_type": "Indicator", "id": "bb207e15-6b91-4a21-951b-f0cd2bfbf9ea", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--6d6e4048-d822-55f1-a412-9ab3bfd2c226", "toId": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_id": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_name": "TernDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.529Z", "created_at": "2026-09-26T05:42:33.534Z", "modified": "2026-09-26T05:42:33.671Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:42:33.671Z" }, "description_available": false, "entity_type": "indicates", "fromId": "0eb188e3-885e-4084-abdf-6d4ba0098e64", "from_id": "0eb188e3-885e-4084-abdf-6d4ba0098e64", "from_name": null, "from_type": "Indicator", "id": "bb330b17-3f6c-41f3-a5e2-8a1cc692ef40", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--0563b0c1-fbd4-5bdd-9ad9-e9a9e8bfc4c1", "toId": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_id": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_name": "TernDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.318Z", "created_at": "2026-09-26T06:03:46.093Z", "modified": "2026-09-26T06:03:49.470Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:03:49.470Z" }, "description_available": false, "entity_type": "indicates", "fromId": "6fbf4d94-634a-4763-b0e5-0cbe6e9f67ea", "from_id": "6fbf4d94-634a-4763-b0e5-0cbe6e9f67ea", "from_name": null, "from_type": "Indicator", "id": "bb64dc16-f6e2-44ef-bf73-fe6276b8dad9", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--4176256f-c278-5728-9e42-ba56a95a342d", "toId": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_id": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_name": "CrowDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.760Z", "created_at": "2026-09-26T05:48:44.919Z", "modified": "2026-09-26T05:48:45.227Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:48:45.227Z" }, "description_available": false, "entity_type": "indicates", "fromId": "1a15e67e-da7b-42ec-b24a-d47fd8aa0767", "from_id": "1a15e67e-da7b-42ec-b24a-d47fd8aa0767", "from_name": null, "from_type": "Indicator", "id": "bba2ebb5-25da-4b9d-85fa-b0ab8d822f8a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--237c73ef-284a-5476-b1c3-5000ffbbe3ca", "toId": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_id": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_name": "PlugX - S0013", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.916Z", "created_at": "2026-09-26T05:53:07.678Z", "modified": "2026-09-26T05:53:07.910Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:53:07.910Z" }, "description_available": false, "entity_type": "indicates", "fromId": "fdaa0a79-121c-4e17-91bb-e23da88da18e", "from_id": "fdaa0a79-121c-4e17-91bb-e23da88da18e", "from_name": null, "from_type": "Indicator", "id": "bc13462e-d235-4b1f-9dc6-a5c31380c606", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--86950ac6-eea9-552e-b76e-01090f3e8427", "toId": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_id": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_name": "STOWAWAY", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.957Z", "created_at": "2026-09-26T05:53:57.981Z", "modified": "2026-09-26T05:53:58.145Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:53:58.145Z" }, "description_available": false, "entity_type": "indicates", "fromId": "2497f466-fac3-4bfc-ab1f-5ebcf363283b", "from_id": "2497f466-fac3-4bfc-ab1f-5ebcf363283b", "from_name": null, "from_type": "Indicator", "id": "bc21f710-48bf-4ecd-bba9-a085149c5b3b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--1b0d0337-093a-5956-a346-38e9c3db6846", "toId": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_id": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_name": "PlugX - S0013", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.565Z", "created_at": "2026-09-26T05:43:22.918Z", "modified": "2026-09-26T05:43:23.332Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:43:23.332Z" }, "description_available": false, "entity_type": "indicates", "fromId": "b5ad9feb-b128-47fb-9914-8319d0f48229", "from_id": "b5ad9feb-b128-47fb-9914-8319d0f48229", "from_name": null, "from_type": "Indicator", "id": "bc9434b3-ce76-4940-be6a-278618f6ac75", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--5b90f172-a892-5001-9261-860a682baa09", "toId": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_id": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_name": "HelloBot", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.502Z", "created_at": "2026-09-26T06:07:52.880Z", "modified": "2026-09-26T06:07:54.083Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:07:54.083Z" }, "description_available": false, "entity_type": "indicates", "fromId": "781e0e33-439f-46a6-b565-9c9e6287a0ff", "from_id": "781e0e33-439f-46a6-b565-9c9e6287a0ff", "from_name": null, "from_type": "Indicator", "id": "bcc8d34f-ca4c-447d-a344-de9cd74eaedc", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--3e6a5c52-7be1-538f-9019-3d32eac63401", "toId": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_id": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_name": "Spark - S0543", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.984Z", "created_at": "2026-09-26T05:54:49.426Z", "modified": "2026-09-26T05:54:49.789Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:54:49.789Z" }, "description_available": false, "entity_type": "indicates", "fromId": "2d8df4da-244f-458a-8c2d-ff67380121e9", "from_id": "2d8df4da-244f-458a-8c2d-ff67380121e9", "from_name": null, "from_type": "Indicator", "id": "bd6f1785-6223-4905-808e-84cf1c10168b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--0dcc9257-cc41-577f-bc71-a494f6495fa0", "toId": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_id": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_name": "CrowDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.255Z", "created_at": "2026-09-26T05:35:26.258Z", "modified": "2026-09-26T05:35:29.266Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:35:29.266Z" }, "description_available": false, "entity_type": "indicates", "fromId": "f7f8f4c3-42b1-433b-a4ab-f67c83968004", "from_id": "f7f8f4c3-42b1-433b-a4ab-f67c83968004", "from_name": null, "from_type": "Indicator", "id": "bdc8474d-e93a-4e62-94df-97511817df47", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--f59ec457-5562-5347-abed-1ece5bcf08fa", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.209Z", "created_at": "2026-09-26T06:00:18.953Z", "modified": "2026-09-26T06:00:19.119Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:00:19.119Z" }, "description_available": false, "entity_type": "indicates", "fromId": "f0b6cabc-d961-4c2b-a9a0-4075ac17972c", "from_id": "f0b6cabc-d961-4c2b-a9a0-4075ac17972c", "from_name": null, "from_type": "Indicator", "id": "be9413d7-a595-4b12-9409-c4c0c30049d9", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--1e26d5b0-af1a-5f87-81e0-905b6f13640c", "toId": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_id": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_name": "TernDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.570Z", "created_at": "2026-09-26T06:11:03.327Z", "modified": "2026-09-26T06:11:03.517Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:11:03.517Z" }, "description_available": false, "entity_type": "indicates", "fromId": "6ac03fc4-4c10-4d8f-b546-7ce2b9422c39", "from_id": "6ac03fc4-4c10-4d8f-b546-7ce2b9422c39", "from_name": null, "from_type": "Indicator", "id": "bec65af8-ce83-49c2-86a1-0c32b951f60c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--ffe8d0b9-a7c7-56dc-ad66-b974ca5c7471", "toId": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_id": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_name": "CrowDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.890Z", "created_at": "2026-09-26T05:52:40.935Z", "modified": "2026-09-26T05:52:41.234Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:52:41.234Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c77e0b5e-a168-4a6f-993c-bc7076c78285", "from_id": "c77e0b5e-a168-4a6f-993c-bc7076c78285", "from_name": null, "from_type": "Indicator", "id": "bf6309b5-3c17-4178-950a-22f16ee5654b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--a85cd96c-8d2e-5d3c-9e68-ee898747ae6b", "toId": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_id": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_name": "STOWAWAY", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.032Z", "created_at": "2026-09-26T05:34:43.736Z", "modified": "2026-09-26T05:34:44.161Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:34:44.161Z" }, "description_available": false, "entity_type": "based-on", "fromId": "01c74684-bdd9-45d1-84be-d24d189bcb28", "from_id": "01c74684-bdd9-45d1-84be-d24d189bcb28", "from_name": null, "from_type": "Indicator", "id": "bf6b3e7d-6dee-4c97-9105-fe1330d67287", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--3a0e77fa-6ba6-58c9-bab3-87ba9444b47b", "toId": "38bd1e2c-7b42-420b-9c2b-9b6d47e262a9", "to_id": "38bd1e2c-7b42-420b-9c2b-9b6d47e262a9", "to_name": null, "to_type": "IPv4Addr" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.483Z", "created_at": "2026-09-26T05:41:36.153Z", "modified": "2026-09-26T05:41:36.634Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:41:36.634Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c2dcc828-9ae2-404f-a201-0074f26085ba", "from_id": "c2dcc828-9ae2-404f-a201-0074f26085ba", "from_name": null, "from_type": "Indicator", "id": "c05efb1c-9f89-4427-ae0b-bfaeae47f2f9", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--709dcf9f-2a0a-5e4f-852f-d0766d968707", "toId": "657ff382-024b-45a4-974a-3e41f1762074", "to_id": "657ff382-024b-45a4-974a-3e41f1762074", "to_name": "Cobalt Strike - S0154", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.247Z", "created_at": "2026-09-26T06:01:20.059Z", "modified": "2026-09-26T06:01:20.390Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:01:20.390Z" }, "description_available": false, "entity_type": "indicates", "fromId": "09acd2d3-2afb-4de1-a147-7ae7904d3859", "from_id": "09acd2d3-2afb-4de1-a147-7ae7904d3859", "from_name": null, "from_type": "Indicator", "id": "c0c4c459-875d-4255-9872-80c76e2fa31e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--790c90ab-7c78-56ed-a582-3c21484a243b", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.373Z", "created_at": "2026-09-26T05:39:10.380Z", "modified": "2026-09-26T05:39:10.541Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:39:10.541Z" }, "description_available": false, "entity_type": "indicates", "fromId": "eb51ab90-3d38-4f58-84c1-b0700196508c", "from_id": "eb51ab90-3d38-4f58-84c1-b0700196508c", "from_name": null, "from_type": "Indicator", "id": "c1334446-f9c2-46c8-8edf-39baac2a5738", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--afefc9af-1133-5ff9-96aa-83af4cb72cfe", "toId": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_id": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_name": "TernDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.681Z", "created_at": "2026-09-26T05:46:41.153Z", "modified": "2026-09-26T05:46:41.403Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:46:41.403Z" }, "description_available": false, "entity_type": "indicates", "fromId": "157ca5cb-7d34-4fc3-83d2-bac13ceb9804", "from_id": "157ca5cb-7d34-4fc3-83d2-bac13ceb9804", "from_name": null, "from_type": "Indicator", "id": "c17eb1fa-d74e-49c3-88f4-12310d446992", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--675a2d70-4412-56f8-a369-6c0db1b489da", "toId": "208a45aa-c18e-4619-9a90-7004849cab40", "to_id": "208a45aa-c18e-4619-9a90-7004849cab40", "to_name": "HemiGate", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.480Z", "created_at": "2026-09-26T06:07:20.455Z", "modified": "2026-09-26T06:07:20.858Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:07:20.858Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d7d77ca0-8c06-4de9-bacb-a526f344e2e9", "from_id": "d7d77ca0-8c06-4de9-bacb-a526f344e2e9", "from_name": null, "from_type": "Indicator", "id": "c2091067-56b5-49c0-a7ed-1e2f3f2aac68", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--7b40904a-a2db-5070-8b98-1d1ff291a679", "toId": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_id": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_name": "Spark - S0543", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.304Z", "created_at": "2026-09-26T05:36:21.499Z", "modified": "2026-09-26T05:36:21.649Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:36:21.649Z" }, "description_available": false, "entity_type": "indicates", "fromId": "20bc512e-2f63-438d-bcee-abdf39614bf5", "from_id": "20bc512e-2f63-438d-bcee-abdf39614bf5", "from_name": null, "from_type": "Indicator", "id": "c2139442-2050-4b95-b384-0524b793ce2e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--acee037b-66cb-5cef-a4e4-934230be2ac6", "toId": "657ff382-024b-45a4-974a-3e41f1762074", "to_id": "657ff382-024b-45a4-974a-3e41f1762074", "to_name": "Cobalt Strike - S0154", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.253Z", "created_at": "2026-09-26T05:35:19.375Z", "modified": "2026-09-26T05:35:19.838Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:35:19.838Z" }, "description_available": false, "entity_type": "based-on", "fromId": "d5009423-c128-4583-ac72-3f07f1201db6", "from_id": "d5009423-c128-4583-ac72-3f07f1201db6", "from_name": null, "from_type": "Indicator", "id": "c26aeb5b-55a7-4ef4-bdbf-7be783ee5038", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--86819744-dfe2-5097-9717-e07f4c589761", "toId": "9550d260-f7e1-4850-958a-73c46f8d76a7", "to_id": "9550d260-f7e1-4850-958a-73c46f8d76a7", "to_name": null, "to_type": "Hostname" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.482Z", "created_at": "2026-09-26T06:07:35.775Z", "modified": "2026-09-26T06:07:36.367Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:07:36.367Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d7d77ca0-8c06-4de9-bacb-a526f344e2e9", "from_id": "d7d77ca0-8c06-4de9-bacb-a526f344e2e9", "from_name": null, "from_type": "Indicator", "id": "c29fa1fa-4c48-4d52-b6de-311d96a01530", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--bd26ec4a-1a28-58b8-9a2d-818f29d0266b", "toId": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_id": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_name": "CrowDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.617Z", "created_at": "2026-09-26T05:45:21.042Z", "modified": "2026-09-26T05:45:21.563Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:45:21.563Z" }, "description_available": false, "entity_type": "indicates", "fromId": "3be1760f-af98-4d5c-80e2-c0338b71f391", "from_id": "3be1760f-af98-4d5c-80e2-c0338b71f391", "from_name": null, "from_type": "Indicator", "id": "c2a0ab25-59f6-4af6-b2bd-abfeb6bc35f3", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--128b74a1-5dc1-5243-9a8d-9e883c0ff310", "toId": "208a45aa-c18e-4619-9a90-7004849cab40", "to_id": "208a45aa-c18e-4619-9a90-7004849cab40", "to_name": "HemiGate", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.563Z", "created_at": "2026-09-26T06:10:51.462Z", "modified": "2026-09-26T06:10:51.843Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:10:51.843Z" }, "description_available": false, "entity_type": "indicates", "fromId": "6ac03fc4-4c10-4d8f-b546-7ce2b9422c39", "from_id": "6ac03fc4-4c10-4d8f-b546-7ce2b9422c39", "from_name": null, "from_type": "Indicator", "id": "c2f11c43-f115-49b4-83cb-d0c4f47eb177", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--7daaccff-54c5-51c4-9d50-951c953f4f15", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.435Z", "created_at": "2026-09-26T06:06:20.952Z", "modified": "2026-09-26T06:06:21.514Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:06:21.514Z" }, "description_available": false, "entity_type": "indicates", "fromId": "313c8419-28b4-4ef9-9855-91d315819bf8", "from_id": "313c8419-28b4-4ef9-9855-91d315819bf8", "from_name": null, "from_type": "Indicator", "id": "c2fb4cbb-997f-42a9-9e35-d001826be1fc", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--cf65f102-2bd5-5a39-9f4c-b7a06665a8ee", "toId": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_id": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_name": "TernDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.497Z", "created_at": "2026-09-26T06:07:48.827Z", "modified": "2026-09-26T06:07:48.990Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:07:48.990Z" }, "description_available": false, "entity_type": "indicates", "fromId": "781e0e33-439f-46a6-b565-9c9e6287a0ff", "from_id": "781e0e33-439f-46a6-b565-9c9e6287a0ff", "from_name": null, "from_type": "Indicator", "id": "c358e4c8-f333-4991-a825-24c339616b37", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--5ed1b2e8-ca0a-5a35-910f-9c11244d442b", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.028Z", "created_at": "2026-09-26T05:55:31.223Z", "modified": "2026-09-26T05:55:31.398Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:55:31.398Z" }, "description_available": false, "entity_type": "indicates", "fromId": "cd0c196b-8e17-4794-80e8-7129d42950e2", "from_id": "cd0c196b-8e17-4794-80e8-7129d42950e2", "from_name": null, "from_type": "Indicator", "id": "c397402d-061e-4d4f-858d-c2873c6df3e9", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--f54bb9cd-fdd7-5da2-81da-7d69a8358bdf", "toId": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_id": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_name": "TernDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.936Z", "created_at": "2026-09-26T05:53:29.285Z", "modified": "2026-09-26T05:53:29.457Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:53:29.457Z" }, "description_available": false, "entity_type": "indicates", "fromId": "1315ce2a-6659-4f4f-b9b7-e2450564ca9b", "from_id": "1315ce2a-6659-4f4f-b9b7-e2450564ca9b", "from_name": null, "from_type": "Indicator", "id": "c3a2efa2-a2d3-4dc1-82da-b4dfe64b9f8b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--b64d2565-d884-5665-93aa-3c188cb00bb6", "toId": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_id": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_name": "PlugX - S0013", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.459Z", "created_at": "2026-09-26T06:06:58.891Z", "modified": "2026-09-26T06:07:00.154Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:07:00.154Z" }, "description_available": false, "entity_type": "indicates", "fromId": "5330b1c5-bebb-4760-ae47-12dd0e0d1e23", "from_id": "5330b1c5-bebb-4760-ae47-12dd0e0d1e23", "from_name": null, "from_type": "Indicator", "id": "c3c46c2b-5349-4867-9b18-5d841faad4aa", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--d92ce234-3ae8-579e-abd5-6e5cb229916f", "toId": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_id": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_name": "CrowDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.745Z", "created_at": "2026-09-26T05:48:15.509Z", "modified": "2026-09-26T05:48:15.962Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:48:15.962Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ce5e270a-a0f5-4d07-9faf-6493364c1a2b", "from_id": "ce5e270a-a0f5-4d07-9faf-6493364c1a2b", "from_name": null, "from_type": "Indicator", "id": "c447779b-3ea6-402c-a2a7-1f834f989dda", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--b35200da-df02-5251-881c-b4e5df018525", "toId": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_id": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_name": "RatelS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.831Z", "created_at": "2026-09-26T05:51:46.306Z", "modified": "2026-09-26T05:51:46.496Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:51:46.496Z" }, "description_available": false, "entity_type": "indicates", "fromId": "10b221ff-1d17-4b38-ae27-73235f136031", "from_id": "10b221ff-1d17-4b38-ae27-73235f136031", "from_name": null, "from_type": "Indicator", "id": "c4742ee4-b6c6-4e83-8c97-723ea9df6e9c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--e21c9331-575c-56e5-b936-4fe9efa4ace8", "toId": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_id": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_name": "RatelS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.767Z", "created_at": "2026-09-26T05:48:50.369Z", "modified": "2026-09-26T05:48:50.537Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:48:50.537Z" }, "description_available": false, "entity_type": "indicates", "fromId": "1a15e67e-da7b-42ec-b24a-d47fd8aa0767", "from_id": "1a15e67e-da7b-42ec-b24a-d47fd8aa0767", "from_name": null, "from_type": "Indicator", "id": "c4c2bf7d-135b-42b6-a0b4-3caf5a2ec8c2", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--31075a62-def7-5b9b-8103-73ff274fb0a9", "toId": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_id": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_name": "RatelS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.262Z", "created_at": "2026-09-26T05:35:31.564Z", "modified": "2026-09-26T05:35:31.743Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:35:31.743Z" }, "description_available": false, "entity_type": "indicates", "fromId": "f7f8f4c3-42b1-433b-a4ab-f67c83968004", "from_id": "f7f8f4c3-42b1-433b-a4ab-f67c83968004", "from_name": null, "from_type": "Indicator", "id": "c541b4ce-f9d1-4529-8478-338e2ef12e58", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--8dbff607-4877-5e29-bb6d-6c7436c399ab", "toId": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_id": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_name": "CrowDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.999Z", "created_at": "2026-09-26T05:54:56.227Z", "modified": "2026-09-26T05:54:56.624Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:54:56.624Z" }, "description_available": false, "entity_type": "indicates", "fromId": "26da206d-5fde-40ba-bc45-0f24f378263c", "from_id": "26da206d-5fde-40ba-bc45-0f24f378263c", "from_name": null, "from_type": "Indicator", "id": "c54cde9a-a37a-49d0-93fe-85300e87e788", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--6e6509fd-b630-5e30-b990-73ce47281a62", "toId": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_id": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_name": "HelloBot", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.372Z", "created_at": "2026-09-26T05:39:03.593Z", "modified": "2026-09-26T05:39:03.815Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:39:03.815Z" }, "description_available": false, "entity_type": "indicates", "fromId": "eb51ab90-3d38-4f58-84c1-b0700196508c", "from_id": "eb51ab90-3d38-4f58-84c1-b0700196508c", "from_name": null, "from_type": "Indicator", "id": "c5f346f3-4546-4b26-a7b0-7d737c563bc5", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--2e21cf42-ced2-59e8-8cbc-6f72949afaec", "toId": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_id": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_name": "CrowDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.418Z", "created_at": "2026-09-26T05:40:11.389Z", "modified": "2026-09-26T05:40:11.602Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:40:11.602Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d4aa073f-c77f-4db6-a515-5246469cf6b0", "from_id": "d4aa073f-c77f-4db6-a515-5246469cf6b0", "from_name": null, "from_type": "Indicator", "id": "c64275c5-b3dc-4d0e-be5e-57b917b07d06", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--d9fcbc40-13cf-5f0d-9021-280023c2ab22", "toId": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_id": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_name": "RatelS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.231Z", "created_at": "2026-09-26T06:01:00.477Z", "modified": "2026-09-26T06:01:01.473Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:01:01.473Z" }, "description_available": false, "entity_type": "indicates", "fromId": "aaf834aa-275b-4a6a-9790-6971e8adf52d", "from_id": "aaf834aa-275b-4a6a-9790-6971e8adf52d", "from_name": null, "from_type": "Indicator", "id": "c66965f2-eb7e-44a5-bbbe-7fe3c579404d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--163ad498-52e4-5147-a4c8-141dea3465eb", "toId": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_id": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_name": "Spark - S0543", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.453Z", "created_at": "2026-09-26T06:06:49.427Z", "modified": "2026-09-26T06:06:49.554Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:06:49.554Z" }, "description_available": false, "entity_type": "indicates", "fromId": "5330b1c5-bebb-4760-ae47-12dd0e0d1e23", "from_id": "5330b1c5-bebb-4760-ae47-12dd0e0d1e23", "from_name": null, "from_type": "Indicator", "id": "c6793111-3d20-445e-ae13-15a72a0025ce", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--9273afcf-bd9a-5273-98db-d78620a37524", "toId": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_id": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_name": "PlugX - S0013", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.786Z", "created_at": "2026-09-26T05:49:18.944Z", "modified": "2026-09-26T05:49:19.626Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:49:19.626Z" }, "description_available": false, "entity_type": "indicates", "fromId": "8134c07a-eec8-489c-80e7-aca40ccc6268", "from_id": "8134c07a-eec8-489c-80e7-aca40ccc6268", "from_name": null, "from_type": "Indicator", "id": "c683ce79-283e-4656-a55b-14e5e4dd453a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--140b1ece-3df3-5f03-987f-83d288a4136a", "toId": "657ff382-024b-45a4-974a-3e41f1762074", "to_id": "657ff382-024b-45a4-974a-3e41f1762074", "to_name": "Cobalt Strike - S0154", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.587Z", "created_at": "2026-09-26T05:43:42.383Z", "modified": "2026-09-26T05:43:42.552Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:43:42.552Z" }, "description_available": false, "entity_type": "indicates", "fromId": "610b3366-3a08-4e4d-9f45-c8543a783a7f", "from_id": "610b3366-3a08-4e4d-9f45-c8543a783a7f", "from_name": null, "from_type": "Indicator", "id": "c6884db0-5988-4c14-983c-cbdc23e9e664", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--7e6ec0ae-ba1a-5898-ba2b-ac94d904dedc", "toId": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_id": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_name": "HelloBot", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.496Z", "created_at": "2026-09-26T06:07:46.152Z", "modified": "2026-09-26T06:07:46.314Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:07:46.314Z" }, "description_available": false, "entity_type": "indicates", "fromId": "781e0e33-439f-46a6-b565-9c9e6287a0ff", "from_id": "781e0e33-439f-46a6-b565-9c9e6287a0ff", "from_name": null, "from_type": "Indicator", "id": "c6b686a0-ab51-420f-83f0-47da3eb9b703", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--c43c8a3d-c023-55d4-bf55-11aa4d9fe941", "toId": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_id": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_name": "Melofee", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.063Z", "created_at": "2026-09-26T05:56:16.406Z", "modified": "2026-09-26T05:56:16.547Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:56:16.547Z" }, "description_available": false, "entity_type": "indicates", "fromId": "66f40cca-cc72-4806-beef-47ae23125e5f", "from_id": "66f40cca-cc72-4806-beef-47ae23125e5f", "from_name": null, "from_type": "Indicator", "id": "c6c38351-4f62-49a1-b598-58ebd4a0416a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--5e8ad5fb-41fb-5d53-b851-4eef8d516e20", "toId": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_id": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_name": "Melofee", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.304Z", "created_at": "2026-09-26T05:36:34.434Z", "modified": "2026-09-26T05:36:34.776Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:36:34.776Z" }, "description_available": false, "entity_type": "indicates", "fromId": "20bc512e-2f63-438d-bcee-abdf39614bf5", "from_id": "20bc512e-2f63-438d-bcee-abdf39614bf5", "from_name": null, "from_type": "Indicator", "id": "c70f3247-46cb-4eb0-91cf-6edde79651db", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--bded3b81-9750-50c1-912f-4fe7588b4875", "toId": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_id": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_name": "STOWAWAY", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.072Z", "created_at": "2026-09-26T05:34:54.326Z", "modified": "2026-09-26T05:34:54.885Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:34:54.885Z" }, "description_available": false, "entity_type": "based-on", "fromId": "ce5e270a-a0f5-4d07-9faf-6493364c1a2b", "from_id": "ce5e270a-a0f5-4d07-9faf-6493364c1a2b", "from_name": null, "from_type": "Indicator", "id": "c72cb1a4-7be7-4063-8f48-869c02f7207a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--16ac7dad-675b-5e26-875c-70ab3fbe0fab", "toId": "27bf2255-9252-4604-8c7c-83202fb44fb9", "to_id": "27bf2255-9252-4604-8c7c-83202fb44fb9", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.824Z", "created_at": "2026-09-26T05:51:41.389Z", "modified": "2026-09-26T05:51:41.639Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:51:41.639Z" }, "description_available": false, "entity_type": "indicates", "fromId": "10b221ff-1d17-4b38-ae27-73235f136031", "from_id": "10b221ff-1d17-4b38-ae27-73235f136031", "from_name": null, "from_type": "Indicator", "id": "c73acb98-3799-46ad-aa6b-db3e66265f8b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--676029f3-47f2-5bd4-b760-9c3ad0ee4e63", "toId": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_id": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_name": "HelloBot", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.260Z", "created_at": "2026-09-26T05:35:39.160Z", "modified": "2026-09-26T05:35:39.302Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:35:39.302Z" }, "description_available": false, "entity_type": "indicates", "fromId": "f7f8f4c3-42b1-433b-a4ab-f67c83968004", "from_id": "f7f8f4c3-42b1-433b-a4ab-f67c83968004", "from_name": null, "from_type": "Indicator", "id": "c7989887-e816-4f48-bd8e-ddd52ae5fc1b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--41fefc8d-b407-57bf-aa25-6c7530eb23d0", "toId": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_id": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_name": "Spark - S0543", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.722Z", "created_at": "2026-09-26T05:47:50.881Z", "modified": "2026-09-26T05:47:51.109Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:47:51.109Z" }, "description_available": false, "entity_type": "indicates", "fromId": "de51cd6f-4b7a-4c4b-9b3d-d5094f650356", "from_id": "de51cd6f-4b7a-4c4b-9b3d-d5094f650356", "from_name": null, "from_type": "Indicator", "id": "c7a4cfe8-7ffc-4183-8b57-56b3782232cb", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--e21efc06-23e8-50f8-ad69-8594a983912b", "toId": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_id": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_name": "CrowDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.297Z", "created_at": "2026-09-26T06:02:33.679Z", "modified": "2026-09-26T06:02:34.266Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:02:34.266Z" }, "description_available": false, "entity_type": "indicates", "fromId": "3b95a828-10fe-4895-a5fa-606043535451", "from_id": "3b95a828-10fe-4895-a5fa-606043535451", "from_name": null, "from_type": "Indicator", "id": "c7a5c6d6-c891-45a7-8ea2-669ddf0ae337", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--303d7115-2fc0-519f-8ad7-2d5e8f0bff2c", "toId": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_id": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_name": "RatelS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.065Z", "created_at": "2026-09-26T05:56:19.838Z", "modified": "2026-09-26T05:56:20.056Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:56:20.056Z" }, "description_available": false, "entity_type": "indicates", "fromId": "66f40cca-cc72-4806-beef-47ae23125e5f", "from_id": "66f40cca-cc72-4806-beef-47ae23125e5f", "from_name": null, "from_type": "Indicator", "id": "c84a769d-fd36-4215-bb56-dfa37fcdacba", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--2f1bd7cf-f3b7-5dfe-b2e2-39bf8db11450", "toId": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_id": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_name": "PlugX - S0013", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.232Z", "created_at": "2026-09-26T06:00:54.473Z", "modified": "2026-09-26T06:00:54.627Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:00:54.627Z" }, "description_available": false, "entity_type": "indicates", "fromId": "aaf834aa-275b-4a6a-9790-6971e8adf52d", "from_id": "aaf834aa-275b-4a6a-9790-6971e8adf52d", "from_name": null, "from_type": "Indicator", "id": "c8ded45c-53f2-4d70-bcd6-574957942b45", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--f4886438-e475-5274-b356-622384cefdda", "toId": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_id": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_name": "CrowDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.593Z", "created_at": "2026-09-26T06:11:31.913Z", "modified": "2026-09-26T06:11:32.123Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:11:32.123Z" }, "description_available": false, "entity_type": "indicates", "fromId": "e82e98a0-5491-4b41-82dd-1ffa975dde57", "from_id": "e82e98a0-5491-4b41-82dd-1ffa975dde57", "from_name": null, "from_type": "Indicator", "id": "ca1c5a66-d0cf-4fea-a150-bdc5baf64ff8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--aaafbf68-f48f-5948-a7fb-acca1e28ea73", "toId": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_id": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_name": "Spark - S0543", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.742Z", "created_at": "2026-09-26T05:48:10.997Z", "modified": "2026-09-26T05:48:11.221Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:48:11.221Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ce5e270a-a0f5-4d07-9faf-6493364c1a2b", "from_id": "ce5e270a-a0f5-4d07-9faf-6493364c1a2b", "from_name": null, "from_type": "Indicator", "id": "ca36f910-c5b8-40b5-8551-005d6be863ac", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--c9bb3598-2d07-56a7-bb17-1c606476db93", "toId": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_id": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_name": "Spark - S0543", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.892Z", "created_at": "2026-09-26T05:52:42.276Z", "modified": "2026-09-26T05:52:42.431Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:52:42.431Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c77e0b5e-a168-4a6f-993c-bc7076c78285", "from_id": "c77e0b5e-a168-4a6f-993c-bc7076c78285", "from_name": null, "from_type": "Indicator", "id": "ca56c607-96dc-40ed-ba2f-7650111405bb", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--6f2dee7b-2795-51e8-ae1b-1aff05053dce", "toId": "208a45aa-c18e-4619-9a90-7004849cab40", "to_id": "208a45aa-c18e-4619-9a90-7004849cab40", "to_name": "HemiGate", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.152Z", "created_at": "2026-09-26T05:59:07.322Z", "modified": "2026-09-26T05:59:07.573Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:59:07.573Z" }, "description_available": false, "entity_type": "indicates", "fromId": "56d609d1-e0ef-4633-8cfe-a3e1f792fbff", "from_id": "56d609d1-e0ef-4633-8cfe-a3e1f792fbff", "from_name": null, "from_type": "Indicator", "id": "ca68d6b3-b67e-4f72-9dbf-ebfc599e3b2c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--7cf62f82-132e-5213-84e9-916a03a813df", "toId": "208a45aa-c18e-4619-9a90-7004849cab40", "to_id": "208a45aa-c18e-4619-9a90-7004849cab40", "to_name": "HemiGate", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.570Z", "created_at": "2026-09-26T05:43:26.442Z", "modified": "2026-09-26T05:43:26.640Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:43:26.640Z" }, "description_available": false, "entity_type": "indicates", "fromId": "b5ad9feb-b128-47fb-9914-8319d0f48229", "from_id": "b5ad9feb-b128-47fb-9914-8319d0f48229", "from_name": null, "from_type": "Indicator", "id": "caa40432-5bbd-45d6-8656-e1a197c05ace", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--b6278668-d5ec-5cd4-b899-cf61ac2ccef0", "toId": "657ff382-024b-45a4-974a-3e41f1762074", "to_id": "657ff382-024b-45a4-974a-3e41f1762074", "to_name": "Cobalt Strike - S0154", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.955Z", "created_at": "2026-09-26T05:53:57.365Z", "modified": "2026-09-26T05:53:57.713Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:53:57.713Z" }, "description_available": false, "entity_type": "indicates", "fromId": "2497f466-fac3-4bfc-ab1f-5ebcf363283b", "from_id": "2497f466-fac3-4bfc-ab1f-5ebcf363283b", "from_name": null, "from_type": "Indicator", "id": "caa819f1-32e9-433e-b84a-e1dd8c897d67", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--1e8b1296-d399-5cd4-b43d-435b6b4500e1", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.507Z", "created_at": "2026-09-26T05:42:04.554Z", "modified": "2026-09-26T05:42:04.775Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:42:04.775Z" }, "description_available": false, "entity_type": "indicates", "fromId": "435fff26-763c-4528-906f-e8da098d6aee", "from_id": "435fff26-763c-4528-906f-e8da098d6aee", "from_name": null, "from_type": "Indicator", "id": "cabcaeb0-ff09-4ace-b5db-3f8e2d645c6f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--92b78634-0287-555f-ad72-de8f7446c374", "toId": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_id": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_name": "CrowDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.305Z", "created_at": "2026-09-26T05:36:22.204Z", "modified": "2026-09-26T05:36:22.375Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:36:22.375Z" }, "description_available": false, "entity_type": "indicates", "fromId": "20bc512e-2f63-438d-bcee-abdf39614bf5", "from_id": "20bc512e-2f63-438d-bcee-abdf39614bf5", "from_name": null, "from_type": "Indicator", "id": "cc2accdb-bcd4-44dc-a20f-746156794b11", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--61cb77e6-033c-5598-b1af-b38c27d21eab", "toId": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_id": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_name": "TernDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.613Z", "created_at": "2026-09-26T06:11:44.627Z", "modified": "2026-09-26T06:11:44.751Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:11:44.751Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d5009423-c128-4583-ac72-3f07f1201db6", "from_id": "d5009423-c128-4583-ac72-3f07f1201db6", "from_name": null, "from_type": "Indicator", "id": "cc461ca6-705f-4465-8e88-1678cd146d92", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--4efa7046-7441-5c35-90e9-23d25b5830a8", "toId": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_id": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_name": "PlugX - S0013", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.289Z", "created_at": "2026-09-26T06:02:22.433Z", "modified": "2026-09-26T06:02:22.593Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:02:22.593Z" }, "description_available": false, "entity_type": "indicates", "fromId": "3b95a828-10fe-4895-a5fa-606043535451", "from_id": "3b95a828-10fe-4895-a5fa-606043535451", "from_name": null, "from_type": "Indicator", "id": "cc703a2b-6992-49fa-9674-cf02aa5dede0", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--2db98827-c94b-564f-9f05-b7566f80867d", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.593Z", "created_at": "2026-09-26T05:43:48.040Z", "modified": "2026-09-26T05:43:48.256Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:43:48.256Z" }, "description_available": false, "entity_type": "indicates", "fromId": "610b3366-3a08-4e4d-9f45-c8543a783a7f", "from_id": "610b3366-3a08-4e4d-9f45-c8543a783a7f", "from_name": null, "from_type": "Indicator", "id": "cc9b073a-634c-4b86-b1a5-19bba912b182", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--57576c00-45e0-5d6c-820d-ced15add9d24", "toId": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_id": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_name": "STOWAWAY", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.593Z", "created_at": "2026-09-26T06:11:21.064Z", "modified": "2026-09-26T06:11:21.205Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:11:21.205Z" }, "description_available": false, "entity_type": "indicates", "fromId": "e82e98a0-5491-4b41-82dd-1ffa975dde57", "from_id": "e82e98a0-5491-4b41-82dd-1ffa975dde57", "from_name": null, "from_type": "Indicator", "id": "ccedd640-578c-449a-8549-a2c9926ebcdf", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--9fa911b2-2687-5fb3-a789-49fb469d59a2", "toId": "657ff382-024b-45a4-974a-3e41f1762074", "to_id": "657ff382-024b-45a4-974a-3e41f1762074", "to_name": "Cobalt Strike - S0154", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.498Z", "created_at": "2026-09-26T06:07:47.160Z", "modified": "2026-09-26T06:07:48.443Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:07:48.443Z" }, "description_available": false, "entity_type": "indicates", "fromId": "781e0e33-439f-46a6-b565-9c9e6287a0ff", "from_id": "781e0e33-439f-46a6-b565-9c9e6287a0ff", "from_name": null, "from_type": "Indicator", "id": "cd37916c-039c-474e-adb8-c3938527404d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--e9c8f80f-5b78-52a3-9ff9-2d871a448874", "toId": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_id": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_name": "PlugX - S0013", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.404Z", "created_at": "2026-09-26T06:05:43.227Z", "modified": "2026-09-26T06:05:43.425Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:05:43.425Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ac6046d8-f570-4eca-af26-b22ab4b74e00", "from_id": "ac6046d8-f570-4eca-af26-b22ab4b74e00", "from_name": null, "from_type": "Indicator", "id": "cd8b97da-e60c-4ff7-b5e2-e11c89829866", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--41d23fe0-f1e9-59cc-9bfc-44ec311a1959", "toId": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_id": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_name": "HelloBot", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.207Z", "created_at": "2026-09-26T05:35:12.307Z", "modified": "2026-09-26T05:35:12.822Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:35:12.822Z" }, "description_available": false, "entity_type": "based-on", "fromId": "09acd2d3-2afb-4de1-a147-7ae7904d3859", "from_id": "09acd2d3-2afb-4de1-a147-7ae7904d3859", "from_name": null, "from_type": "Indicator", "id": "cd9eca57-4f74-49b6-9e18-218fa61ac888", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--83d689ee-851d-54e7-a350-c33e0c899dbb", "toId": "5d59618f-3a97-48e9-8661-b14e05c89144", "to_id": "5d59618f-3a97-48e9-8661-b14e05c89144", "to_name": null, "to_type": "IPv4Addr" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.288Z", "created_at": "2026-09-26T06:02:19.392Z", "modified": "2026-09-26T06:02:19.684Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:02:19.684Z" }, "description_available": false, "entity_type": "indicates", "fromId": "3b95a828-10fe-4895-a5fa-606043535451", "from_id": "3b95a828-10fe-4895-a5fa-606043535451", "from_name": null, "from_type": "Indicator", "id": "cee13107-4174-441b-b53f-3256e2699aeb", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--1ea60037-80fa-5247-9ae9-b4cb9e499fe5", "toId": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_id": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_name": "Melofee", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.225Z", "created_at": "2026-09-26T06:00:45.820Z", "modified": "2026-09-26T06:00:46.134Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:00:46.134Z" }, "description_available": false, "entity_type": "indicates", "fromId": "aaf834aa-275b-4a6a-9790-6971e8adf52d", "from_id": "aaf834aa-275b-4a6a-9790-6971e8adf52d", "from_name": null, "from_type": "Indicator", "id": "cf9e3198-0cd3-4af9-9426-cd862665e222", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--141028f7-db41-5725-8689-7e5d5be9a3b6", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.096Z", "created_at": "2026-09-26T05:58:11.877Z", "modified": "2026-09-26T05:58:12.258Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:58:12.258Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d7f88a85-9ab3-45b8-982b-294d838461a6", "from_id": "d7f88a85-9ab3-45b8-982b-294d838461a6", "from_name": null, "from_type": "Indicator", "id": "d10c7319-5dfa-42e6-b2e5-bacbb1520233", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--fbe6b4d6-0e21-5c0e-8ac0-12b932115fbf", "toId": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_id": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_name": "Spark - S0543", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.549Z", "created_at": "2026-09-26T05:43:02.655Z", "modified": "2026-09-26T05:43:03.641Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:43:03.641Z" }, "description_available": false, "entity_type": "indicates", "fromId": "653baf3a-7205-44e8-bf30-e40825fbf42a", "from_id": "653baf3a-7205-44e8-bf30-e40825fbf42a", "from_name": null, "from_type": "Indicator", "id": "d1785310-635e-4ccd-84c1-8f305d45a420", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--96f0c872-0084-512c-97da-9905a3f1faf8", "toId": "657ff382-024b-45a4-974a-3e41f1762074", "to_id": "657ff382-024b-45a4-974a-3e41f1762074", "to_name": "Cobalt Strike - S0154", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.416Z", "created_at": "2026-09-26T05:40:10.258Z", "modified": "2026-09-26T05:40:10.562Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:40:10.562Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d4aa073f-c77f-4db6-a515-5246469cf6b0", "from_id": "d4aa073f-c77f-4db6-a515-5246469cf6b0", "from_name": null, "from_type": "Indicator", "id": "d1aea3ca-347a-4597-91ce-6d67ca2ca741", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--f84e0ed8-6bc1-52c4-be66-ea56b720c4e7", "toId": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_id": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_name": "TernDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.528Z", "created_at": "2026-09-26T05:42:36.749Z", "modified": "2026-09-26T05:42:37.157Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:42:37.157Z" }, "description_available": false, "entity_type": "indicates", "fromId": "0eb188e3-885e-4084-abdf-6d4ba0098e64", "from_id": "0eb188e3-885e-4084-abdf-6d4ba0098e64", "from_name": null, "from_type": "Indicator", "id": "d1c32ee1-3efb-405f-96b0-d03383e2afec", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--75b0d979-ae07-5ef1-b486-e8cad1513045", "toId": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_id": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_name": "CrowDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.724Z", "created_at": "2026-09-26T05:47:43.913Z", "modified": "2026-09-26T05:47:44.241Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:47:44.241Z" }, "description_available": false, "entity_type": "indicates", "fromId": "de51cd6f-4b7a-4c4b-9b3d-d5094f650356", "from_id": "de51cd6f-4b7a-4c4b-9b3d-d5094f650356", "from_name": null, "from_type": "Indicator", "id": "d2034979-5a47-4ee1-b650-534fae386e55", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--82a7e72e-8306-5446-b413-ce1ce4dc96dd", "toId": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_id": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_name": "RatelS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.596Z", "created_at": "2026-09-26T06:11:25.842Z", "modified": "2026-09-26T06:11:26.311Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:11:26.311Z" }, "description_available": false, "entity_type": "indicates", "fromId": "e82e98a0-5491-4b41-82dd-1ffa975dde57", "from_id": "e82e98a0-5491-4b41-82dd-1ffa975dde57", "from_name": null, "from_type": "Indicator", "id": "d23c174d-d784-4aed-9644-3949c2cc33a4", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--32f4e638-8a5c-55c9-a097-77861d81c9ec", "toId": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_id": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_name": "RatelS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.637Z", "created_at": "2026-09-26T05:45:44.153Z", "modified": "2026-09-26T05:45:44.308Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:45:44.308Z" }, "description_available": false, "entity_type": "indicates", "fromId": "cdadaaa5-0866-4957-b6d7-c64be31a1cf9", "from_id": "cdadaaa5-0866-4957-b6d7-c64be31a1cf9", "from_name": null, "from_type": "Indicator", "id": "d24f461d-9ecd-40d5-a966-e3ba54cac00f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--c77282f0-92c7-5653-a393-68c1f653cce4", "toId": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_id": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_name": "STOWAWAY", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.659Z", "created_at": "2026-09-26T05:46:10.135Z", "modified": "2026-09-26T05:46:10.305Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:46:10.305Z" }, "description_available": false, "entity_type": "indicates", "fromId": "681c2240-1fb8-466d-a533-8f1d8132b27b", "from_id": "681c2240-1fb8-466d-a533-8f1d8132b27b", "from_name": null, "from_type": "Indicator", "id": "d3044e44-d922-46d7-8e3c-5c6db8f292a7", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--d5d79a72-ba7e-5632-b5dc-420b75b2dc64", "toId": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_id": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_name": "STOWAWAY", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.675Z", "created_at": "2026-09-26T05:46:33.387Z", "modified": "2026-09-26T05:46:34.718Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:46:34.718Z" }, "description_available": false, "entity_type": "indicates", "fromId": "157ca5cb-7d34-4fc3-83d2-bac13ceb9804", "from_id": "157ca5cb-7d34-4fc3-83d2-bac13ceb9804", "from_name": null, "from_type": "Indicator", "id": "d3098e1f-5721-41cf-adcc-f76d8fd40a48", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--00b517a8-15ea-5d6b-a1f2-989584339eee", "toId": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_id": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_name": "PlugX - S0013", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.254Z", "created_at": "2026-09-26T06:01:30.541Z", "modified": "2026-09-26T06:01:31.009Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:01:31.009Z" }, "description_available": false, "entity_type": "indicates", "fromId": "09acd2d3-2afb-4de1-a147-7ae7904d3859", "from_id": "09acd2d3-2afb-4de1-a147-7ae7904d3859", "from_name": null, "from_type": "Indicator", "id": "d32322cd-92fc-4e13-99cc-7e6f5a6588c0", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--7ea3c863-bc1f-5d6b-b236-84dbc0b6e3a7", "toId": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_id": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_name": "CrowDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.413Z", "created_at": "2026-09-26T06:05:53.052Z", "modified": "2026-09-26T06:05:53.394Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:05:53.394Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ac6046d8-f570-4eca-af26-b22ab4b74e00", "from_id": "ac6046d8-f570-4eca-af26-b22ab4b74e00", "from_name": null, "from_type": "Indicator", "id": "d3aa7079-6c2e-4565-980d-63348e9fb9d5", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--b48ca21c-75b2-5aa6-afd9-0f929d9bba36", "toId": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_id": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_name": "RatelS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.943Z", "created_at": "2026-09-26T05:53:35.116Z", "modified": "2026-09-26T05:53:35.838Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:53:35.838Z" }, "description_available": false, "entity_type": "indicates", "fromId": "1315ce2a-6659-4f4f-b9b7-e2450564ca9b", "from_id": "1315ce2a-6659-4f4f-b9b7-e2450564ca9b", "from_name": null, "from_type": "Indicator", "id": "d3fdce52-6f5f-4444-8d98-eb6527d413f1", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--ea11a105-803f-52af-abd6-aa6ac2f296a3", "toId": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_id": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_name": "RatelS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.485Z", "created_at": "2026-09-26T05:41:35.392Z", "modified": "2026-09-26T05:41:35.762Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:41:35.762Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c2dcc828-9ae2-404f-a201-0074f26085ba", "from_id": "c2dcc828-9ae2-404f-a201-0074f26085ba", "from_name": null, "from_type": "Indicator", "id": "d41c9fef-e195-4336-b711-321ec1240bca", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--79627fcd-0cab-582a-a53a-34b28469f875", "toId": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_id": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_name": "TernDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.344Z", "created_at": "2026-09-26T06:04:29.063Z", "modified": "2026-09-26T06:04:29.235Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:04:29.235Z" }, "description_available": false, "entity_type": "indicates", "fromId": "95ef732a-5859-4b75-a4ea-fd3cfe3f1618", "from_id": "95ef732a-5859-4b75-a4ea-fd3cfe3f1618", "from_name": null, "from_type": "Indicator", "id": "d4352f4b-c53b-4ad0-a42b-5d96f6748805", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--6d9f1623-5f59-51e8-a448-e6fa784eb537", "toId": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_id": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_name": "TernDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.256Z", "created_at": "2026-09-26T05:35:23.127Z", "modified": "2026-09-26T05:35:23.520Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:35:23.520Z" }, "description_available": false, "entity_type": "indicates", "fromId": "f7f8f4c3-42b1-433b-a4ab-f67c83968004", "from_id": "f7f8f4c3-42b1-433b-a4ab-f67c83968004", "from_name": null, "from_type": "Indicator", "id": "d4cf7c22-6dd5-49ce-968e-cfb9f4e819c2", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--f5994032-c744-5209-8307-ba2ce7cd705a", "toId": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_id": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_name": "HelloBot", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.070Z", "created_at": "2026-09-26T05:56:25.492Z", "modified": "2026-09-26T05:56:25.732Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:56:25.732Z" }, "description_available": false, "entity_type": "indicates", "fromId": "66f40cca-cc72-4806-beef-47ae23125e5f", "from_id": "66f40cca-cc72-4806-beef-47ae23125e5f", "from_name": null, "from_type": "Indicator", "id": "d4fef635-1fe9-4a56-911f-98df033f0219", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--37faca75-d237-5a26-8462-ab073d8a6b13", "toId": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_id": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_name": "CrowDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.087Z", "created_at": "2026-09-26T05:34:55.287Z", "modified": "2026-09-26T05:34:58.924Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:34:58.924Z" }, "description_available": false, "entity_type": "based-on", "fromId": "2227cc4b-afc7-4060-b897-a1a458d90abd", "from_id": "2227cc4b-afc7-4060-b897-a1a458d90abd", "from_name": null, "from_type": "Indicator", "id": "d517e645-232d-4072-8ff4-f83412205443", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--3e028b37-aba2-5181-aa43-7598cf28acfa", "toId": "464bb6a2-f467-40fe-b562-fb088579a17f", "to_id": "464bb6a2-f467-40fe-b562-fb088579a17f", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.523Z", "created_at": "2026-09-26T05:42:30.512Z", "modified": "2026-09-26T05:42:30.697Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:42:30.697Z" }, "description_available": false, "entity_type": "indicates", "fromId": "0eb188e3-885e-4084-abdf-6d4ba0098e64", "from_id": "0eb188e3-885e-4084-abdf-6d4ba0098e64", "from_name": null, "from_type": "Indicator", "id": "d560be5d-8742-4d12-8790-55a473ffd5d9", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--23c748f1-f835-5e08-b016-5b9ae5bf3c19", "toId": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_id": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_name": "HelloBot", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.461Z", "created_at": "2026-09-26T05:41:03.721Z", "modified": "2026-09-26T05:41:03.955Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:41:03.955Z" }, "description_available": false, "entity_type": "indicates", "fromId": "4ff9e994-0564-43c3-8240-004f20eb7d3f", "from_id": "4ff9e994-0564-43c3-8240-004f20eb7d3f", "from_name": null, "from_type": "Indicator", "id": "d5e7b820-e9f8-42cc-a081-109d2659f5ec", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--bd269e97-e65f-59da-8e18-e2f7666560d1", "toId": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_id": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_name": "CrowDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.367Z", "created_at": "2026-09-26T05:39:00.179Z", "modified": "2026-09-26T05:39:00.389Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:39:00.389Z" }, "description_available": false, "entity_type": "indicates", "fromId": "eb51ab90-3d38-4f58-84c1-b0700196508c", "from_id": "eb51ab90-3d38-4f58-84c1-b0700196508c", "from_name": null, "from_type": "Indicator", "id": "d611201e-b16c-4604-8127-a348a288433b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--645266f5-f07f-559b-ad62-3182f7ac4f06", "toId": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_id": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_name": "PlugX - S0013", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.198Z", "created_at": "2026-09-26T06:00:03.342Z", "modified": "2026-09-26T06:00:03.599Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:00:03.599Z" }, "description_available": false, "entity_type": "indicates", "fromId": "f0b6cabc-d961-4c2b-a9a0-4075ac17972c", "from_id": "f0b6cabc-d961-4c2b-a9a0-4075ac17972c", "from_name": null, "from_type": "Indicator", "id": "d6268512-11ec-47e8-a707-4344b7179f60", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--acafc77c-b0ec-5acc-8b76-45e485a72724", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.499Z", "created_at": "2026-09-26T05:42:01.930Z", "modified": "2026-09-26T05:42:02.817Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:42:02.817Z" }, "description_available": false, "entity_type": "indicates", "fromId": "435fff26-763c-4528-906f-e8da098d6aee", "from_id": "435fff26-763c-4528-906f-e8da098d6aee", "from_name": null, "from_type": "Indicator", "id": "d66c6df1-bddd-4ce4-ad3f-1d09df62146d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--12445eb3-cc71-568c-8024-ced490acb954", "toId": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_id": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_name": "Melofee", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.388Z", "created_at": "2026-09-26T06:05:20.201Z", "modified": "2026-09-26T06:05:20.418Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:05:20.418Z" }, "description_available": false, "entity_type": "indicates", "fromId": "2d16d740-ae8a-45ff-8a8b-9032f924c3fa", "from_id": "2d16d740-ae8a-45ff-8a8b-9032f924c3fa", "from_name": null, "from_type": "Indicator", "id": "d7d5c72f-3766-49ae-ba29-9bd2bb4764ee", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--5cf1cdde-84e3-5a0c-8b5e-2be13fc4f367", "toId": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_id": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_name": "STOWAWAY", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.017Z", "created_at": "2026-09-26T05:34:39.519Z", "modified": "2026-09-26T05:34:39.922Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:34:39.922Z" }, "description_available": false, "entity_type": "based-on", "fromId": "20bc512e-2f63-438d-bcee-abdf39614bf5", "from_id": "20bc512e-2f63-438d-bcee-abdf39614bf5", "from_name": null, "from_type": "Indicator", "id": "d8010d4c-9b0e-48bb-881d-b66f4d6fdbab", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--3e1857fd-c379-5b0b-96c4-f0ae6c2e0ea5", "toId": "bf3b8856-9137-440a-957e-bfbd1c098297", "to_id": "bf3b8856-9137-440a-957e-bfbd1c098297", "to_name": null, "to_type": "Hostname" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.630Z", "created_at": "2026-09-26T05:45:36.824Z", "modified": "2026-09-26T05:45:37.466Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:45:37.466Z" }, "description_available": false, "entity_type": "indicates", "fromId": "cdadaaa5-0866-4957-b6d7-c64be31a1cf9", "from_id": "cdadaaa5-0866-4957-b6d7-c64be31a1cf9", "from_name": null, "from_type": "Indicator", "id": "d8b10e72-2f67-49b0-a6a5-ddd1f6ff4fa9", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--5721f6de-fa45-5780-bda5-e6f34a9c1866", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.278Z", "created_at": "2026-09-26T05:35:57.276Z", "modified": "2026-09-26T05:35:57.493Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:35:57.493Z" }, "description_available": false, "entity_type": "indicates", "fromId": "48f22366-f0fd-4667-b458-fc531795e8ff", "from_id": "48f22366-f0fd-4667-b458-fc531795e8ff", "from_name": null, "from_type": "Indicator", "id": "d8dbda27-2afe-45d2-8a75-fda0bb55d2b4", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--5a290f9b-e9fc-58f7-a78a-07577d4f79e8", "toId": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_id": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_name": "PlugX - S0013", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.830Z", "created_at": "2026-09-26T05:51:45.266Z", "modified": "2026-09-26T05:51:45.487Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:51:45.487Z" }, "description_available": false, "entity_type": "indicates", "fromId": "10b221ff-1d17-4b38-ae27-73235f136031", "from_id": "10b221ff-1d17-4b38-ae27-73235f136031", "from_name": null, "from_type": "Indicator", "id": "d909e80f-1c9e-4f2a-8ffc-bc72ca9ed4c3", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--40b88684-2099-59e3-8652-da712c9859a8", "toId": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_id": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_name": "CrowDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.619Z", "created_at": "2026-09-26T06:11:59.537Z", "modified": "2026-09-26T06:11:59.861Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:11:59.861Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d5009423-c128-4583-ac72-3f07f1201db6", "from_id": "d5009423-c128-4583-ac72-3f07f1201db6", "from_name": null, "from_type": "Indicator", "id": "d95d8ff3-7bf4-421a-a6db-5cf44f14acce", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--2876b6f9-578e-5202-849b-badff0663ebc", "toId": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_id": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_name": "CrowDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.459Z", "created_at": "2026-09-26T05:41:09.248Z", "modified": "2026-09-26T05:41:09.473Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:41:09.473Z" }, "description_available": false, "entity_type": "indicates", "fromId": "4ff9e994-0564-43c3-8240-004f20eb7d3f", "from_id": "4ff9e994-0564-43c3-8240-004f20eb7d3f", "from_name": null, "from_type": "Indicator", "id": "d97ea383-6899-4ca6-bf2b-7da7f26c417a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--8f0a1fa4-b013-50de-8837-137ebc03727a", "toId": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_id": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_name": "Spark - S0543", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.024Z", "created_at": "2026-09-26T05:34:42.037Z", "modified": "2026-09-26T05:34:43.011Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:34:43.011Z" }, "description_available": false, "entity_type": "based-on", "fromId": "eb51ab90-3d38-4f58-84c1-b0700196508c", "from_id": "eb51ab90-3d38-4f58-84c1-b0700196508c", "from_name": null, "from_type": "Indicator", "id": "d9da3395-b3cc-467c-b87a-79624e8d2a38", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--d50ab41b-1e8d-5a39-a554-9c8c0e515e26", "toId": "26ce54a1-f3a1-4886-afcd-344e44e6354b", "to_id": "26ce54a1-f3a1-4886-afcd-344e44e6354b", "to_name": null, "to_type": "Hostname" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.696Z", "created_at": "2026-09-26T05:47:01.883Z", "modified": "2026-09-26T05:47:02.130Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:47:02.130Z" }, "description_available": false, "entity_type": "indicates", "fromId": "a7a198b8-f0a3-4221-b768-191720f061b9", "from_id": "a7a198b8-f0a3-4221-b768-191720f061b9", "from_name": null, "from_type": "Indicator", "id": "d9df8471-6e8a-4185-b0fa-13bfccb61bfe", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--7a932f28-f8d8-5ea3-954d-ba2e453321d5", "toId": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_id": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_name": "PlugX - S0013", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.521Z", "created_at": "2026-09-26T05:42:25.475Z", "modified": "2026-09-26T05:42:25.865Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:42:25.865Z" }, "description_available": false, "entity_type": "indicates", "fromId": "0eb188e3-885e-4084-abdf-6d4ba0098e64", "from_id": "0eb188e3-885e-4084-abdf-6d4ba0098e64", "from_name": null, "from_type": "Indicator", "id": "d9f142b9-bf38-4005-9c84-17d0d885bf6f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--45bff680-2fce-5861-bb00-c0e768e2ad3b", "toId": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_id": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_name": "Melofee", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.998Z", "created_at": "2026-09-26T05:54:55.531Z", "modified": "2026-09-26T05:54:55.807Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:54:55.807Z" }, "description_available": false, "entity_type": "indicates", "fromId": "26da206d-5fde-40ba-bc45-0f24f378263c", "from_id": "26da206d-5fde-40ba-bc45-0f24f378263c", "from_name": null, "from_type": "Indicator", "id": "da2d59d0-e4d7-4e4e-8bd5-cf79087dfccc", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--bc03f6c8-9371-561c-b9be-491c9bbf9532", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.403Z", "created_at": "2026-09-26T06:05:45.573Z", "modified": "2026-09-26T06:05:45.741Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:05:45.741Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ac6046d8-f570-4eca-af26-b22ab4b74e00", "from_id": "ac6046d8-f570-4eca-af26-b22ab4b74e00", "from_name": null, "from_type": "Indicator", "id": "db073789-cd3c-431d-8fbe-8274f160bda8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--afae497f-fdee-5a88-b8cb-1c3ae24b4c23", "toId": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_id": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_name": "Melofee", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.360Z", "created_at": "2026-09-26T06:04:49.358Z", "modified": "2026-09-26T06:04:49.718Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:04:49.718Z" }, "description_available": false, "entity_type": "indicates", "fromId": "3c2ca4de-2c25-4802-a582-ebf285060ed9", "from_id": "3c2ca4de-2c25-4802-a582-ebf285060ed9", "from_name": null, "from_type": "Indicator", "id": "dc46af1b-95b5-4452-8de5-c72fcc971a25", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--2bf465a4-8690-5c50-b86a-7898edb53085", "toId": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_id": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_name": "PlugX - S0013", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.436Z", "created_at": "2026-09-26T06:06:22.748Z", "modified": "2026-09-26T06:06:23.038Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:06:23.038Z" }, "description_available": false, "entity_type": "indicates", "fromId": "313c8419-28b4-4ef9-9855-91d315819bf8", "from_id": "313c8419-28b4-4ef9-9855-91d315819bf8", "from_name": null, "from_type": "Indicator", "id": "dc60cf08-bdb5-487d-b32b-6a3f82f39117", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--cc9664a2-c43a-588e-959a-d1a1b1ba8e85", "toId": "208a45aa-c18e-4619-9a90-7004849cab40", "to_id": "208a45aa-c18e-4619-9a90-7004849cab40", "to_name": "HemiGate", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.461Z", "created_at": "2026-09-26T06:06:55.069Z", "modified": "2026-09-26T06:06:55.400Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:06:55.400Z" }, "description_available": false, "entity_type": "indicates", "fromId": "5330b1c5-bebb-4760-ae47-12dd0e0d1e23", "from_id": "5330b1c5-bebb-4760-ae47-12dd0e0d1e23", "from_name": null, "from_type": "Indicator", "id": "dd4c50c9-c573-4778-98a0-9fc8a55695e7", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--b8dd84bd-44ff-5a96-a6de-d6126a57bff3", "toId": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_id": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_name": "RatelS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.638Z", "created_at": "2026-09-26T05:45:45.104Z", "modified": "2026-09-26T05:45:45.252Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:45:45.252Z" }, "description_available": false, "entity_type": "indicates", "fromId": "cdadaaa5-0866-4957-b6d7-c64be31a1cf9", "from_id": "cdadaaa5-0866-4957-b6d7-c64be31a1cf9", "from_name": null, "from_type": "Indicator", "id": "dd6d5b4d-e823-4302-ac12-d602b4990ce0", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--2f190bb2-c292-588b-a0a5-f0ae4c5880d1", "toId": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_id": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_name": "TernDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.427Z", "created_at": "2026-09-26T06:06:13.387Z", "modified": "2026-09-26T06:06:14.270Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:06:14.270Z" }, "description_available": false, "entity_type": "indicates", "fromId": "313c8419-28b4-4ef9-9855-91d315819bf8", "from_id": "313c8419-28b4-4ef9-9855-91d315819bf8", "from_name": null, "from_type": "Indicator", "id": "de25bb41-0918-44ff-a659-e2856f92cb7b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--7e1a81c4-9053-5621-bfe6-7370ff9a6320", "toId": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_id": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_name": "HelloBot", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.255Z", "created_at": "2026-09-26T06:01:31.352Z", "modified": "2026-09-26T06:01:31.967Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:01:31.967Z" }, "description_available": false, "entity_type": "indicates", "fromId": "09acd2d3-2afb-4de1-a147-7ae7904d3859", "from_id": "09acd2d3-2afb-4de1-a147-7ae7904d3859", "from_name": null, "from_type": "Indicator", "id": "de6ed281-8d04-496e-8352-4800e4d6d46f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--64049092-5649-5fac-a905-3c17eaf50444", "toId": "208a45aa-c18e-4619-9a90-7004849cab40", "to_id": "208a45aa-c18e-4619-9a90-7004849cab40", "to_name": "HemiGate", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.635Z", "created_at": "2026-09-26T05:45:42.229Z", "modified": "2026-09-26T05:45:42.366Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:45:42.366Z" }, "description_available": false, "entity_type": "indicates", "fromId": "cdadaaa5-0866-4957-b6d7-c64be31a1cf9", "from_id": "cdadaaa5-0866-4957-b6d7-c64be31a1cf9", "from_name": null, "from_type": "Indicator", "id": "de71bf06-de9d-4cf6-b6f5-9d955a1bab79", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--fa91c766-ed10-529f-9af1-9e6015817a73", "toId": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_id": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_name": "Spark - S0543", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.426Z", "created_at": "2026-09-26T06:06:15.053Z", "modified": "2026-09-26T06:06:16.559Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:06:16.559Z" }, "description_available": false, "entity_type": "indicates", "fromId": "313c8419-28b4-4ef9-9855-91d315819bf8", "from_id": "313c8419-28b4-4ef9-9855-91d315819bf8", "from_name": null, "from_type": "Indicator", "id": "de7b76c5-c959-4120-a003-1baf6eb88a2f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--d94406ac-bc74-5bba-b3d5-f0c9bb3ec586", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.029Z", "created_at": "2026-09-26T05:55:37.315Z", "modified": "2026-09-26T05:55:37.549Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:55:37.549Z" }, "description_available": false, "entity_type": "indicates", "fromId": "cd0c196b-8e17-4794-80e8-7129d42950e2", "from_id": "cd0c196b-8e17-4794-80e8-7129d42950e2", "from_name": null, "from_type": "Indicator", "id": "de850f9e-599c-4ff7-9d5f-afff2ca188e8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--5d3a3238-72fc-5361-8a97-0ebc263b857d", "toId": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_id": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_name": "RatelS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.785Z", "created_at": "2026-09-26T05:49:18.324Z", "modified": "2026-09-26T05:49:18.504Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:49:18.504Z" }, "description_available": false, "entity_type": "indicates", "fromId": "8134c07a-eec8-489c-80e7-aca40ccc6268", "from_id": "8134c07a-eec8-489c-80e7-aca40ccc6268", "from_name": null, "from_type": "Indicator", "id": "deba816e-9a59-4b77-963b-d911c077699d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--040f7854-ac96-50c1-b900-6b60f28e2bf1", "toId": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_id": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_name": "Spark - S0543", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.571Z", "created_at": "2026-09-26T05:43:25.178Z", "modified": "2026-09-26T05:43:25.426Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:43:25.426Z" }, "description_available": false, "entity_type": "indicates", "fromId": "b5ad9feb-b128-47fb-9914-8319d0f48229", "from_id": "b5ad9feb-b128-47fb-9914-8319d0f48229", "from_name": null, "from_type": "Indicator", "id": "df3d4dff-f099-4ee1-9e8c-8e677a59d6ea", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--3bc165c8-8441-549d-85bb-08ae1dcb7850", "toId": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_id": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_name": "CrowDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.460Z", "created_at": "2026-09-26T05:41:03.252Z", "modified": "2026-09-26T05:41:03.388Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:41:03.388Z" }, "description_available": false, "entity_type": "indicates", "fromId": "4ff9e994-0564-43c3-8240-004f20eb7d3f", "from_id": "4ff9e994-0564-43c3-8240-004f20eb7d3f", "from_name": null, "from_type": "Indicator", "id": "df49f057-ffce-4a47-bf05-b64153da5b56", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--9114df85-31e5-5135-b8d7-19c8a62081bc", "toId": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_id": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_name": "STOWAWAY", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.917Z", "created_at": "2026-09-26T05:53:08.085Z", "modified": "2026-09-26T05:53:08.380Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:53:08.380Z" }, "description_available": false, "entity_type": "indicates", "fromId": "fdaa0a79-121c-4e17-91bb-e23da88da18e", "from_id": "fdaa0a79-121c-4e17-91bb-e23da88da18e", "from_name": null, "from_type": "Indicator", "id": "df64293b-af98-4bf7-8b7e-2f55ed638136", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--854b2c76-2ca0-5380-a58a-5cf8dac9f31b", "toId": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_id": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_name": "TernDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.501Z", "created_at": "2026-09-26T05:41:58.643Z", "modified": "2026-09-26T05:41:58.885Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:41:58.885Z" }, "description_available": false, "entity_type": "indicates", "fromId": "435fff26-763c-4528-906f-e8da098d6aee", "from_id": "435fff26-763c-4528-906f-e8da098d6aee", "from_name": null, "from_type": "Indicator", "id": "e0849bc9-87f3-4228-b2cf-4c10b0f4f6f7", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--bab2b446-5602-5b37-84be-04113a86318a", "toId": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_id": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_name": "PlugX - S0013", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.961Z", "created_at": "2026-09-26T05:54:00.482Z", "modified": "2026-09-26T05:54:00.705Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:54:00.705Z" }, "description_available": false, "entity_type": "indicates", "fromId": "2497f466-fac3-4bfc-ab1f-5ebcf363283b", "from_id": "2497f466-fac3-4bfc-ab1f-5ebcf363283b", "from_name": null, "from_type": "Indicator", "id": "e0b782b0-4d59-4616-93f9-1937755be33a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--993d0cb1-c2e9-5f8b-bfee-c2151255cc25", "toId": "657ff382-024b-45a4-974a-3e41f1762074", "to_id": "657ff382-024b-45a4-974a-3e41f1762074", "to_name": "Cobalt Strike - S0154", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.918Z", "created_at": "2026-09-26T05:53:08.809Z", "modified": "2026-09-26T05:53:08.977Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:53:08.977Z" }, "description_available": false, "entity_type": "indicates", "fromId": "fdaa0a79-121c-4e17-91bb-e23da88da18e", "from_id": "fdaa0a79-121c-4e17-91bb-e23da88da18e", "from_name": null, "from_type": "Indicator", "id": "e10312a0-daba-4d75-9d82-54a07ce47317", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--3a61f5c3-37eb-5540-b55f-acf9b6f998fc", "toId": "208a45aa-c18e-4619-9a90-7004849cab40", "to_id": "208a45aa-c18e-4619-9a90-7004849cab40", "to_name": "HemiGate", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.569Z", "created_at": "2026-09-26T06:10:54.241Z", "modified": "2026-09-26T06:10:54.659Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:10:54.659Z" }, "description_available": false, "entity_type": "indicates", "fromId": "6ac03fc4-4c10-4d8f-b546-7ce2b9422c39", "from_id": "6ac03fc4-4c10-4d8f-b546-7ce2b9422c39", "from_name": null, "from_type": "Indicator", "id": "e119e4af-1665-46c3-85ac-b0c5b37b66a6", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--80d6d267-1798-56f8-8fc4-1f73e31ae605", "toId": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_id": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_name": "Spark - S0543", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.197Z", "created_at": "2026-09-26T05:35:06.625Z", "modified": "2026-09-26T05:35:07.133Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:35:07.133Z" }, "description_available": false, "entity_type": "based-on", "fromId": "56d609d1-e0ef-4633-8cfe-a3e1f792fbff", "from_id": "56d609d1-e0ef-4633-8cfe-a3e1f792fbff", "from_name": null, "from_type": "Indicator", "id": "e1203d0f-a209-44ca-b3d3-bc3e22d4c9e8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--f11a23a8-f189-5d14-9e32-6267dbd0fccc", "toId": "7afdb82b-9941-485e-8009-7224919d145a", "to_id": "7afdb82b-9941-485e-8009-7224919d145a", "to_name": null, "to_type": "IPv4Addr" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.450Z", "created_at": "2026-09-26T06:06:50.933Z", "modified": "2026-09-26T06:06:51.131Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:06:51.131Z" }, "description_available": false, "entity_type": "indicates", "fromId": "5330b1c5-bebb-4760-ae47-12dd0e0d1e23", "from_id": "5330b1c5-bebb-4760-ae47-12dd0e0d1e23", "from_name": null, "from_type": "Indicator", "id": "e147a005-1974-45d1-b46f-f51020792fbd", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--3e7bc64b-6512-5d6c-9a6d-ec030c068733", "toId": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_id": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_name": "Melofee", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.283Z", "created_at": "2026-09-26T05:36:00.128Z", "modified": "2026-09-26T05:36:00.261Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:36:00.261Z" }, "description_available": false, "entity_type": "indicates", "fromId": "48f22366-f0fd-4667-b458-fc531795e8ff", "from_id": "48f22366-f0fd-4667-b458-fc531795e8ff", "from_name": null, "from_type": "Indicator", "id": "e1a7a38f-8c50-456c-b095-534b09c7a1a7", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--6fa6d6b6-e330-53e7-a3a1-e7e06b4d31df", "toId": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_id": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_name": "STOWAWAY", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.595Z", "created_at": "2026-09-26T06:11:28.288Z", "modified": "2026-09-26T06:11:30.633Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:11:30.633Z" }, "description_available": false, "entity_type": "indicates", "fromId": "e82e98a0-5491-4b41-82dd-1ffa975dde57", "from_id": "e82e98a0-5491-4b41-82dd-1ffa975dde57", "from_name": null, "from_type": "Indicator", "id": "e22b5248-fce6-47f9-bb18-79d189ddd0f8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--b06a2b21-6e91-566b-9013-36204a206111", "toId": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_id": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_name": "TernDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.976Z", "created_at": "2026-09-26T05:54:22.564Z", "modified": "2026-09-26T05:54:23.106Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:54:23.106Z" }, "description_available": false, "entity_type": "indicates", "fromId": "2d8df4da-244f-458a-8c2d-ff67380121e9", "from_id": "2d8df4da-244f-458a-8c2d-ff67380121e9", "from_name": null, "from_type": "Indicator", "id": "e2c3d4a9-c490-4abf-b3c3-5a1c4f0e893b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--52a39ba9-f14c-57a9-89fb-adfd60b7eb92", "toId": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_id": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_name": "Melofee", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.395Z", "created_at": "2026-09-26T05:39:40.030Z", "modified": "2026-09-26T05:39:41.549Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:39:41.549Z" }, "description_available": false, "entity_type": "indicates", "fromId": "8c1b4518-8219-46bb-a619-1c69182e4eec", "from_id": "8c1b4518-8219-46bb-a619-1c69182e4eec", "from_name": null, "from_type": "Indicator", "id": "e2f705bc-4221-4346-9d78-a0a43b02c69f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--67125690-4532-51d9-bfc6-5f3fbf11ec34", "toId": "208a45aa-c18e-4619-9a90-7004849cab40", "to_id": "208a45aa-c18e-4619-9a90-7004849cab40", "to_name": "HemiGate", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.543Z", "created_at": "2026-09-26T05:42:51.297Z", "modified": "2026-09-26T05:42:51.579Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:42:51.579Z" }, "description_available": false, "entity_type": "indicates", "fromId": "653baf3a-7205-44e8-bf30-e40825fbf42a", "from_id": "653baf3a-7205-44e8-bf30-e40825fbf42a", "from_name": null, "from_type": "Indicator", "id": "e3f5c2f0-def4-4398-a466-c3c48754ec26", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--54040c8b-239f-5699-bf42-a3f653e08d4a", "toId": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_id": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_name": "Melofee", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.618Z", "created_at": "2026-09-26T06:11:48.003Z", "modified": "2026-09-26T06:11:48.182Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:11:48.182Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d5009423-c128-4583-ac72-3f07f1201db6", "from_id": "d5009423-c128-4583-ac72-3f07f1201db6", "from_name": null, "from_type": "Indicator", "id": "e4082090-7800-4c27-bc59-73247fda9fcf", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--f9995ce6-0581-5e5d-8cde-961a24f08ed4", "toId": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_id": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_name": "STOWAWAY", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.701Z", "created_at": "2026-09-26T05:47:08.746Z", "modified": "2026-09-26T05:47:09.001Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:47:09.001Z" }, "description_available": false, "entity_type": "indicates", "fromId": "a7a198b8-f0a3-4221-b768-191720f061b9", "from_id": "a7a198b8-f0a3-4221-b768-191720f061b9", "from_name": null, "from_type": "Indicator", "id": "e40ef721-5caa-4a9b-a8c3-192e186b3c71", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--849c7d08-ee56-5920-8f3b-2d19b093c71b", "toId": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_id": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_name": "CrowDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.366Z", "created_at": "2026-09-26T05:39:02.007Z", "modified": "2026-09-26T05:39:02.191Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:39:02.191Z" }, "description_available": false, "entity_type": "indicates", "fromId": "eb51ab90-3d38-4f58-84c1-b0700196508c", "from_id": "eb51ab90-3d38-4f58-84c1-b0700196508c", "from_name": null, "from_type": "Indicator", "id": "e433923f-c443-460b-acc3-6100740a0b83", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--247a8c7c-1871-5431-b3ea-7a3eb2354d26", "toId": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_id": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_name": "HelloBot", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.431Z", "created_at": "2026-09-26T05:40:32.631Z", "modified": "2026-09-26T05:40:33.211Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:40:33.211Z" }, "description_available": false, "entity_type": "indicates", "fromId": "01c74684-bdd9-45d1-84be-d24d189bcb28", "from_id": "01c74684-bdd9-45d1-84be-d24d189bcb28", "from_name": null, "from_type": "Indicator", "id": "e47536cc-2a24-4338-bd7c-fa65cfa559a2", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--20c48c2d-e264-5681-838f-f8cc6795e5e3", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.210Z", "created_at": "2026-09-26T06:00:25.464Z", "modified": "2026-09-26T06:00:25.771Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:00:25.771Z" }, "description_available": false, "entity_type": "indicates", "fromId": "f0b6cabc-d961-4c2b-a9a0-4075ac17972c", "from_id": "f0b6cabc-d961-4c2b-a9a0-4075ac17972c", "from_name": null, "from_type": "Indicator", "id": "e5f49896-35ca-4f5a-b262-c834a838620b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--46e99447-5203-5f60-8aa2-0b9031c5740d", "toId": "208a45aa-c18e-4619-9a90-7004849cab40", "to_id": "208a45aa-c18e-4619-9a90-7004849cab40", "to_name": "HemiGate", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.499Z", "created_at": "2026-09-26T05:41:57.334Z", "modified": "2026-09-26T05:41:57.621Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:41:57.621Z" }, "description_available": false, "entity_type": "indicates", "fromId": "435fff26-763c-4528-906f-e8da098d6aee", "from_id": "435fff26-763c-4528-906f-e8da098d6aee", "from_name": null, "from_type": "Indicator", "id": "e66e9cc3-478d-464e-bc82-ff03cda4adfe", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--d67e9c89-985e-5a4c-be3d-4d84b1dd9f93", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.048Z", "created_at": "2026-09-26T05:34:47.790Z", "modified": "2026-09-26T05:34:50.137Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:34:50.137Z" }, "description_available": false, "entity_type": "based-on", "fromId": "b5ad9feb-b128-47fb-9914-8319d0f48229", "from_id": "b5ad9feb-b128-47fb-9914-8319d0f48229", "from_name": null, "from_type": "Indicator", "id": "e76bf4e7-4b67-48fb-9d0e-687d54ff901f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--368b0a56-c551-58ea-b8da-03b7e110ffe6", "toId": "473feaf2-9501-41f3-bf51-78c6f3efc898", "to_id": "473feaf2-9501-41f3-bf51-78c6f3efc898", "to_name": null, "to_type": "IPv4Addr" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.048Z", "created_at": "2026-09-26T05:56:04.385Z", "modified": "2026-09-26T05:56:04.578Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:56:04.578Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ea8ff45b-69d1-4069-bebe-6f7107045959", "from_id": "ea8ff45b-69d1-4069-bebe-6f7107045959", "from_name": null, "from_type": "Indicator", "id": "e76c7ae8-8d1b-464f-9d1f-056a9f8505e2", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--b780cbb1-8f20-5883-b63d-20d28ca7020a", "toId": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_id": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_name": "CrowDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.595Z", "created_at": "2026-09-26T05:43:46.435Z", "modified": "2026-09-26T05:43:46.594Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:43:46.594Z" }, "description_available": false, "entity_type": "indicates", "fromId": "610b3366-3a08-4e4d-9f45-c8543a783a7f", "from_id": "610b3366-3a08-4e4d-9f45-c8543a783a7f", "from_name": null, "from_type": "Indicator", "id": "e78b6ca2-58fc-4b66-b991-2f2f5d012658", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--c1c8dbdf-5523-575c-9e84-41c15c419bdd", "toId": "208a45aa-c18e-4619-9a90-7004849cab40", "to_id": "208a45aa-c18e-4619-9a90-7004849cab40", "to_name": "HemiGate", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.248Z", "created_at": "2026-09-26T06:01:22.457Z", "modified": "2026-09-26T06:01:22.682Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:01:22.682Z" }, "description_available": false, "entity_type": "indicates", "fromId": "09acd2d3-2afb-4de1-a147-7ae7904d3859", "from_id": "09acd2d3-2afb-4de1-a147-7ae7904d3859", "from_name": null, "from_type": "Indicator", "id": "e7a9e8db-50d5-4265-a3ba-48766b56cf8c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--4e64840f-2296-5751-ae0c-ae002ef0c8ed", "toId": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_id": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_name": "PlugX - S0013", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.120Z", "created_at": "2026-09-26T05:35:05.151Z", "modified": "2026-09-26T05:35:06.101Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:35:06.101Z" }, "description_available": false, "entity_type": "based-on", "fromId": "d7f88a85-9ab3-45b8-982b-294d838461a6", "from_id": "d7f88a85-9ab3-45b8-982b-294d838461a6", "from_name": null, "from_type": "Indicator", "id": "e7c6372b-8cf7-440e-9745-8bb8974fcc77", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--b1d3955a-007d-56f6-9eb7-255d38321a6e", "toId": "d8d488d1-6404-4891-a4d4-e6ad07248ed2", "to_id": "d8d488d1-6404-4891-a4d4-e6ad07248ed2", "to_name": null, "to_type": "IPv4Addr" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.474Z", "created_at": "2026-09-26T06:07:16.967Z", "modified": "2026-09-26T06:07:17.125Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:07:17.125Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d7d77ca0-8c06-4de9-bacb-a526f344e2e9", "from_id": "d7d77ca0-8c06-4de9-bacb-a526f344e2e9", "from_name": null, "from_type": "Indicator", "id": "e81e7724-7f81-49e3-a06e-f8f0373fe739", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--b205a279-ffc6-5eee-9e21-90094a61e586", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.276Z", "created_at": "2026-09-26T06:02:05.892Z", "modified": "2026-09-26T06:02:06.099Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:02:06.099Z" }, "description_available": false, "entity_type": "indicates", "fromId": "2c0b3e29-5bb5-4044-8031-4f47cd51a008", "from_id": "2c0b3e29-5bb5-4044-8031-4f47cd51a008", "from_name": null, "from_type": "Indicator", "id": "e8831bd8-dd9a-445b-81a8-0f3763838d49", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--62280fc0-a331-548d-9670-79791da41446", "toId": "208a45aa-c18e-4619-9a90-7004849cab40", "to_id": "208a45aa-c18e-4619-9a90-7004849cab40", "to_name": "HemiGate", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.548Z", "created_at": "2026-09-26T06:09:01.240Z", "modified": "2026-09-26T06:09:01.559Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:09:01.559Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c9493e20-dc6a-4938-8fee-746005c4ae07", "from_id": "c9493e20-dc6a-4938-8fee-746005c4ae07", "from_name": null, "from_type": "Indicator", "id": "e8e366fb-791b-44d8-9802-7cb53480daab", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--225e146d-642a-525c-8f9f-bd933181c7d0", "toId": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_id": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_name": "TernDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.056Z", "created_at": "2026-09-26T05:34:52.110Z", "modified": "2026-09-26T05:34:52.934Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:34:52.934Z" }, "description_available": false, "entity_type": "based-on", "fromId": "cdadaaa5-0866-4957-b6d7-c64be31a1cf9", "from_id": "cdadaaa5-0866-4957-b6d7-c64be31a1cf9", "from_name": null, "from_type": "Indicator", "id": "e90645ac-4e07-4867-9fe7-ccf7e3ca4027", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--90d0ef07-818b-53a1-87f3-9e3d2e63cba2", "toId": "34e12ea3-8b2b-4e72-bcf2-ce08877ef79c", "to_id": "34e12ea3-8b2b-4e72-bcf2-ce08877ef79c", "to_name": null, "to_type": "IPv4Addr" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.615Z", "created_at": "2026-09-26T05:45:16.726Z", "modified": "2026-09-26T05:45:16.924Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:45:16.924Z" }, "description_available": false, "entity_type": "indicates", "fromId": "3be1760f-af98-4d5c-80e2-c0338b71f391", "from_id": "3be1760f-af98-4d5c-80e2-c0338b71f391", "from_name": null, "from_type": "Indicator", "id": "e979e853-6bdd-4a47-b61f-e3fb4e9d665a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--b69ff263-cfc8-5f23-b84a-fd1cd8118a56", "toId": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_id": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_name": "STOWAWAY", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.680Z", "created_at": "2026-09-26T05:46:44.601Z", "modified": "2026-09-26T05:46:44.861Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:46:44.861Z" }, "description_available": false, "entity_type": "indicates", "fromId": "157ca5cb-7d34-4fc3-83d2-bac13ceb9804", "from_id": "157ca5cb-7d34-4fc3-83d2-bac13ceb9804", "from_name": null, "from_type": "Indicator", "id": "e9cca046-3049-4039-92c3-38c4c4f83da2", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--1ba4d966-b177-5c3f-aa6a-db43e3922478", "toId": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_id": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_name": "STOWAWAY", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.541Z", "created_at": "2026-09-26T06:08:57.220Z", "modified": "2026-09-26T06:08:57.719Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:08:57.719Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c9493e20-dc6a-4938-8fee-746005c4ae07", "from_id": "c9493e20-dc6a-4938-8fee-746005c4ae07", "from_name": null, "from_type": "Indicator", "id": "ea1482ca-ae62-4b3e-85e5-ef641ebd6d27", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--c4e52a4d-5998-5ff1-86f1-55b2648cb8b7", "toId": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_id": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_name": "HelloBot", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.759Z", "created_at": "2026-09-26T05:48:43.135Z", "modified": "2026-09-26T05:48:43.528Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:48:43.528Z" }, "description_available": false, "entity_type": "indicates", "fromId": "1a15e67e-da7b-42ec-b24a-d47fd8aa0767", "from_id": "1a15e67e-da7b-42ec-b24a-d47fd8aa0767", "from_name": null, "from_type": "Indicator", "id": "ea5f7541-34ca-4e0d-963a-88b896a45c95", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--b8132ae5-12fc-5232-80e6-c58e8d0316b4", "toId": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_id": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_name": "HelloBot", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.475Z", "created_at": "2026-09-26T06:07:18.298Z", "modified": "2026-09-26T06:07:18.933Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:07:18.933Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d7d77ca0-8c06-4de9-bacb-a526f344e2e9", "from_id": "d7d77ca0-8c06-4de9-bacb-a526f344e2e9", "from_name": null, "from_type": "Indicator", "id": "eb306e43-ccc5-4cbc-9cc1-b8e6f8e1c708", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--7611af0f-0bf7-5bb6-bde5-e52b5939d2a3", "toId": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_id": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_name": "HelloBot", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.828Z", "created_at": "2026-09-26T05:51:43.490Z", "modified": "2026-09-26T05:51:44.469Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:51:44.469Z" }, "description_available": false, "entity_type": "indicates", "fromId": "10b221ff-1d17-4b38-ae27-73235f136031", "from_id": "10b221ff-1d17-4b38-ae27-73235f136031", "from_name": null, "from_type": "Indicator", "id": "eb4b39f1-045c-4bda-84c6-6fb42a00faea", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--0708c860-7df5-5324-be27-286599b326bd", "toId": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_id": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_name": "Spark - S0543", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.118Z", "created_at": "2026-09-26T05:35:04.821Z", "modified": "2026-09-26T05:35:05.712Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:35:05.712Z" }, "description_available": false, "entity_type": "based-on", "fromId": "66f40cca-cc72-4806-beef-47ae23125e5f", "from_id": "66f40cca-cc72-4806-beef-47ae23125e5f", "from_name": null, "from_type": "Indicator", "id": "ebb45c1e-a5dd-4ddd-aad0-515eed8139e8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--534116d5-bd99-5897-b16a-2615d8d46938", "toId": "2a32de1d-3c80-424d-91d9-77dd6be4c048", "to_id": "2a32de1d-3c80-424d-91d9-77dd6be4c048", "to_name": null, "to_type": "IPv4Addr" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.844Z", "created_at": "2026-09-26T05:52:08.497Z", "modified": "2026-09-26T05:52:08.740Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:52:08.740Z" }, "description_available": false, "entity_type": "indicates", "fromId": "6ae45569-c03b-471f-80ff-50d7a804075a", "from_id": "6ae45569-c03b-471f-80ff-50d7a804075a", "from_name": null, "from_type": "Indicator", "id": "ebc6db03-5fc6-43ca-93dd-92b374d41747", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--ee1fbe85-ab9f-5bb9-8c94-19c21d181122", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.658Z", "created_at": "2026-09-26T05:46:06.583Z", "modified": "2026-09-26T05:46:07.014Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:46:07.014Z" }, "description_available": false, "entity_type": "indicates", "fromId": "681c2240-1fb8-466d-a533-8f1d8132b27b", "from_id": "681c2240-1fb8-466d-a533-8f1d8132b27b", "from_name": null, "from_type": "Indicator", "id": "ec205287-10f2-4edd-aa73-53fb5a633a93", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--841b61c9-1cb8-5c09-9c9e-7bc561da49e7", "toId": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_id": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_name": "Spark - S0543", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.571Z", "created_at": "2026-09-26T06:10:58.910Z", "modified": "2026-09-26T06:10:59.226Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:10:59.226Z" }, "description_available": false, "entity_type": "indicates", "fromId": "6ac03fc4-4c10-4d8f-b546-7ce2b9422c39", "from_id": "6ac03fc4-4c10-4d8f-b546-7ce2b9422c39", "from_name": null, "from_type": "Indicator", "id": "ec367bad-6394-41b1-b579-ef8c16a0048f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--d7a7e4c9-333c-51bd-b0f2-458cd7ae7b1e", "toId": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_id": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_name": "TernDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.048Z", "created_at": "2026-09-26T05:56:01.521Z", "modified": "2026-09-26T05:56:01.682Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:56:01.682Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ea8ff45b-69d1-4069-bebe-6f7107045959", "from_id": "ea8ff45b-69d1-4069-bebe-6f7107045959", "from_name": null, "from_type": "Indicator", "id": "ec4bc272-fda1-4bc2-8c0a-af6371be2a8b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--519079dd-2094-5f11-b5d9-66fe149c2302", "toId": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_id": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_name": "STOWAWAY", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.256Z", "created_at": "2026-09-26T05:35:23.903Z", "modified": "2026-09-26T05:35:24.046Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:35:24.046Z" }, "description_available": false, "entity_type": "indicates", "fromId": "f7f8f4c3-42b1-433b-a4ab-f67c83968004", "from_id": "f7f8f4c3-42b1-433b-a4ab-f67c83968004", "from_name": null, "from_type": "Indicator", "id": "ecee39ea-6ad3-4900-83a9-665d18c94dff", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--9a0a03c6-a434-5f5a-a601-67bc8c4f5964", "toId": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_id": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_name": "PlugX - S0013", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.403Z", "created_at": "2026-09-26T06:05:42.538Z", "modified": "2026-09-26T06:05:42.825Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:05:42.825Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ac6046d8-f570-4eca-af26-b22ab4b74e00", "from_id": "ac6046d8-f570-4eca-af26-b22ab4b74e00", "from_name": null, "from_type": "Indicator", "id": "ed5e8a71-df0a-4263-9a62-5558f9ad049a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--2b789b26-4cc8-5229-9175-3efd6ef1ab90", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.978Z", "created_at": "2026-09-26T05:54:27.140Z", "modified": "2026-09-26T05:54:27.310Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:54:27.310Z" }, "description_available": false, "entity_type": "indicates", "fromId": "2d8df4da-244f-458a-8c2d-ff67380121e9", "from_id": "2d8df4da-244f-458a-8c2d-ff67380121e9", "from_name": null, "from_type": "Indicator", "id": "ed9661a7-223d-4f41-821c-ab9faa45cfad", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--c91ae69c-7ea1-58c2-9026-6f785904c6ea", "toId": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_id": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_name": "HelloBot", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.276Z", "created_at": "2026-09-26T06:02:04.124Z", "modified": "2026-09-26T06:02:04.947Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:02:04.947Z" }, "description_available": false, "entity_type": "indicates", "fromId": "2c0b3e29-5bb5-4044-8031-4f47cd51a008", "from_id": "2c0b3e29-5bb5-4044-8031-4f47cd51a008", "from_name": null, "from_type": "Indicator", "id": "ee67f7b5-ce07-473d-a1ab-b66b33534bef", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--3c2a6a60-d32e-52ce-a97e-1f4a5d26699a", "toId": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_id": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_name": "TernDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.326Z", "created_at": "2026-09-26T05:36:56.406Z", "modified": "2026-09-26T05:36:56.643Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:36:56.643Z" }, "description_available": false, "entity_type": "indicates", "fromId": "b2490479-1c8f-4288-a8e1-23589e1535cf", "from_id": "b2490479-1c8f-4288-a8e1-23589e1535cf", "from_name": null, "from_type": "Indicator", "id": "ee86d7f2-aeb3-4153-bd0e-b789e9a01a75", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--d08238ae-b60f-5189-82a4-f8615e0788ef", "toId": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_id": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_name": "STOWAWAY", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.412Z", "created_at": "2026-09-26T06:05:52.186Z", "modified": "2026-09-26T06:05:52.317Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:05:52.317Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ac6046d8-f570-4eca-af26-b22ab4b74e00", "from_id": "ac6046d8-f570-4eca-af26-b22ab4b74e00", "from_name": null, "from_type": "Indicator", "id": "efceedb4-14ff-4b9a-b436-247888bf1d8c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--ee90cbeb-b747-54f1-9a55-ebbc3a78cb02", "toId": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_id": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_name": "TernDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.679Z", "created_at": "2026-09-26T05:46:40.111Z", "modified": "2026-09-26T05:46:40.352Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:46:40.352Z" }, "description_available": false, "entity_type": "indicates", "fromId": "157ca5cb-7d34-4fc3-83d2-bac13ceb9804", "from_id": "157ca5cb-7d34-4fc3-83d2-bac13ceb9804", "from_name": null, "from_type": "Indicator", "id": "efed1a3e-1a0a-480e-b001-6f7a3d827190", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--668102b1-5647-5899-94f5-73adcb514acf", "toId": "657ff382-024b-45a4-974a-3e41f1762074", "to_id": "657ff382-024b-45a4-974a-3e41f1762074", "to_name": "Cobalt Strike - S0154", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.254Z", "created_at": "2026-09-26T05:35:22.038Z", "modified": "2026-09-26T05:35:22.566Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:35:22.566Z" }, "description_available": false, "entity_type": "indicates", "fromId": "f7f8f4c3-42b1-433b-a4ab-f67c83968004", "from_id": "f7f8f4c3-42b1-433b-a4ab-f67c83968004", "from_name": null, "from_type": "Indicator", "id": "f09bfb58-3d31-4f57-9759-38e10d967764", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--a19fae9b-d8d1-5c86-b2b3-2ca6e1a5a25e", "toId": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_id": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_name": "Melofee", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.327Z", "created_at": "2026-09-26T05:36:56.886Z", "modified": "2026-09-26T05:36:59.665Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:36:59.665Z" }, "description_available": false, "entity_type": "indicates", "fromId": "b2490479-1c8f-4288-a8e1-23589e1535cf", "from_id": "b2490479-1c8f-4288-a8e1-23589e1535cf", "from_name": null, "from_type": "Indicator", "id": "f0aa864b-0fcf-4f79-a9fd-35e875416cfc", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--3692de38-e404-5129-b34a-4b3b1ffe5927", "toId": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_id": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_name": "CrowDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.544Z", "created_at": "2026-09-26T05:42:52.947Z", "modified": "2026-09-26T05:42:53.160Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:42:53.160Z" }, "description_available": false, "entity_type": "indicates", "fromId": "653baf3a-7205-44e8-bf30-e40825fbf42a", "from_id": "653baf3a-7205-44e8-bf30-e40825fbf42a", "from_name": null, "from_type": "Indicator", "id": "f0e7cd49-5abb-4836-8df3-6897f4f456ed", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--c535f434-3666-5672-9a9c-701d67b90f78", "toId": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_id": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_name": "HelloBot", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.022Z", "created_at": "2026-09-26T05:34:40.628Z", "modified": "2026-09-26T05:34:42.647Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:34:42.647Z" }, "description_available": false, "entity_type": "based-on", "fromId": "94a7b3a6-0b64-4746-86ff-6647d1a2df8d", "from_id": "94a7b3a6-0b64-4746-86ff-6647d1a2df8d", "from_name": null, "from_type": "Indicator", "id": "f119d930-9f6c-4a93-ba74-0fb59ef42cb5", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--1d0c22e7-c926-5814-8afd-78bca20519c8", "toId": "d7cc6736-6d0e-44e8-ad46-b060d3d6980d", "to_id": "d7cc6736-6d0e-44e8-ad46-b060d3d6980d", "to_name": null, "to_type": "Hostname" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.518Z", "created_at": "2026-09-26T06:08:20.463Z", "modified": "2026-09-26T06:08:20.664Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:08:20.664Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c08d31e4-ff5a-45b7-8880-330403eced75", "from_id": "c08d31e4-ff5a-45b7-8880-330403eced75", "from_name": null, "from_type": "Indicator", "id": "f226b77f-7ebe-433e-8ff3-2fa79b361c15", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--5438d9ba-0323-5322-9407-08ad81f6d3da", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.430Z", "created_at": "2026-09-26T05:40:35.077Z", "modified": "2026-09-26T05:40:35.181Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:40:35.181Z" }, "description_available": false, "entity_type": "indicates", "fromId": "01c74684-bdd9-45d1-84be-d24d189bcb28", "from_id": "01c74684-bdd9-45d1-84be-d24d189bcb28", "from_name": null, "from_type": "Indicator", "id": "f22e087c-b5d4-42c0-80f3-245816db0965", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--b41948cf-d8dd-5525-b78f-acc25ac9949e", "toId": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_id": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_name": "Melofee", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.207Z", "created_at": "2026-09-26T06:00:05.299Z", "modified": "2026-09-26T06:00:06.739Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:00:06.739Z" }, "description_available": false, "entity_type": "indicates", "fromId": "f0b6cabc-d961-4c2b-a9a0-4075ac17972c", "from_id": "f0b6cabc-d961-4c2b-a9a0-4075ac17972c", "from_name": null, "from_type": "Indicator", "id": "f33365d3-ca09-4c35-804b-8af394756a8b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--f512cb7c-fa23-50df-af27-e7ea6b761a7c", "toId": "657ff382-024b-45a4-974a-3e41f1762074", "to_id": "657ff382-024b-45a4-974a-3e41f1762074", "to_name": "Cobalt Strike - S0154", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.144Z", "created_at": "2026-09-26T05:59:02.096Z", "modified": "2026-09-26T05:59:02.256Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:59:02.256Z" }, "description_available": false, "entity_type": "indicates", "fromId": "56d609d1-e0ef-4633-8cfe-a3e1f792fbff", "from_id": "56d609d1-e0ef-4633-8cfe-a3e1f792fbff", "from_name": null, "from_type": "Indicator", "id": "f3abe9cd-308e-4156-92be-2e02428c32a7", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--13b878c0-99dd-5fcd-ac5f-a402bf7a19b7", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.745Z", "created_at": "2026-09-26T05:48:14.950Z", "modified": "2026-09-26T05:48:15.158Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:48:15.158Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ce5e270a-a0f5-4d07-9faf-6493364c1a2b", "from_id": "ce5e270a-a0f5-4d07-9faf-6493364c1a2b", "from_name": null, "from_type": "Indicator", "id": "f3d965a1-0df6-4472-9147-6aa6912f2b0b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--613808f8-d148-5a03-80a3-6df08434dff7", "toId": "208a45aa-c18e-4619-9a90-7004849cab40", "to_id": "208a45aa-c18e-4619-9a90-7004849cab40", "to_name": "HemiGate", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.382Z", "created_at": "2026-09-26T06:05:16.933Z", "modified": "2026-09-26T06:05:17.145Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:05:17.145Z" }, "description_available": false, "entity_type": "indicates", "fromId": "2d16d740-ae8a-45ff-8a8b-9032f924c3fa", "from_id": "2d16d740-ae8a-45ff-8a8b-9032f924c3fa", "from_name": null, "from_type": "Indicator", "id": "f449fa62-1350-4117-88ae-cb55d039641e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--20631a16-c2c5-538b-93c4-34651217c972", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.383Z", "created_at": "2026-09-26T06:05:17.376Z", "modified": "2026-09-26T06:05:17.553Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:05:17.553Z" }, "description_available": false, "entity_type": "indicates", "fromId": "2d16d740-ae8a-45ff-8a8b-9032f924c3fa", "from_id": "2d16d740-ae8a-45ff-8a8b-9032f924c3fa", "from_name": null, "from_type": "Indicator", "id": "f4681e83-7493-4d70-b52c-595b953fbdae", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--c4ce86bd-9299-5f06-a821-527b30aaaa28", "toId": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_id": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_name": "PlugX - S0013", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.653Z", "created_at": "2026-09-26T05:46:04.534Z", "modified": "2026-09-26T05:46:05.462Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:46:05.462Z" }, "description_available": false, "entity_type": "indicates", "fromId": "681c2240-1fb8-466d-a533-8f1d8132b27b", "from_id": "681c2240-1fb8-466d-a533-8f1d8132b27b", "from_name": null, "from_type": "Indicator", "id": "f48dc154-1a49-4b63-9a51-425997e2ca1c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--5a7ff038-585a-5090-8cf1-7aa8c0c3c8d2", "toId": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_id": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_name": "HelloBot", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.724Z", "created_at": "2026-09-26T05:47:41.769Z", "modified": "2026-09-26T05:47:43.227Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:47:43.227Z" }, "description_available": false, "entity_type": "indicates", "fromId": "de51cd6f-4b7a-4c4b-9b3d-d5094f650356", "from_id": "de51cd6f-4b7a-4c4b-9b3d-d5094f650356", "from_name": null, "from_type": "Indicator", "id": "f4a234b9-f7cf-4b98-92e1-c702d94d2722", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--4626cf4d-65a2-58ef-ba10-ca73b3d28511", "toId": "208a45aa-c18e-4619-9a90-7004849cab40", "to_id": "208a45aa-c18e-4619-9a90-7004849cab40", "to_name": "HemiGate", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.679Z", "created_at": "2026-09-26T05:46:39.009Z", "modified": "2026-09-26T05:46:39.741Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:46:39.741Z" }, "description_available": false, "entity_type": "indicates", "fromId": "157ca5cb-7d34-4fc3-83d2-bac13ceb9804", "from_id": "157ca5cb-7d34-4fc3-83d2-bac13ceb9804", "from_name": null, "from_type": "Indicator", "id": "f4bd2c28-2293-4e31-a751-9bc9f5afdfc7", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--3a52bf99-9939-5e0c-ad2f-7ef6c37fb999", "toId": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_id": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_name": "Spark - S0543", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.802Z", "created_at": "2026-09-26T05:49:44.139Z", "modified": "2026-09-26T05:49:44.371Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:49:44.371Z" }, "description_available": false, "entity_type": "indicates", "fromId": "2227cc4b-afc7-4060-b897-a1a458d90abd", "from_id": "2227cc4b-afc7-4060-b897-a1a458d90abd", "from_name": null, "from_type": "Indicator", "id": "f4ed5f1d-bed6-4f90-937d-3f4a958b9194", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--ea430ff2-de22-5be7-be91-12278798c082", "toId": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_id": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_name": "HelloBot", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.808Z", "created_at": "2026-09-26T05:49:50.574Z", "modified": "2026-09-26T05:49:50.740Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:49:50.740Z" }, "description_available": false, "entity_type": "indicates", "fromId": "2227cc4b-afc7-4060-b897-a1a458d90abd", "from_id": "2227cc4b-afc7-4060-b897-a1a458d90abd", "from_name": null, "from_type": "Indicator", "id": "f53189a1-f33c-4359-b5e5-8f2484b97761", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--57ba1f7e-9d96-5a28-9aae-884c53505deb", "toId": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_id": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_name": "STOWAWAY", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.318Z", "created_at": "2026-09-26T06:02:58.556Z", "modified": "2026-09-26T06:03:00.759Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:03:00.759Z" }, "description_available": false, "entity_type": "indicates", "fromId": "6fbf4d94-634a-4763-b0e5-0cbe6e9f67ea", "from_id": "6fbf4d94-634a-4763-b0e5-0cbe6e9f67ea", "from_name": null, "from_type": "Indicator", "id": "f5500fe2-2dc6-4f6c-9794-8a31bd34d308", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--5cf56e86-4772-5d30-a546-e0f09de045c0", "toId": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_id": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_name": "TernDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.231Z", "created_at": "2026-09-26T05:35:17.864Z", "modified": "2026-09-26T05:35:18.177Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:35:18.177Z" }, "description_available": false, "entity_type": "based-on", "fromId": "5330b1c5-bebb-4760-ae47-12dd0e0d1e23", "from_id": "5330b1c5-bebb-4760-ae47-12dd0e0d1e23", "from_name": null, "from_type": "Indicator", "id": "f5ab350d-69fb-43cd-8911-40c99c370ca5", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--cf78e67d-98b0-54ce-ad3a-b5299401cb5e", "toId": "0c77a85a-303f-453d-92ba-020828262896", "to_id": "0c77a85a-303f-453d-92ba-020828262896", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.743Z", "created_at": "2026-09-26T05:48:20.915Z", "modified": "2026-09-26T05:48:21.161Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:48:21.161Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ce5e270a-a0f5-4d07-9faf-6493364c1a2b", "from_id": "ce5e270a-a0f5-4d07-9faf-6493364c1a2b", "from_name": null, "from_type": "Indicator", "id": "f6057bee-4ead-4fbf-964a-30227d9259b2", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--09045725-bd85-5ca5-afa1-cddc5c00442c", "toId": "657ff382-024b-45a4-974a-3e41f1762074", "to_id": "657ff382-024b-45a4-974a-3e41f1762074", "to_name": "Cobalt Strike - S0154", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.478Z", "created_at": "2026-09-26T05:41:32.301Z", "modified": "2026-09-26T05:41:32.596Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:41:32.596Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c2dcc828-9ae2-404f-a201-0074f26085ba", "from_id": "c2dcc828-9ae2-404f-a201-0074f26085ba", "from_name": null, "from_type": "Indicator", "id": "f6b029d5-fb5e-4a54-9263-208281e30c1c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--9767ae83-ca3d-57f8-9e19-be436bd2057d", "toId": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_id": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "to_name": "HelloBot", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.703Z", "created_at": "2026-09-26T05:47:12.711Z", "modified": "2026-09-26T05:47:13.051Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:47:13.051Z" }, "description_available": false, "entity_type": "indicates", "fromId": "a7a198b8-f0a3-4221-b768-191720f061b9", "from_id": "a7a198b8-f0a3-4221-b768-191720f061b9", "from_name": null, "from_type": "Indicator", "id": "f6e3c5f9-c965-4718-8609-4923c92be2e6", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--5a25e192-1e4d-5504-a5f4-701aee393b00", "toId": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_id": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "to_name": "RatelS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.437Z", "created_at": "2026-09-26T05:40:39.344Z", "modified": "2026-09-26T05:40:39.595Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:40:39.595Z" }, "description_available": false, "entity_type": "indicates", "fromId": "01c74684-bdd9-45d1-84be-d24d189bcb28", "from_id": "01c74684-bdd9-45d1-84be-d24d189bcb28", "from_name": null, "from_type": "Indicator", "id": "f752ddae-8170-4aae-9a39-d86987548a8f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--9523734d-1be6-5c01-91a6-0be1f0191899", "toId": "657ff382-024b-45a4-974a-3e41f1762074", "to_id": "657ff382-024b-45a4-974a-3e41f1762074", "to_name": "Cobalt Strike - S0154", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.028Z", "created_at": "2026-09-26T05:55:31.674Z", "modified": "2026-09-26T05:55:31.898Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:55:31.898Z" }, "description_available": false, "entity_type": "indicates", "fromId": "cd0c196b-8e17-4794-80e8-7129d42950e2", "from_id": "cd0c196b-8e17-4794-80e8-7129d42950e2", "from_name": null, "from_type": "Indicator", "id": "f7cf8d55-6a59-4525-b16c-3d0b8a9bbc87", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--8440ea16-3d8b-5040-8a15-b853151c3534", "toId": "208a45aa-c18e-4619-9a90-7004849cab40", "to_id": "208a45aa-c18e-4619-9a90-7004849cab40", "to_name": "HemiGate", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.810Z", "created_at": "2026-09-26T05:49:54.163Z", "modified": "2026-09-26T05:49:54.391Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:49:54.391Z" }, "description_available": false, "entity_type": "indicates", "fromId": "2227cc4b-afc7-4060-b897-a1a458d90abd", "from_id": "2227cc4b-afc7-4060-b897-a1a458d90abd", "from_name": null, "from_type": "Indicator", "id": "f80282ef-968e-4e90-ae53-2629baa82c87", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--4702e52e-833e-578a-954a-b1508255620f", "toId": "208a45aa-c18e-4619-9a90-7004849cab40", "to_id": "208a45aa-c18e-4619-9a90-7004849cab40", "to_name": "HemiGate", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.005Z", "created_at": "2026-09-26T05:54:58.472Z", "modified": "2026-09-26T05:54:58.895Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:54:58.895Z" }, "description_available": false, "entity_type": "indicates", "fromId": "26da206d-5fde-40ba-bc45-0f24f378263c", "from_id": "26da206d-5fde-40ba-bc45-0f24f378263c", "from_name": null, "from_type": "Indicator", "id": "f877884d-5c19-4f16-976d-06bc1f647d4b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--179b72e4-4b02-528e-bad5-d82e8d05d856", "toId": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_id": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_name": "CrowDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.940Z", "created_at": "2026-09-26T05:53:41.141Z", "modified": "2026-09-26T05:53:41.350Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:53:41.350Z" }, "description_available": false, "entity_type": "indicates", "fromId": "1315ce2a-6659-4f4f-b9b7-e2450564ca9b", "from_id": "1315ce2a-6659-4f4f-b9b7-e2450564ca9b", "from_name": null, "from_type": "Indicator", "id": "f888b08e-28e0-413b-97a6-a3fcacf1dbcd", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--c84ae436-7d4f-50cd-8fc9-83421a885bfa", "toId": "657ff382-024b-45a4-974a-3e41f1762074", "to_id": "657ff382-024b-45a4-974a-3e41f1762074", "to_name": "Cobalt Strike - S0154", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.168Z", "created_at": "2026-09-26T05:59:28.572Z", "modified": "2026-09-26T05:59:28.927Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:59:28.927Z" }, "description_available": false, "entity_type": "indicates", "fromId": "350ff6fa-1c04-4870-b345-041e0d3d6d92", "from_id": "350ff6fa-1c04-4870-b345-041e0d3d6d92", "from_name": null, "from_type": "Indicator", "id": "f8da4e3f-0178-43fc-b664-9fd9b7b74afd", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--654a3626-11a1-5a41-b88d-b577c95370fc", "toId": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_id": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_name": "Melofee", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.200Z", "created_at": "2026-09-26T05:59:59.745Z", "modified": "2026-09-26T06:00:01.787Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:00:01.787Z" }, "description_available": false, "entity_type": "indicates", "fromId": "f0b6cabc-d961-4c2b-a9a0-4075ac17972c", "from_id": "f0b6cabc-d961-4c2b-a9a0-4075ac17972c", "from_name": null, "from_type": "Indicator", "id": "f9236db1-13b0-4bda-92d6-f15875b182fd", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--23079bc9-b1b2-53b0-87df-1b6680d753e6", "toId": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_id": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_name": "PlugX - S0013", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.439Z", "created_at": "2026-09-26T05:40:40.878Z", "modified": "2026-09-26T05:40:41.067Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:40:41.067Z" }, "description_available": false, "entity_type": "indicates", "fromId": "01c74684-bdd9-45d1-84be-d24d189bcb28", "from_id": "01c74684-bdd9-45d1-84be-d24d189bcb28", "from_name": null, "from_type": "Indicator", "id": "f9501cde-8f13-45cc-8788-41975647add2", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--eb44eee1-0654-5dd9-b1d4-d47f6e1749ec", "toId": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_id": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "to_name": "TernDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.884Z", "created_at": "2026-09-26T05:52:39.345Z", "modified": "2026-09-26T05:52:39.556Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:52:39.556Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c77e0b5e-a168-4a6f-993c-bc7076c78285", "from_id": "c77e0b5e-a168-4a6f-993c-bc7076c78285", "from_name": null, "from_type": "Indicator", "id": "f96ce3ce-15db-44f9-8108-fe90b0cf3032", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--96ae4fe1-8f59-5212-885f-d393e415ac4f", "toId": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_id": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_name": "PlugX - S0013", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.654Z", "created_at": "2026-09-26T05:46:03.696Z", "modified": "2026-09-26T05:46:03.838Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:46:03.838Z" }, "description_available": false, "entity_type": "indicates", "fromId": "681c2240-1fb8-466d-a533-8f1d8132b27b", "from_id": "681c2240-1fb8-466d-a533-8f1d8132b27b", "from_name": null, "from_type": "Indicator", "id": "f98c5bb3-d3d7-4a8e-aa8e-b74803fd6058", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--2e600d95-190d-5949-ba00-536db3f707ff", "toId": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_id": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_name": "PlugX - S0013", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.305Z", "created_at": "2026-09-26T05:36:21.838Z", "modified": "2026-09-26T05:36:21.966Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:36:21.966Z" }, "description_available": false, "entity_type": "indicates", "fromId": "20bc512e-2f63-438d-bcee-abdf39614bf5", "from_id": "20bc512e-2f63-438d-bcee-abdf39614bf5", "from_name": null, "from_type": "Indicator", "id": "f9b994e1-152f-497e-a5ad-6b13ff0c1690", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--40ae5add-ea02-58ef-b714-0cd0b8fdc5fd", "toId": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_id": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_name": "CrowDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.715Z", "created_at": "2026-09-26T05:47:33.672Z", "modified": "2026-09-26T05:47:34.073Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:47:34.073Z" }, "description_available": false, "entity_type": "indicates", "fromId": "de51cd6f-4b7a-4c4b-9b3d-d5094f650356", "from_id": "de51cd6f-4b7a-4c4b-9b3d-d5094f650356", "from_name": null, "from_type": "Indicator", "id": "f9e46d27-0b30-4c85-985e-0a8f8d241df8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--ad799649-5bb3-51e8-b84d-3c44ce6db311", "toId": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_id": "82dae33b-e459-494e-ba12-c05113d9bb06", "to_name": "Melofee", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.525Z", "created_at": "2026-09-26T06:08:26.804Z", "modified": "2026-09-26T06:08:27.130Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:08:27.130Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c08d31e4-ff5a-45b7-8880-330403eced75", "from_id": "c08d31e4-ff5a-45b7-8880-330403eced75", "from_name": null, "from_type": "Indicator", "id": "fa540fde-e4d7-44e4-a5fe-b32cbaad383f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--d94b052d-afd8-5c1f-9cb2-dbae18212fff", "toId": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_id": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_name": "CrowDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.616Z", "created_at": "2026-09-26T05:45:17.188Z", "modified": "2026-09-26T05:45:17.354Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:45:17.354Z" }, "description_available": false, "entity_type": "indicates", "fromId": "3be1760f-af98-4d5c-80e2-c0338b71f391", "from_id": "3be1760f-af98-4d5c-80e2-c0338b71f391", "from_name": null, "from_type": "Indicator", "id": "fa930e22-b345-4a09-a541-c671c6260618", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--369703a6-8cd4-5402-9946-6d0283255029", "toId": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_id": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_name": "CrowDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.282Z", "created_at": "2026-09-26T05:35:59.260Z", "modified": "2026-09-26T05:35:59.482Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:35:59.482Z" }, "description_available": false, "entity_type": "indicates", "fromId": "48f22366-f0fd-4667-b458-fc531795e8ff", "from_id": "48f22366-f0fd-4667-b458-fc531795e8ff", "from_name": null, "from_type": "Indicator", "id": "faa998bb-7ff2-414f-a4ff-d34de9137ab7", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--6c967e40-0a35-5a47-99d6-37017bf9fecc", "toId": "657ff382-024b-45a4-974a-3e41f1762074", "to_id": "657ff382-024b-45a4-974a-3e41f1762074", "to_name": "Cobalt Strike - S0154", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.233Z", "created_at": "2026-09-26T06:00:55.318Z", "modified": "2026-09-26T06:00:55.493Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:00:55.493Z" }, "description_available": false, "entity_type": "indicates", "fromId": "aaf834aa-275b-4a6a-9790-6971e8adf52d", "from_id": "aaf834aa-275b-4a6a-9790-6971e8adf52d", "from_name": null, "from_type": "Indicator", "id": "fb2d2270-49d9-4b99-9ace-670200e52091", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--0e5a9965-77ea-5a88-9d4b-a81bbbb00ffe", "toId": "208a45aa-c18e-4619-9a90-7004849cab40", "to_id": "208a45aa-c18e-4619-9a90-7004849cab40", "to_name": "HemiGate", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.013Z", "created_at": "2026-09-26T05:34:38.156Z", "modified": "2026-09-26T05:34:38.563Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:34:38.563Z" }, "description_available": false, "entity_type": "based-on", "fromId": "f7f8f4c3-42b1-433b-a4ab-f67c83968004", "from_id": "f7f8f4c3-42b1-433b-a4ab-f67c83968004", "from_name": null, "from_type": "Indicator", "id": "fb730bd8-192a-45e5-bb0a-4a29e9e85146", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--c9fcc0ad-0a2a-5373-9e7e-d7d69e42be7c", "toId": "80884810-4591-4dfe-970a-330ea35c15af", "to_id": "80884810-4591-4dfe-970a-330ea35c15af", "to_name": null, "to_type": "IPv4Addr" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.394Z", "created_at": "2026-09-26T05:39:42.053Z", "modified": "2026-09-26T05:39:42.483Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:39:42.483Z" }, "description_available": false, "entity_type": "indicates", "fromId": "8c1b4518-8219-46bb-a619-1c69182e4eec", "from_id": "8c1b4518-8219-46bb-a619-1c69182e4eec", "from_name": null, "from_type": "Indicator", "id": "fb7d92dc-b28e-40be-8a67-c0d8d11f3cc8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--26876056-6e39-5b43-87db-3c6c4e48d5d1", "toId": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_id": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "to_name": "CrowDoor", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.829Z", "created_at": "2026-09-26T05:51:45.824Z", "modified": "2026-09-26T05:51:45.986Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:51:45.986Z" }, "description_available": false, "entity_type": "indicates", "fromId": "10b221ff-1d17-4b38-ae27-73235f136031", "from_id": "10b221ff-1d17-4b38-ae27-73235f136031", "from_name": null, "from_type": "Indicator", "id": "fb81e956-8f15-4a5c-b226-6a9848aef814", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--abed818b-d6dd-54df-8789-12d5eb2b8708", "toId": "657ff382-024b-45a4-974a-3e41f1762074", "to_id": "657ff382-024b-45a4-974a-3e41f1762074", "to_name": "Cobalt Strike - S0154", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.571Z", "created_at": "2026-09-26T05:43:24.740Z", "modified": "2026-09-26T05:43:24.974Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:43:24.974Z" }, "description_available": false, "entity_type": "indicates", "fromId": "b5ad9feb-b128-47fb-9914-8319d0f48229", "from_id": "b5ad9feb-b128-47fb-9914-8319d0f48229", "from_name": null, "from_type": "Indicator", "id": "fbcd368e-63b5-42a9-9643-b1c2924c6eb8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--dcfdc88e-3b2d-5f03-9cb0-9e1dbd646fae", "toId": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_id": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_name": "STOWAWAY", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.618Z", "created_at": "2026-09-26T06:11:48.403Z", "modified": "2026-09-26T06:11:48.602Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:11:48.602Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d5009423-c128-4583-ac72-3f07f1201db6", "from_id": "d5009423-c128-4583-ac72-3f07f1201db6", "from_name": null, "from_type": "Indicator", "id": "fc4ff828-da19-42bd-8205-41672397d773", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--909dd11b-5540-5a75-8469-4a17e96a8956", "toId": "657ff382-024b-45a4-974a-3e41f1762074", "to_id": "657ff382-024b-45a4-974a-3e41f1762074", "to_name": "Cobalt Strike - S0154", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.417Z", "created_at": "2026-09-26T05:40:10.822Z", "modified": "2026-09-26T05:40:11.095Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:40:11.095Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d4aa073f-c77f-4db6-a515-5246469cf6b0", "from_id": "d4aa073f-c77f-4db6-a515-5246469cf6b0", "from_name": null, "from_type": "Indicator", "id": "fd1ac345-2543-4e0e-bc08-c08ed2b200b2", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--6eb402db-baf2-5647-9c32-a66bac60562c", "toId": "208a45aa-c18e-4619-9a90-7004849cab40", "to_id": "208a45aa-c18e-4619-9a90-7004849cab40", "to_name": "HemiGate", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.371Z", "created_at": "2026-09-26T05:39:02.904Z", "modified": "2026-09-26T05:39:03.123Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:39:03.123Z" }, "description_available": false, "entity_type": "indicates", "fromId": "eb51ab90-3d38-4f58-84c1-b0700196508c", "from_id": "eb51ab90-3d38-4f58-84c1-b0700196508c", "from_name": null, "from_type": "Indicator", "id": "fd55db52-ca57-445a-adf5-a850a3c1a7b1", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--6707d0b4-4193-5486-8213-5f3e7ff4bc89", "toId": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_id": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "to_name": "Spark - S0543", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.977Z", "created_at": "2026-09-26T05:54:25.568Z", "modified": "2026-09-26T05:54:25.801Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:54:25.801Z" }, "description_available": false, "entity_type": "indicates", "fromId": "2d8df4da-244f-458a-8c2d-ff67380121e9", "from_id": "2d8df4da-244f-458a-8c2d-ff67380121e9", "from_name": null, "from_type": "Indicator", "id": "fdc90e8f-5cf4-4847-ae6e-328c1eb79d6e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--8b348b72-b0d5-566f-bb24-2721dcdd8e54", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.270Z", "created_at": "2026-09-26T06:01:58.191Z", "modified": "2026-09-26T06:01:58.354Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:01:58.354Z" }, "description_available": false, "entity_type": "indicates", "fromId": "2c0b3e29-5bb5-4044-8031-4f47cd51a008", "from_id": "2c0b3e29-5bb5-4044-8031-4f47cd51a008", "from_name": null, "from_type": "Indicator", "id": "fde636f8-3c7d-4657-af92-c7f3c4256753", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--1cb9a4d2-ccab-57dc-ad0d-6656c024cbf1", "toId": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_id": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_name": "PlugX - S0013", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.150Z", "created_at": "2026-09-26T05:59:04.934Z", "modified": "2026-09-26T05:59:05.970Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:59:05.970Z" }, "description_available": false, "entity_type": "indicates", "fromId": "56d609d1-e0ef-4633-8cfe-a3e1f792fbff", "from_id": "56d609d1-e0ef-4633-8cfe-a3e1f792fbff", "from_name": null, "from_type": "Indicator", "id": "fdf9b980-17b6-4d5d-af7d-596d98b53c00", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--00eb657d-f3f0-5973-8c03-33e3cf373cfe", "toId": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_id": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_name": "STOWAWAY", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.232Z", "created_at": "2026-09-26T06:00:54.084Z", "modified": "2026-09-26T06:00:54.251Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:00:54.251Z" }, "description_available": false, "entity_type": "indicates", "fromId": "aaf834aa-275b-4a6a-9790-6971e8adf52d", "from_id": "aaf834aa-275b-4a6a-9790-6971e8adf52d", "from_name": null, "from_type": "Indicator", "id": "fe5348d8-f5a4-4ff5-9157-8797bbf5bbb7", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--a6605f35-6ff7-52e0-b2e3-0ecd06586d4b", "toId": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_id": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_name": "STOWAWAY", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.319Z", "created_at": "2026-09-26T06:03:04.095Z", "modified": "2026-09-26T06:03:10.959Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:03:10.959Z" }, "description_available": false, "entity_type": "indicates", "fromId": "6fbf4d94-634a-4763-b0e5-0cbe6e9f67ea", "from_id": "6fbf4d94-634a-4763-b0e5-0cbe6e9f67ea", "from_name": null, "from_type": "Indicator", "id": "fea26e3f-9d93-4735-a987-31090a882765", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--0b8e2ebe-08f8-5678-b69f-486135212428", "toId": "208a45aa-c18e-4619-9a90-7004849cab40", "to_id": "208a45aa-c18e-4619-9a90-7004849cab40", "to_name": "HemiGate", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.890Z", "created_at": "2026-09-26T05:52:43.833Z", "modified": "2026-09-26T05:52:44.056Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:52:44.056Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c77e0b5e-a168-4a6f-993c-bc7076c78285", "from_id": "c77e0b5e-a168-4a6f-993c-bc7076c78285", "from_name": null, "from_type": "Indicator", "id": "feae150d-0134-4ad6-b4f1-0aa3739ad4a1", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--9e656770-b956-5c62-ad87-02a73d629821", "toId": "657ff382-024b-45a4-974a-3e41f1762074", "to_id": "657ff382-024b-45a4-974a-3e41f1762074", "to_name": "Cobalt Strike - S0154", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.063Z", "created_at": "2026-09-26T05:56:17.521Z", "modified": "2026-09-26T05:56:17.989Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:56:17.989Z" }, "description_available": false, "entity_type": "indicates", "fromId": "66f40cca-cc72-4806-beef-47ae23125e5f", "from_id": "66f40cca-cc72-4806-beef-47ae23125e5f", "from_name": null, "from_type": "Indicator", "id": "fef71d35-40dc-44a8-9737-38148d7282ba", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--be725a56-488e-5eeb-9ff8-67fd23659fa5", "toId": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "to_name": "ShadowPad - S0596", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:24.701Z", "created_at": "2026-09-26T05:47:18.766Z", "modified": "2026-09-26T05:47:19.069Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T05:47:19.069Z" }, "description_available": false, "entity_type": "indicates", "fromId": "a7a198b8-f0a3-4221-b768-191720f061b9", "from_id": "a7a198b8-f0a3-4221-b768-191720f061b9", "from_name": null, "from_type": "Indicator", "id": "ff2537aa-3640-4e64-be04-9b915200a159", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--ac2da934-9bb6-5863-bfb4-eec1157318ab", "toId": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_id": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "to_name": "STOWAWAY", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:54:25.427Z", "created_at": "2026-09-26T06:06:17.118Z", "modified": "2026-09-26T06:06:17.434Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T06:06:17.434Z" }, "description_available": false, "entity_type": "indicates", "fromId": "313c8419-28b4-4ef9-9855-91d315819bf8", "from_id": "313c8419-28b4-4ef9-9855-91d315819bf8", "from_name": null, "from_type": "Indicator", "id": "ffbcba84-ade3-4085-84e6-a9fd06ce3450", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--749668d8-a784-515b-91f5-eda48acfb253", "toId": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_id": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "to_name": "PlugX - S0013", "to_type": "Malware" } ], "iocs": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "amzaonaws[.]org", "description_available": false, "object_id": "313c8419-28b4-4ef9-9855-91d315819bf8", "object_ids": [ "313c8419-28b4-4ef9-9855-91d315819bf8", "cd7ff8be-11f3-4197-9332-31bb24712c8c" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "313c8419-28b4-4ef9-9855-91d315819bf8", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2026-12-22T13:12:20.260Z", "validity_status": "active", "value": "amzaonaws.org" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "cd7ff8be-11f3-4197-9332-31bb24712c8c", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "amzaonaws.org" } ], "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "type": "domain", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2026-12-22T13:12:20.260Z", "validity_status": "active", "value": "amzaonaws.org" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "microsoftupdates[.]top", "description_available": false, "object_id": "653baf3a-7205-44e8-bf30-e40825fbf42a", "object_ids": [ "653baf3a-7205-44e8-bf30-e40825fbf42a", "9ad9ffb0-21a9-41e9-8ba4-eb7a850a99d7" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "653baf3a-7205-44e8-bf30-e40825fbf42a", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2026-12-22T13:12:20.260Z", "validity_status": "active", "value": "microsoftupdates.top" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "9ad9ffb0-21a9-41e9-8ba4-eb7a850a99d7", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "microsoftupdates.top" } ], "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "type": "domain", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2026-12-22T13:12:20.260Z", "validity_status": "active", "value": "microsoftupdates.top" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "microupdate[.]me", "description_available": false, "object_id": "5330b1c5-bebb-4760-ae47-12dd0e0d1e23", "object_ids": [ "0c77a85a-303f-453d-92ba-020828262896", "5330b1c5-bebb-4760-ae47-12dd0e0d1e23" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "5330b1c5-bebb-4760-ae47-12dd0e0d1e23", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2026-12-22T13:12:20.260Z", "validity_status": "active", "value": "microupdate.me" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "0c77a85a-303f-453d-92ba-020828262896", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "microupdate.me" } ], "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "type": "domain", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2026-12-22T13:12:20.260Z", "validity_status": "active", "value": "microupdate.me" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "microupdate[.]top", "description_available": false, "object_id": "d7d77ca0-8c06-4de9-bacb-a526f344e2e9", "object_ids": [ "51f01700-015a-4847-b006-08292d4e3fa5", "d7d77ca0-8c06-4de9-bacb-a526f344e2e9" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "d7d77ca0-8c06-4de9-bacb-a526f344e2e9", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2026-12-22T13:12:20.260Z", "validity_status": "active", "value": "microupdate.top" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "51f01700-015a-4847-b006-08292d4e3fa5", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "microupdate.top" } ], "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "type": "domain", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2026-12-22T13:12:20.260Z", "validity_status": "active", "value": "microupdate.top" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "windefender[.]net", "description_available": false, "object_id": "8c1b4518-8219-46bb-a619-1c69182e4eec", "object_ids": [ "2946350a-219e-4fc3-a946-0b21873bc1b2", "8c1b4518-8219-46bb-a619-1c69182e4eec" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "8c1b4518-8219-46bb-a619-1c69182e4eec", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2026-12-22T13:12:20.260Z", "validity_status": "active", "value": "windefender.net" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "2946350a-219e-4fc3-a946-0b21873bc1b2", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "windefender.net" } ], "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "type": "domain", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2026-12-22T13:12:20.260Z", "validity_status": "active", "value": "windefender.net" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "windowsupdates[.]us", "description_available": false, "object_id": "781e0e33-439f-46a6-b565-9c9e6287a0ff", "object_ids": [ "65928f13-af58-4e92-87d2-583157b8a75a", "781e0e33-439f-46a6-b565-9c9e6287a0ff" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "781e0e33-439f-46a6-b565-9c9e6287a0ff", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2026-12-22T13:12:20.260Z", "validity_status": "active", "value": "windowsupdates.us" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "65928f13-af58-4e92-87d2-583157b8a75a", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "windowsupdates.us" } ], "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "type": "domain", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2026-12-22T13:12:20.260Z", "validity_status": "active", "value": "windowsupdates.us" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "103[.]215[.]216[.]116", "description_available": false, "object_id": "26da206d-5fde-40ba-bc45-0f24f378263c", "object_ids": [ "26da206d-5fde-40ba-bc45-0f24f378263c", "770e49ee-7bed-41b3-a341-8a41d6bd0258" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "26da206d-5fde-40ba-bc45-0f24f378263c", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2026-10-01T03:51:51.434Z", "validity_status": "revoked", "value": "103.215.216.116" }, { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "object_id": "770e49ee-7bed-41b3-a341-8a41d6bd0258", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "103.215.216.116" } ], "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "type": "ipv4", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2026-10-01T03:51:51.434Z", "validity_status": "revoked", "value": "103.215.216.116" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "103[.]215[.]216[.]117", "description_available": false, "object_id": "435fff26-763c-4528-906f-e8da098d6aee", "object_ids": [ "435fff26-763c-4528-906f-e8da098d6aee", "8e14af81-a523-423f-9f91-478260788646" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "435fff26-763c-4528-906f-e8da098d6aee", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2026-10-01T03:51:51.434Z", "validity_status": "revoked", "value": "103.215.216.117" }, { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "object_id": "8e14af81-a523-423f-9f91-478260788646", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "103.215.216.117" } ], "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "type": "ipv4", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2026-10-01T03:51:51.434Z", "validity_status": "revoked", "value": "103.215.216.117" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "103[.]215[.]216[.]162", "description_available": false, "object_id": "cd0c196b-8e17-4794-80e8-7129d42950e2", "object_ids": [ "4c992236-6476-4fe3-96f7-f527564a3c5a", "cd0c196b-8e17-4794-80e8-7129d42950e2" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "cd0c196b-8e17-4794-80e8-7129d42950e2", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2026-10-01T03:51:51.434Z", "validity_status": "revoked", "value": "103.215.216.162" }, { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "object_id": "4c992236-6476-4fe3-96f7-f527564a3c5a", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "103.215.216.162" } ], "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "type": "ipv4", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2026-10-01T03:51:51.434Z", "validity_status": "revoked", "value": "103.215.216.162" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "103[.]215[.]216[.]181", "description_available": false, "object_id": "b5ad9feb-b128-47fb-9914-8319d0f48229", "object_ids": [ "473feaf2-9501-41f3-bf51-78c6f3efc898", "b5ad9feb-b128-47fb-9914-8319d0f48229" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "b5ad9feb-b128-47fb-9914-8319d0f48229", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2026-10-01T03:51:51.434Z", "validity_status": "revoked", "value": "103.215.216.181" }, { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "object_id": "473feaf2-9501-41f3-bf51-78c6f3efc898", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "103.215.216.181" } ], "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "type": "ipv4", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2026-10-01T03:51:51.434Z", "validity_status": "revoked", "value": "103.215.216.181" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "103[.]215[.]216[.]27", "description_available": false, "object_id": "ea8ff45b-69d1-4069-bebe-6f7107045959", "object_ids": [ "c75f6906-a6e4-4a6f-bedb-eb506639f40f", "ea8ff45b-69d1-4069-bebe-6f7107045959" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "ea8ff45b-69d1-4069-bebe-6f7107045959", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2026-10-01T03:51:51.434Z", "validity_status": "revoked", "value": "103.215.216.27" }, { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "object_id": "c75f6906-a6e4-4a6f-bedb-eb506639f40f", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "103.215.216.27" } ], "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "type": "ipv4", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2026-10-01T03:51:51.434Z", "validity_status": "revoked", "value": "103.215.216.27" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "103[.]215[.]216[.]61", "description_available": false, "object_id": "3be1760f-af98-4d5c-80e2-c0338b71f391", "object_ids": [ "2055a094-ceaf-4dfb-aba7-f26e1663bc4a", "3be1760f-af98-4d5c-80e2-c0338b71f391" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "3be1760f-af98-4d5c-80e2-c0338b71f391", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2026-10-01T03:51:51.434Z", "validity_status": "revoked", "value": "103.215.216.61" }, { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "object_id": "2055a094-ceaf-4dfb-aba7-f26e1663bc4a", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "103.215.216.61" } ], "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "type": "ipv4", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2026-10-01T03:51:51.434Z", "validity_status": "revoked", "value": "103.215.216.61" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "103[.]215[.]216[.]75", "description_available": false, "object_id": "66f40cca-cc72-4806-beef-47ae23125e5f", "object_ids": [ "2a32de1d-3c80-424d-91d9-77dd6be4c048", "66f40cca-cc72-4806-beef-47ae23125e5f" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "66f40cca-cc72-4806-beef-47ae23125e5f", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2026-10-01T03:51:51.434Z", "validity_status": "revoked", "value": "103.215.216.75" }, { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "object_id": "2a32de1d-3c80-424d-91d9-77dd6be4c048", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "103.215.216.75" } ], "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "type": "ipv4", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2026-10-01T03:51:51.434Z", "validity_status": "revoked", "value": "103.215.216.75" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "103[.]87[.]9[.]148", "description_available": false, "object_id": "d7f88a85-9ab3-45b8-982b-294d838461a6", "object_ids": [ "d7f88a85-9ab3-45b8-982b-294d838461a6", "d8d488d1-6404-4891-a4d4-e6ad07248ed2" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "d7f88a85-9ab3-45b8-982b-294d838461a6", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2026-10-01T03:51:51.434Z", "validity_status": "revoked", "value": "103.87.9.148" }, { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "object_id": "d8d488d1-6404-4891-a4d4-e6ad07248ed2", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "103.87.9.148" } ], "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "type": "ipv4", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2026-10-01T03:51:51.434Z", "validity_status": "revoked", "value": "103.87.9.148" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "130[.]94[.]91[.]165", "description_available": false, "object_id": "c2dcc828-9ae2-404f-a201-0074f26085ba", "object_ids": [ "84c081dd-c3ae-4f17-a8bc-75a9988112fd", "c2dcc828-9ae2-404f-a201-0074f26085ba" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "c2dcc828-9ae2-404f-a201-0074f26085ba", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2026-10-01T03:51:51.434Z", "validity_status": "revoked", "value": "130.94.91.165" }, { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "object_id": "84c081dd-c3ae-4f17-a8bc-75a9988112fd", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "130.94.91.165" } ], "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "type": "ipv4", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2026-10-01T03:51:51.434Z", "validity_status": "revoked", "value": "130.94.91.165" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "130[.]94[.]91[.]53", "description_available": false, "object_id": "52b56463-7f22-48f8-b036-35d89d2dabcb", "object_ids": [ "52b56463-7f22-48f8-b036-35d89d2dabcb", "b8f3a636-2804-4e40-bf6e-d055e9b61462" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "52b56463-7f22-48f8-b036-35d89d2dabcb", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2026-10-01T03:51:51.434Z", "validity_status": "revoked", "value": "130.94.91.53" }, { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "object_id": "b8f3a636-2804-4e40-bf6e-d055e9b61462", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "130.94.91.53" } ], "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "type": "ipv4", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2026-10-01T03:51:51.434Z", "validity_status": "revoked", "value": "130.94.91.53" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "146[.]71[.]85[.]33", "description_available": false, "object_id": "681c2240-1fb8-466d-a533-8f1d8132b27b", "object_ids": [ "057c7c24-a4a7-4440-b9e0-342673290da3", "681c2240-1fb8-466d-a533-8f1d8132b27b" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "681c2240-1fb8-466d-a533-8f1d8132b27b", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2026-10-01T03:51:51.434Z", "validity_status": "revoked", "value": "146.71.85.33" }, { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "object_id": "057c7c24-a4a7-4440-b9e0-342673290da3", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "146.71.85.33" } ], "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "type": "ipv4", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2026-10-01T03:51:51.434Z", "validity_status": "revoked", "value": "146.71.85.33" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "154[.]205[.]137[.]88", "description_available": false, "object_id": "56d609d1-e0ef-4633-8cfe-a3e1f792fbff", "object_ids": [ "56d609d1-e0ef-4633-8cfe-a3e1f792fbff", "7afdb82b-9941-485e-8009-7224919d145a" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "56d609d1-e0ef-4633-8cfe-a3e1f792fbff", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2026-10-01T03:51:51.434Z", "validity_status": "revoked", "value": "154.205.137.88" }, { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "object_id": "7afdb82b-9941-485e-8009-7224919d145a", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "154.205.137.88" } ], "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "type": "ipv4", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2026-10-01T03:51:51.434Z", "validity_status": "revoked", "value": "154.205.137.88" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "180[.]149[.]44[.]110", "description_available": false, "object_id": "350ff6fa-1c04-4870-b345-041e0d3d6d92", "object_ids": [ "127cff7a-eff6-40a6-a2f5-c5160ba6006e", "350ff6fa-1c04-4870-b345-041e0d3d6d92" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "350ff6fa-1c04-4870-b345-041e0d3d6d92", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2026-10-01T03:51:51.434Z", "validity_status": "revoked", "value": "180.149.44.110" }, { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "object_id": "127cff7a-eff6-40a6-a2f5-c5160ba6006e", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "180.149.44.110" } ], "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "type": "ipv4", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2026-10-01T03:51:51.434Z", "validity_status": "revoked", "value": "180.149.44.110" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "180[.]149[.]44[.]115", "description_available": false, "object_id": "d4aa073f-c77f-4db6-a515-5246469cf6b0", "object_ids": [ "d4aa073f-c77f-4db6-a515-5246469cf6b0", "f4f85fd2-e8e3-4f88-9173-9680e5c6e9ae" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "d4aa073f-c77f-4db6-a515-5246469cf6b0", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2026-10-01T03:51:51.434Z", "validity_status": "revoked", "value": "180.149.44.115" }, { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "object_id": "f4f85fd2-e8e3-4f88-9173-9680e5c6e9ae", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "180.149.44.115" } ], "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "type": "ipv4", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2026-10-01T03:51:51.434Z", "validity_status": "revoked", "value": "180.149.44.115" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "180[.]149[.]44[.]43", "description_available": false, "object_id": "f0b6cabc-d961-4c2b-a9a0-4075ac17972c", "object_ids": [ "c4ec9e93-b504-4f50-8451-fac10c9ad804", "f0b6cabc-d961-4c2b-a9a0-4075ac17972c" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "f0b6cabc-d961-4c2b-a9a0-4075ac17972c", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2026-10-01T03:51:51.434Z", "validity_status": "revoked", "value": "180.149.44.43" }, { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "object_id": "c4ec9e93-b504-4f50-8451-fac10c9ad804", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "180.149.44.43" } ], "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "type": "ipv4", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2026-10-01T03:51:51.434Z", "validity_status": "revoked", "value": "180.149.44.43" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "185[.]163[.]2[.]100", "description_available": false, "object_id": "610b3366-3a08-4e4d-9f45-c8543a783a7f", "object_ids": [ "610b3366-3a08-4e4d-9f45-c8543a783a7f", "c693aaa8-d711-4326-9843-d33513ceb248" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "610b3366-3a08-4e4d-9f45-c8543a783a7f", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2026-10-01T03:51:51.434Z", "validity_status": "revoked", "value": "185.163.2.100" }, { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "object_id": "c693aaa8-d711-4326-9843-d33513ceb248", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "185.163.2.100" } ], "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "type": "ipv4", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2026-10-01T03:51:51.434Z", "validity_status": "revoked", "value": "185.163.2.100" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "185[.]163[.]2[.]34", "description_available": false, "object_id": "01c74684-bdd9-45d1-84be-d24d189bcb28", "object_ids": [ "01c74684-bdd9-45d1-84be-d24d189bcb28", "38bd1e2c-7b42-420b-9c2b-9b6d47e262a9" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "01c74684-bdd9-45d1-84be-d24d189bcb28", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2026-10-01T03:51:51.434Z", "validity_status": "revoked", "value": "185.163.2.34" }, { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "object_id": "38bd1e2c-7b42-420b-9c2b-9b6d47e262a9", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "185.163.2.34" } ], "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "type": "ipv4", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2026-10-01T03:51:51.434Z", "validity_status": "revoked", "value": "185.163.2.34" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "185[.]163[.]2[.]79", "description_available": false, "object_id": "48f22366-f0fd-4667-b458-fc531795e8ff", "object_ids": [ "01333910-071d-4b01-b2f4-28b9cbbcb5f6", "48f22366-f0fd-4667-b458-fc531795e8ff" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "48f22366-f0fd-4667-b458-fc531795e8ff", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2026-10-01T03:51:51.434Z", "validity_status": "revoked", "value": "185.163.2.79" }, { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "object_id": "01333910-071d-4b01-b2f4-28b9cbbcb5f6", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "185.163.2.79" } ], "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "type": "ipv4", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2026-10-01T03:51:51.434Z", "validity_status": "revoked", "value": "185.163.2.79" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "185[.]163[.]2[.]81", "description_available": false, "object_id": "cdadaaa5-0866-4957-b6d7-c64be31a1cf9", "object_ids": [ "34e12ea3-8b2b-4e72-bcf2-ce08877ef79c", "cdadaaa5-0866-4957-b6d7-c64be31a1cf9" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "cdadaaa5-0866-4957-b6d7-c64be31a1cf9", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2026-10-01T03:51:51.434Z", "validity_status": "revoked", "value": "185.163.2.81" }, { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "object_id": "34e12ea3-8b2b-4e72-bcf2-ce08877ef79c", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "185.163.2.81" } ], "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "type": "ipv4", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2026-10-01T03:51:51.434Z", "validity_status": "revoked", "value": "185.163.2.81" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "2[.]56[.]166[.]139", "description_available": false, "object_id": "aaf834aa-275b-4a6a-9790-6971e8adf52d", "object_ids": [ "3b17245e-fd0a-4e60-aca2-694cccd39c6d", "aaf834aa-275b-4a6a-9790-6971e8adf52d" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "aaf834aa-275b-4a6a-9790-6971e8adf52d", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2026-10-01T03:51:51.434Z", "validity_status": "revoked", "value": "2.56.166.139" }, { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "object_id": "3b17245e-fd0a-4e60-aca2-694cccd39c6d", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "2.56.166.139" } ], "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "type": "ipv4", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2026-10-01T03:51:51.434Z", "validity_status": "revoked", "value": "2.56.166.139" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "2[.]56[.]166[.]84", "description_available": false, "object_id": "09acd2d3-2afb-4de1-a147-7ae7904d3859", "object_ids": [ "09acd2d3-2afb-4de1-a147-7ae7904d3859", "5d59618f-3a97-48e9-8661-b14e05c89144" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "09acd2d3-2afb-4de1-a147-7ae7904d3859", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2026-10-01T03:51:51.434Z", "validity_status": "revoked", "value": "2.56.166.84" }, { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "object_id": "5d59618f-3a97-48e9-8661-b14e05c89144", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "2.56.166.84" } ], "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "type": "ipv4", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2026-10-01T03:51:51.434Z", "validity_status": "revoked", "value": "2.56.166.84" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "38[.]54[.]110[.]44", "description_available": false, "object_id": "4ff9e994-0564-43c3-8240-004f20eb7d3f", "object_ids": [ "4ff9e994-0564-43c3-8240-004f20eb7d3f", "de6cfc4d-a139-4133-8ce1-195a0b3fd5c5" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "4ff9e994-0564-43c3-8240-004f20eb7d3f", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2026-10-01T03:51:51.434Z", "validity_status": "revoked", "value": "38.54.110.44" }, { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "object_id": "de6cfc4d-a139-4133-8ce1-195a0b3fd5c5", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "38.54.110.44" } ], "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "type": "ipv4", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2026-10-01T03:51:51.434Z", "validity_status": "revoked", "value": "38.54.110.44" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "38[.]54[.]71[.]107", "description_available": false, "object_id": "2c0b3e29-5bb5-4044-8031-4f47cd51a008", "object_ids": [ "2c0b3e29-5bb5-4044-8031-4f47cd51a008", "38a810da-9fd2-4970-952c-20d833c93f6d" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "2c0b3e29-5bb5-4044-8031-4f47cd51a008", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2026-10-01T03:51:51.434Z", "validity_status": "revoked", "value": "38.54.71.107" }, { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "object_id": "38a810da-9fd2-4970-952c-20d833c93f6d", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "38.54.71.107" } ], "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "type": "ipv4", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2026-10-01T03:51:51.434Z", "validity_status": "revoked", "value": "38.54.71.107" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "38[.]54[.]71[.]56", "description_available": false, "object_id": "3b95a828-10fe-4895-a5fa-606043535451", "object_ids": [ "3b95a828-10fe-4895-a5fa-606043535451", "3f67326c-9dfe-411f-ad47-f5aa047fb1dd" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "3b95a828-10fe-4895-a5fa-606043535451", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2026-10-01T03:51:51.434Z", "validity_status": "revoked", "value": "38.54.71.56" }, { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "object_id": "3f67326c-9dfe-411f-ad47-f5aa047fb1dd", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "38.54.71.56" } ], "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "type": "ipv4", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2026-10-01T03:51:51.434Z", "validity_status": "revoked", "value": "38.54.71.56" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "45[.]67[.]230[.]185", "description_available": false, "object_id": "b2490479-1c8f-4288-a8e1-23589e1535cf", "object_ids": [ "a7c4c835-d970-49b2-8782-cd5a75827218", "b2490479-1c8f-4288-a8e1-23589e1535cf" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "b2490479-1c8f-4288-a8e1-23589e1535cf", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2026-10-01T03:51:51.434Z", "validity_status": "revoked", "value": "45.67.230.185" }, { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "object_id": "a7c4c835-d970-49b2-8782-cd5a75827218", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "45.67.230.185" } ], "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "type": "ipv4", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2026-10-01T03:51:51.434Z", "validity_status": "revoked", "value": "45.67.230.185" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "45[.]80[.]208[.]232", "description_available": false, "object_id": "6fbf4d94-634a-4763-b0e5-0cbe6e9f67ea", "object_ids": [ "4fac57e7-eef7-47f0-9b98-c7356e554504", "6fbf4d94-634a-4763-b0e5-0cbe6e9f67ea" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "6fbf4d94-634a-4763-b0e5-0cbe6e9f67ea", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2026-10-01T03:51:51.434Z", "validity_status": "revoked", "value": "45.80.208.232" }, { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "object_id": "4fac57e7-eef7-47f0-9b98-c7356e554504", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "45.80.208.232" } ], "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "type": "ipv4", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2026-10-01T03:51:51.434Z", "validity_status": "revoked", "value": "45.80.208.232" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "89[.]44[.]198[.]107", "description_available": false, "object_id": "0eb188e3-885e-4084-abdf-6d4ba0098e64", "object_ids": [ "0eb188e3-885e-4084-abdf-6d4ba0098e64", "746e057f-05ff-48aa-af9c-a0589b31c045" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "0eb188e3-885e-4084-abdf-6d4ba0098e64", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2026-10-01T03:51:51.434Z", "validity_status": "revoked", "value": "89.44.198.107" }, { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "object_id": "746e057f-05ff-48aa-af9c-a0589b31c045", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "89.44.198.107" } ], "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "type": "ipv4", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2026-10-01T03:51:51.434Z", "validity_status": "revoked", "value": "89.44.198.107" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "92[.]38[.]169[.]152", "description_available": false, "object_id": "f7f8f4c3-42b1-433b-a4ab-f67c83968004", "object_ids": [ "80884810-4591-4dfe-970a-330ea35c15af", "f7f8f4c3-42b1-433b-a4ab-f67c83968004" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "f7f8f4c3-42b1-433b-a4ab-f67c83968004", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2026-10-01T03:51:51.434Z", "validity_status": "revoked", "value": "92.38.169.152" }, { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "object_id": "80884810-4591-4dfe-970a-330ea35c15af", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "92.38.169.152" } ], "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "type": "ipv4", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2026-10-01T03:51:51.434Z", "validity_status": "revoked", "value": "92.38.169.152" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "40637c70fd5cd899ca41d1252c267ccf", "description_available": false, "object_id": "157ca5cb-7d34-4fc3-83d2-bac13ceb9804", "object_ids": [ "157ca5cb-7d34-4fc3-83d2-bac13ceb9804", "ffe798a7-54cc-419f-8e75-b8a9ec869d0d" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "157ca5cb-7d34-4fc3-83d2-bac13ceb9804", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2027-06-28T09:26:56.557Z", "validity_status": "active", "value": "40637c70fd5cd899ca41d1252c267ccf" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "ffe798a7-54cc-419f-8e75-b8a9ec869d0d", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "40637c70fd5cd899ca41d1252c267ccf" } ], "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "type": "md5", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2027-06-28T09:26:56.557Z", "validity_status": "active", "value": "40637c70fd5cd899ca41d1252c267ccf" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "71d3832587a1d009ca3c0947005b187f23e52008", "description_available": false, "object_id": "a7a198b8-f0a3-4221-b768-191720f061b9", "object_ids": [ "a7a198b8-f0a3-4221-b768-191720f061b9", "ea1778a7-5b4b-491f-b4b4-49c709df6453" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "a7a198b8-f0a3-4221-b768-191720f061b9", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2027-06-28T09:26:56.557Z", "validity_status": "active", "value": "71d3832587a1d009ca3c0947005b187f23e52008" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "ea1778a7-5b4b-491f-b4b4-49c709df6453", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "71d3832587a1d009ca3c0947005b187f23e52008" } ], "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "type": "sha1", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2027-06-28T09:26:56.557Z", "validity_status": "active", "value": "71d3832587a1d009ca3c0947005b187f23e52008" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "b6df18f66cf4364be2946d6b981e69763aafde68", "description_available": false, "object_id": "de51cd6f-4b7a-4c4b-9b3d-d5094f650356", "object_ids": [ "5acd99db-1647-4737-931f-6bda9bc2e3fa", "de51cd6f-4b7a-4c4b-9b3d-d5094f650356" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "de51cd6f-4b7a-4c4b-9b3d-d5094f650356", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2027-06-28T09:26:56.557Z", "validity_status": "active", "value": "b6df18f66cf4364be2946d6b981e69763aafde68" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "5acd99db-1647-4737-931f-6bda9bc2e3fa", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "b6df18f66cf4364be2946d6b981e69763aafde68" } ], "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "type": "sha1", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2027-06-28T09:26:56.557Z", "validity_status": "active", "value": "b6df18f66cf4364be2946d6b981e69763aafde68" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "c8e585c8a161b9b7a0e59bd65a3ec5492375d53c", "description_available": false, "object_id": "ac6046d8-f570-4eca-af26-b22ab4b74e00", "object_ids": [ "0b49f882-3713-40dc-957f-7e6435f89a00", "ac6046d8-f570-4eca-af26-b22ab4b74e00" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "ac6046d8-f570-4eca-af26-b22ab4b74e00", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2027-06-28T09:26:56.557Z", "validity_status": "active", "value": "c8e585c8a161b9b7a0e59bd65a3ec5492375d53c" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "0b49f882-3713-40dc-957f-7e6435f89a00", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "c8e585c8a161b9b7a0e59bd65a3ec5492375d53c" } ], "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "type": "sha1", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2027-06-28T09:26:56.557Z", "validity_status": "active", "value": "c8e585c8a161b9b7a0e59bd65a3ec5492375d53c" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "dbbcb279a1f1a258832174ce63c295c5080de249", "description_available": false, "object_id": "ce5e270a-a0f5-4d07-9faf-6493364c1a2b", "object_ids": [ "27bf2255-9252-4604-8c7c-83202fb44fb9", "ce5e270a-a0f5-4d07-9faf-6493364c1a2b" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "ce5e270a-a0f5-4d07-9faf-6493364c1a2b", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2027-06-28T09:26:56.557Z", "validity_status": "active", "value": "dbbcb279a1f1a258832174ce63c295c5080de249" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "27bf2255-9252-4604-8c7c-83202fb44fb9", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "dbbcb279a1f1a258832174ce63c295c5080de249" } ], "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "type": "sha1", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2027-06-28T09:26:56.557Z", "validity_status": "active", "value": "dbbcb279a1f1a258832174ce63c295c5080de249" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "0c1666b274ddb44dd5c7a11f03c8c041f6bccf0c7dae924626ef9d15b1cc41d5", "description_available": false, "object_id": "1a15e67e-da7b-42ec-b24a-d47fd8aa0767", "object_ids": [ "016f544e-e59c-4260-b22d-e1c41b3acf25", "1a15e67e-da7b-42ec-b24a-d47fd8aa0767" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "1a15e67e-da7b-42ec-b24a-d47fd8aa0767", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2027-06-28T09:26:56.557Z", "validity_status": "active", "value": "0c1666b274ddb44dd5c7a11f03c8c041f6bccf0c7dae924626ef9d15b1cc41d5" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "016f544e-e59c-4260-b22d-e1c41b3acf25", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "0c1666b274ddb44dd5c7a11f03c8c041f6bccf0c7dae924626ef9d15b1cc41d5" } ], "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "type": "sha256", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2027-06-28T09:26:56.557Z", "validity_status": "active", "value": "0c1666b274ddb44dd5c7a11f03c8c041f6bccf0c7dae924626ef9d15b1cc41d5" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "129349a221e6efcc9a047efdfd81197f796fcf38877344f17f85651b21e33427", "description_available": false, "object_id": "8134c07a-eec8-489c-80e7-aca40ccc6268", "object_ids": [ "8134c07a-eec8-489c-80e7-aca40ccc6268", "f9498165-6ce4-46a4-ad53-6692e3059b2e" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "8134c07a-eec8-489c-80e7-aca40ccc6268", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2027-06-28T09:26:56.557Z", "validity_status": "active", "value": "129349a221e6efcc9a047efdfd81197f796fcf38877344f17f85651b21e33427" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "f9498165-6ce4-46a4-ad53-6692e3059b2e", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "129349a221e6efcc9a047efdfd81197f796fcf38877344f17f85651b21e33427" } ], "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "type": "sha256", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2027-06-28T09:26:56.557Z", "validity_status": "active", "value": "129349a221e6efcc9a047efdfd81197f796fcf38877344f17f85651b21e33427" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "4400096e8b39cb2641abec17c6dddad845ed6415e79d60adc2af1dcbd2837c59", "description_available": false, "object_id": "2227cc4b-afc7-4060-b897-a1a458d90abd", "object_ids": [ "2227cc4b-afc7-4060-b897-a1a458d90abd", "464bb6a2-f467-40fe-b562-fb088579a17f" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "2227cc4b-afc7-4060-b897-a1a458d90abd", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2027-06-28T09:26:56.557Z", "validity_status": "active", "value": "4400096e8b39cb2641abec17c6dddad845ed6415e79d60adc2af1dcbd2837c59" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "464bb6a2-f467-40fe-b562-fb088579a17f", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "4400096e8b39cb2641abec17c6dddad845ed6415e79d60adc2af1dcbd2837c59" } ], "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "type": "sha256", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2027-06-28T09:26:56.557Z", "validity_status": "active", "value": "4400096e8b39cb2641abec17c6dddad845ed6415e79d60adc2af1dcbd2837c59" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "50daadd49b8df4f0190d0badfde89f8e6a6e61af664ef1444984028a005f40d8", "description_available": false, "object_id": "10b221ff-1d17-4b38-ae27-73235f136031", "object_ids": [ "10b221ff-1d17-4b38-ae27-73235f136031", "526752ca-7f3b-4cb8-b0ec-5bd2ab4cd5d4" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "10b221ff-1d17-4b38-ae27-73235f136031", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2027-06-28T09:26:56.557Z", "validity_status": "active", "value": "50daadd49b8df4f0190d0badfde89f8e6a6e61af664ef1444984028a005f40d8" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "526752ca-7f3b-4cb8-b0ec-5bd2ab4cd5d4", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "50daadd49b8df4f0190d0badfde89f8e6a6e61af664ef1444984028a005f40d8" } ], "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "type": "sha256", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2027-06-28T09:26:56.557Z", "validity_status": "active", "value": "50daadd49b8df4f0190d0badfde89f8e6a6e61af664ef1444984028a005f40d8" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "6678216ace0ff224d6a5ae6bf1ca29e66fba9fceaa715e27440e85d5bfb06069", "description_available": false, "object_id": "6ae45569-c03b-471f-80ff-50d7a804075a", "object_ids": [ "6ae45569-c03b-471f-80ff-50d7a804075a", "e61b6017-a6a7-4dfb-a05d-e24eef8b4eec" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "6ae45569-c03b-471f-80ff-50d7a804075a", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2027-06-28T09:26:56.557Z", "validity_status": "active", "value": "6678216ace0ff224d6a5ae6bf1ca29e66fba9fceaa715e27440e85d5bfb06069" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "e61b6017-a6a7-4dfb-a05d-e24eef8b4eec", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "6678216ace0ff224d6a5ae6bf1ca29e66fba9fceaa715e27440e85d5bfb06069" } ], "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "type": "sha256", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2027-06-28T09:26:56.557Z", "validity_status": "active", "value": "6678216ace0ff224d6a5ae6bf1ca29e66fba9fceaa715e27440e85d5bfb06069" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "8255d5a423ce79c69e42685cbf8e708b4239650c01b2898a7efe856582bb3aaf", "description_available": false, "object_id": "c77e0b5e-a168-4a6f-993c-bc7076c78285", "object_ids": [ "c77e0b5e-a168-4a6f-993c-bc7076c78285", "f05ee10f-9e6f-4994-b588-c172a138f88e" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "c77e0b5e-a168-4a6f-993c-bc7076c78285", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2027-06-28T09:26:56.557Z", "validity_status": "active", "value": "8255d5a423ce79c69e42685cbf8e708b4239650c01b2898a7efe856582bb3aaf" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "f05ee10f-9e6f-4994-b588-c172a138f88e", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "8255d5a423ce79c69e42685cbf8e708b4239650c01b2898a7efe856582bb3aaf" } ], "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "type": "sha256", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2027-06-28T09:26:56.557Z", "validity_status": "active", "value": "8255d5a423ce79c69e42685cbf8e708b4239650c01b2898a7efe856582bb3aaf" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "9d01724193d9570a6c75bbcbb171d29df290207007d004cf75d133dd9aa475f4", "description_available": false, "object_id": "fdaa0a79-121c-4e17-91bb-e23da88da18e", "object_ids": [ "9d5b7e5a-f4bb-4233-b9d0-269de30e7216", "fdaa0a79-121c-4e17-91bb-e23da88da18e" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "fdaa0a79-121c-4e17-91bb-e23da88da18e", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2027-06-28T09:26:56.557Z", "validity_status": "active", "value": "9d01724193d9570a6c75bbcbb171d29df290207007d004cf75d133dd9aa475f4" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "9d5b7e5a-f4bb-4233-b9d0-269de30e7216", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "9d01724193d9570a6c75bbcbb171d29df290207007d004cf75d133dd9aa475f4" } ], "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "type": "sha256", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2027-06-28T09:26:56.557Z", "validity_status": "active", "value": "9d01724193d9570a6c75bbcbb171d29df290207007d004cf75d133dd9aa475f4" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "aa2fd252a6f5a09b8d8422fbd1037febefe2aa99317e3c3973889384a80e29b7", "description_available": false, "object_id": "1315ce2a-6659-4f4f-b9b7-e2450564ca9b", "object_ids": [ "1315ce2a-6659-4f4f-b9b7-e2450564ca9b", "78bce55a-b598-436c-956d-75bca2e1d662" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "1315ce2a-6659-4f4f-b9b7-e2450564ca9b", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2027-06-28T09:26:56.557Z", "validity_status": "active", "value": "aa2fd252a6f5a09b8d8422fbd1037febefe2aa99317e3c3973889384a80e29b7" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "78bce55a-b598-436c-956d-75bca2e1d662", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "aa2fd252a6f5a09b8d8422fbd1037febefe2aa99317e3c3973889384a80e29b7" } ], "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "type": "sha256", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2027-06-28T09:26:56.557Z", "validity_status": "active", "value": "aa2fd252a6f5a09b8d8422fbd1037febefe2aa99317e3c3973889384a80e29b7" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "cbce7dc8649b37c5db411dfee3a74e8cace2b48fdc8350bfa5b4846c5d9ed2ae", "description_available": false, "object_id": "2497f466-fac3-4bfc-ab1f-5ebcf363283b", "object_ids": [ "2497f466-fac3-4bfc-ab1f-5ebcf363283b", "ca8da3f5-7f0e-44c2-a7fa-6ac0dc228591" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "2497f466-fac3-4bfc-ab1f-5ebcf363283b", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2027-06-28T09:26:56.557Z", "validity_status": "active", "value": "cbce7dc8649b37c5db411dfee3a74e8cace2b48fdc8350bfa5b4846c5d9ed2ae" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "ca8da3f5-7f0e-44c2-a7fa-6ac0dc228591", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "cbce7dc8649b37c5db411dfee3a74e8cace2b48fdc8350bfa5b4846c5d9ed2ae" } ], "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "type": "sha256", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2027-06-28T09:26:56.557Z", "validity_status": "active", "value": "cbce7dc8649b37c5db411dfee3a74e8cace2b48fdc8350bfa5b4846c5d9ed2ae" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "dd081c130d7c3a3c18e06a26300dcfd65ee70e6b23b729edb54cb0f0a5829df9", "description_available": false, "object_id": "2d8df4da-244f-458a-8c2d-ff67380121e9", "object_ids": [ "2d8df4da-244f-458a-8c2d-ff67380121e9", "b2074404-2769-4ab5-8041-fea559804907" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "2d8df4da-244f-458a-8c2d-ff67380121e9", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2027-06-28T09:26:56.557Z", "validity_status": "active", "value": "dd081c130d7c3a3c18e06a26300dcfd65ee70e6b23b729edb54cb0f0a5829df9" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "b2074404-2769-4ab5-8041-fea559804907", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "dd081c130d7c3a3c18e06a26300dcfd65ee70e6b23b729edb54cb0f0a5829df9" } ], "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "type": "sha256", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2027-06-28T09:26:56.557Z", "validity_status": "active", "value": "dd081c130d7c3a3c18e06a26300dcfd65ee70e6b23b729edb54cb0f0a5829df9" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "hxxp[:]//windefender[.]net[:]443", "description_available": false, "object_id": "95ef732a-5859-4b75-a4ea-fd3cfe3f1618", "object_ids": [ "95ef732a-5859-4b75-a4ea-fd3cfe3f1618", "b43b9fe9-5ab2-4d09-bb77-e585675093c6" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "95ef732a-5859-4b75-a4ea-fd3cfe3f1618", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2026-10-01T03:51:51.434Z", "validity_status": "revoked", "value": "http://windefender.net:443" }, { "classification": "observable", "confidence": null, "context": "Objet Url explicitement associé au rapport source.", "object_id": "b43b9fe9-5ab2-4d09-bb77-e585675093c6", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "http://windefender.net:443" } ], "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "type": "url", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2026-10-01T03:51:51.434Z", "validity_status": "revoked", "value": "http://windefender.net:443" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "hxxp[:]//windowsupdates[.]us[:]80", "description_available": false, "object_id": "3c2ca4de-2c25-4802-a582-ebf285060ed9", "object_ids": [ "2664d5d7-e095-48a9-8b0a-4bbf509e3cdc", "3c2ca4de-2c25-4802-a582-ebf285060ed9" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "3c2ca4de-2c25-4802-a582-ebf285060ed9", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2026-10-01T03:51:51.434Z", "validity_status": "revoked", "value": "http://windowsupdates.us:80" }, { "classification": "observable", "confidence": null, "context": "Objet Url explicitement associé au rapport source.", "object_id": "2664d5d7-e095-48a9-8b0a-4bbf509e3cdc", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "http://windowsupdates.us:80" } ], "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "type": "url", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2026-10-01T03:51:51.434Z", "validity_status": "revoked", "value": "http://windowsupdates.us:80" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "hxxp[:]//www[.]windefender[.]net[:]443", "description_available": false, "object_id": "2d16d740-ae8a-45ff-8a8b-9032f924c3fa", "object_ids": [ "2d16d740-ae8a-45ff-8a8b-9032f924c3fa", "9c508525-38f5-4ad0-a0d5-897383007809" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "2d16d740-ae8a-45ff-8a8b-9032f924c3fa", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2026-10-01T03:51:51.434Z", "validity_status": "revoked", "value": "http://www.windefender.net:443" }, { "classification": "observable", "confidence": null, "context": "Objet Url explicitement associé au rapport source.", "object_id": "9c508525-38f5-4ad0-a0d5-897383007809", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "http://www.windefender.net:443" } ], "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "type": "url", "valid_from": "2026-09-10T22:17:12.000Z", "valid_until": "2026-10-01T03:51:51.434Z", "validity_status": "revoked", "value": "http://www.windefender.net:443" } ], "mentioned": [ { "confidence": 50, "evidence_id": "657ff382-024b-45a4-974a-3e41f1762074", "name": "Cobalt Strike - S0154", "role": "mentionné", "type": "Malware" }, { "confidence": 50, "evidence_id": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "name": "CrowDoor", "role": "mentionné", "type": "Malware" }, { "confidence": 50, "evidence_id": "dd0e7de9-0c7b-42a4-8ae7-ad82595adf8d", "name": "HelloBot", "role": "mentionné", "type": "Malware" }, { "confidence": 50, "evidence_id": "208a45aa-c18e-4619-9a90-7004849cab40", "name": "HemiGate", "role": "mentionné", "type": "Malware" }, { "confidence": 50, "evidence_id": "82dae33b-e459-494e-ba12-c05113d9bb06", "name": "Melofee", "role": "mentionné", "type": "Malware" }, { "confidence": 50, "evidence_id": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "name": "PlugX - S0013", "role": "mentionné", "type": "Malware" }, { "confidence": 50, "evidence_id": "ecbf92ef-bec9-4aa8-bcf4-a44eb7cfb686", "name": "RatelS", "role": "mentionné", "type": "Malware" }, { "confidence": 50, "evidence_id": "9ff4277f-e5bc-4ea8-897c-c88d6e068de6", "name": "STOWAWAY", "role": "mentionné", "type": "Malware" }, { "confidence": 50, "evidence_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "name": "ShadowPad - S0596", "role": "mentionné", "type": "Malware" }, { "confidence": 50, "evidence_id": "43650ebe-d4e7-4bd4-a5e5-fd442cd6bb95", "name": "Spark - S0543", "role": "mentionné", "type": "Malware" }, { "confidence": 50, "evidence_id": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "name": "TernDoor", "role": "mentionné", "type": "Malware" } ], "mitre": { "associated_repertoire": [ { "complete": true, "relationships": [ { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-18T18:09:56.115Z", "created_at": "2026-01-19T17:45:38.090Z", "modified": "2026-01-19T17:45:38.961Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-19T17:45:38.961Z" }, "description_available": false, "entity_type": "uses", "fromId": "657ff382-024b-45a4-974a-3e41f1762074", "from_id": "657ff382-024b-45a4-974a-3e41f1762074", "from_name": "Cobalt Strike - S0154", "from_type": "Malware", "id": "017556d5-24b2-4dc2-8752-c31cadda6456", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--4ea4e126-d22d-5cb2-bc0a-28a62f245b7c", "toId": "6dc3b6a2-d526-4427-a8df-edeef4fc095e", "to_id": "6dc3b6a2-d526-4427-a8df-edeef4fc095e", "to_name": "T1023", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T20:01:36.183Z", "created_at": "2026-03-16T15:07:48.420Z", "modified": "2026-03-16T15:07:49.094Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-03-16T15:07:49.094Z" }, "description_available": false, "entity_type": "uses", "fromId": "657ff382-024b-45a4-974a-3e41f1762074", "from_id": "657ff382-024b-45a4-974a-3e41f1762074", "from_name": "Cobalt Strike - S0154", "from_type": "Malware", "id": "0e77135a-13e2-48f4-bf6c-8a2567d47409", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--0b905d88-e0e7-58b2-baee-2a8f78f0f3f3", "toId": "008dd51f-8f8d-4be2-a41b-6191033560d2", "to_id": "008dd51f-8f8d-4be2-a41b-6191033560d2", "to_name": "TA0001", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-18T18:10:21.536Z", "created_at": "2026-01-19T18:50:20.700Z", "modified": "2026-01-19T18:50:21.107Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-19T18:50:21.107Z" }, "description_available": false, "entity_type": "uses", "fromId": "657ff382-024b-45a4-974a-3e41f1762074", "from_id": "657ff382-024b-45a4-974a-3e41f1762074", "from_name": "Cobalt Strike - S0154", "from_type": "Malware", "id": "1abc6712-067a-4c79-9bc6-52cadb947b78", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--136c04da-77e3-55bc-99e7-bf9f0ac6404c", "toId": "49e99359-b1d6-4e62-b704-5336d333ed05", "to_id": "49e99359-b1d6-4e62-b704-5336d333ed05", "to_name": "T1086", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T20:01:36.180Z", "created_at": "2026-03-16T15:07:41.871Z", "modified": "2026-03-16T15:07:42.423Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-03-16T15:07:42.423Z" }, "description_available": false, "entity_type": "uses", "fromId": "657ff382-024b-45a4-974a-3e41f1762074", "from_id": "657ff382-024b-45a4-974a-3e41f1762074", "from_name": "Cobalt Strike - S0154", "from_type": "Malware", "id": "3807de46-2db8-4f96-a5a9-7754776911c8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--9e5504a3-e16e-51fe-83d5-cfdbb17e736a", "toId": "50941343-5131-46d0-acab-3576025e11f7", "to_id": "50941343-5131-46d0-acab-3576025e11f7", "to_name": "TA0005", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T17:45:26.577Z", "created_at": "2026-02-20T20:13:44.828Z", "modified": "2026-02-20T20:13:45.743Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-02-20T20:13:45.743Z" }, "description_available": false, "entity_type": "uses", "fromId": "657ff382-024b-45a4-974a-3e41f1762074", "from_id": "657ff382-024b-45a4-974a-3e41f1762074", "from_name": "Cobalt Strike - S0154", "from_type": "Malware", "id": "62f6950e-034b-4a45-90cc-a7c2171423c2", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--c115719f-d328-5689-9d9b-54f4b2b652ef", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-18T18:09:56.113Z", "created_at": "2026-01-19T17:45:32.166Z", "modified": "2026-01-19T17:45:32.713Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-19T17:45:32.713Z" }, "description_available": false, "entity_type": "uses", "fromId": "657ff382-024b-45a4-974a-3e41f1762074", "from_id": "657ff382-024b-45a4-974a-3e41f1762074", "from_name": "Cobalt Strike - S0154", "from_type": "Malware", "id": "7ff60055-21c1-409a-9560-13b0dcf950ce", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--8fc0957c-f400-58fb-855d-59a6e760cb04", "toId": "8cbc136d-7185-4164-a1a0-8a5e3934d4ad", "to_id": "8cbc136d-7185-4164-a1a0-8a5e3934d4ad", "to_name": "T1060", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T20:01:36.181Z", "created_at": "2026-03-16T15:07:42.916Z", "modified": "2026-03-16T15:07:43.200Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-03-16T15:07:43.200Z" }, "description_available": false, "entity_type": "uses", "fromId": "657ff382-024b-45a4-974a-3e41f1762074", "from_id": "657ff382-024b-45a4-974a-3e41f1762074", "from_name": "Cobalt Strike - S0154", "from_type": "Malware", "id": "974f2eb7-8de9-4a1c-b2ec-240a523c6f54", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--1a20b9c7-12bb-57d8-92d6-e0dadeebdcc2", "toId": "b567183b-d314-4266-96a5-7c9ed53ab2b0", "to_id": "b567183b-d314-4266-96a5-7c9ed53ab2b0", "to_name": "TA0007", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T20:01:36.179Z", "created_at": "2026-03-16T15:07:44.457Z", "modified": "2026-03-16T15:07:46.436Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-03-16T15:07:46.436Z" }, "description_available": false, "entity_type": "uses", "fromId": "657ff382-024b-45a4-974a-3e41f1762074", "from_id": "657ff382-024b-45a4-974a-3e41f1762074", "from_name": "Cobalt Strike - S0154", "from_type": "Malware", "id": "9a97c37b-581e-435d-9ee4-9e13de661c3c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--0cecf0c5-df70-559f-9807-728ae3a71299", "toId": "007d40c1-8ed8-41d8-9959-0e44fd2b4e84", "to_id": "007d40c1-8ed8-41d8-9959-0e44fd2b4e84", "to_name": "TA0008", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T19:30:54.400Z", "created_at": "2026-03-11T02:42:40.730Z", "modified": "2026-03-11T02:43:19.495Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-03-11T02:43:19.495Z" }, "description_available": false, "entity_type": "uses", "fromId": "657ff382-024b-45a4-974a-3e41f1762074", "from_id": "657ff382-024b-45a4-974a-3e41f1762074", "from_name": "Cobalt Strike - S0154", "from_type": "Malware", "id": "afc68bd6-780a-446b-ac07-01c998c20543", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--ac2ff5b0-254a-51e8-bebc-1feb53046ec9", "toId": "87c0091a-bb57-4ddd-8be3-849dd3ee13bb", "to_id": "87c0091a-bb57-4ddd-8be3-849dd3ee13bb", "to_name": "T1076", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T16:28:13.311Z", "created_at": "2026-02-07T18:57:07.478Z", "modified": "2026-02-07T18:57:07.687Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-02-07T18:57:07.687Z" }, "description_available": false, "entity_type": "uses", "fromId": "657ff382-024b-45a4-974a-3e41f1762074", "from_id": "657ff382-024b-45a4-974a-3e41f1762074", "from_name": "Cobalt Strike - S0154", "from_type": "Malware", "id": "c9ce065e-9319-40f8-9b44-01abc213f470", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--6f4fc28e-1650-5290-9fa1-18da1af1f484", "toId": "7ea7cb32-9909-4ee9-9a11-41a64fbb0d98", "to_id": "7ea7cb32-9909-4ee9-9a11-41a64fbb0d98", "to_name": "T1081", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-18T18:09:56.116Z", "created_at": "2026-01-19T17:45:40.121Z", "modified": "2026-01-19T17:45:41.066Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-19T17:45:41.066Z" }, "description_available": false, "entity_type": "uses", "fromId": "657ff382-024b-45a4-974a-3e41f1762074", "from_id": "657ff382-024b-45a4-974a-3e41f1762074", "from_name": "Cobalt Strike - S0154", "from_type": "Malware", "id": "ccad1c23-1d29-4c03-b68d-bb609200c46f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--e91673d6-f1d7-5893-936f-0f20cc00f3a7", "toId": "0c43fa3c-1023-4011-bc40-c398438711c9", "to_id": "0c43fa3c-1023-4011-bc40-c398438711c9", "to_name": "T1094", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T20:01:36.181Z", "created_at": "2026-03-16T15:07:50.560Z", "modified": "2026-03-16T15:07:52.428Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-03-16T15:07:52.428Z" }, "description_available": false, "entity_type": "uses", "fromId": "657ff382-024b-45a4-974a-3e41f1762074", "from_id": "657ff382-024b-45a4-974a-3e41f1762074", "from_name": "Cobalt Strike - S0154", "from_type": "Malware", "id": "d1ef7489-e412-4254-bc01-53379622042e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--f349d62e-4e7e-50b9-9f72-9704cc803854", "toId": "3c4ed719-1a23-4538-bce0-ec21c8e5e5ae", "to_id": "3c4ed719-1a23-4538-bce0-ec21c8e5e5ae", "to_name": "TA0010", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T16:20:54.931Z", "created_at": "2026-02-06T14:17:05.293Z", "modified": "2026-02-06T14:17:09.475Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-02-06T14:17:09.475Z" }, "description_available": false, "entity_type": "uses", "fromId": "657ff382-024b-45a4-974a-3e41f1762074", "from_id": "657ff382-024b-45a4-974a-3e41f1762074", "from_name": "Cobalt Strike - S0154", "from_type": "Malware", "id": "f06d17b2-6c54-4eb2-a5fe-4bd0950c822b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--ed2ad588-1d3e-5058-89b6-ebabd50a37f2", "toId": "0274a80d-ba1a-4dd7-95cd-cb9aad2b548a", "to_id": "0274a80d-ba1a-4dd7-95cd-cb9aad2b548a", "to_name": "T1045", "to_type": "AttackPattern" } ], "scope": "entity-context", "techniques": [ { "aliases": [], "attributes": { "x_mitre_id": "TA0008" }, "authorized_members": [], "confidence": 50, "created": "2026-01-18T18:28:11.150Z", "created_by": null, "dates": { "created": "2026-01-18T18:28:11.150Z", "created_at": "2026-01-21T11:31:19.514Z", "modified": "2026-01-21T11:31:20.180Z", "updated_at": "2026-01-21T11:31:20.180Z" }, "description_available": false, "evidence_ids": [ "007d40c1-8ed8-41d8-9959-0e44fd2b4e84", "9a97c37b-581e-435d-9ee4-9e13de661c3c" ], "external_id": null, "id": "007d40c1-8ed8-41d8-9959-0e44fd2b4e84", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": null, "modified": "2026-01-21T11:31:20.180Z", "name": "TA0008", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "TA0008", "id": "ad7866d4-e709-45c7-a0b3-721cd0ac76a9", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/TA0008" } ], "relationship_ids": [ "9a97c37b-581e-435d-9ee4-9e13de661c3c" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "tactics": [], "url": null, "via_entities": [ { "id": "657ff382-024b-45a4-974a-3e41f1762074", "name": "Cobalt Strike - S0154", "type": "Malware" } ] }, { "aliases": [], "attributes": { "x_mitre_id": "TA0001" }, "authorized_members": [], "confidence": 50, "created": "2026-01-19T18:16:18.950Z", "created_by": null, "dates": { "created": "2026-01-19T18:16:18.950Z", "created_at": "2026-02-26T09:42:18.208Z", "modified": "2026-02-26T09:42:18.968Z", "updated_at": "2026-02-26T09:42:18.968Z" }, "description_available": false, "evidence_ids": [ "008dd51f-8f8d-4be2-a41b-6191033560d2", "0e77135a-13e2-48f4-bf6c-8a2567d47409" ], "external_id": null, "id": "008dd51f-8f8d-4be2-a41b-6191033560d2", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": null, "modified": "2026-02-26T09:42:18.968Z", "name": "TA0001", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "TA0001", "id": "b9b34b9a-84bd-442c-a126-8dd241c3fecc", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/TA0001" } ], "relationship_ids": [ "0e77135a-13e2-48f4-bf6c-8a2567d47409" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "tactics": [], "url": null, "via_entities": [ { "id": "657ff382-024b-45a4-974a-3e41f1762074", "name": "Cobalt Strike - S0154", "type": "Malware" } ] }, { "aliases": [], "attributes": { "x_mitre_id": "T1045" }, "authorized_members": [], "confidence": 50, "created": "2026-01-18T18:02:52.598Z", "created_by": null, "dates": { "created": "2026-01-18T18:02:52.598Z", "created_at": "2026-01-18T18:17:47.648Z", "modified": "2026-01-18T18:17:48.365Z", "updated_at": "2026-01-18T18:17:48.365Z" }, "description_available": false, "evidence_ids": [ "0274a80d-ba1a-4dd7-95cd-cb9aad2b548a", "f06d17b2-6c54-4eb2-a5fe-4bd0950c822b" ], "external_id": "T1045", "id": "0274a80d-ba1a-4dd7-95cd-cb9aad2b548a", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": "T1045", "modified": "2026-01-18T18:17:48.365Z", "name": "T1045", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "T1045", "id": "779e0644-aa4d-451c-9079-29ebc2cf5705", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1045" } ], "relationship_ids": [ "f06d17b2-6c54-4eb2-a5fe-4bd0950c822b" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "tactics": [], "url": "https://attack.mitre.org/techniques/T1045/", "via_entities": [ { "id": "657ff382-024b-45a4-974a-3e41f1762074", "name": "Cobalt Strike - S0154", "type": "Malware" } ] }, { "aliases": [], "attributes": { "x_mitre_id": "T1094" }, "authorized_members": [], "confidence": 50, "created": "2026-01-18T18:04:28.695Z", "created_by": null, "dates": { "created": "2026-01-18T18:04:28.695Z", "created_at": "2026-01-18T22:32:58.220Z", "modified": "2026-01-18T22:33:01.087Z", "updated_at": "2026-01-18T22:33:01.087Z" }, "description_available": false, "evidence_ids": [ "0c43fa3c-1023-4011-bc40-c398438711c9", "ccad1c23-1d29-4c03-b68d-bb609200c46f" ], "external_id": "T1094", "id": "0c43fa3c-1023-4011-bc40-c398438711c9", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": "T1094", "modified": "2026-01-18T22:33:01.087Z", "name": "T1094", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "T1094", "id": "fb43a6ff-5bf1-40b3-8e1c-ce8220f7163b", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1094" } ], "relationship_ids": [ "ccad1c23-1d29-4c03-b68d-bb609200c46f" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "tactics": [], "url": "https://attack.mitre.org/techniques/T1094/", "via_entities": [ { "id": "657ff382-024b-45a4-974a-3e41f1762074", "name": "Cobalt Strike - S0154", "type": "Malware" } ] }, { "aliases": [], "attributes": { "x_mitre_id": "TA0010" }, "authorized_members": [], "confidence": 50, "created": "2026-01-18T18:52:03.139Z", "created_by": null, "dates": { "created": "2026-01-18T18:52:03.139Z", "created_at": "2026-01-24T03:42:30.097Z", "modified": "2026-01-24T03:42:30.732Z", "updated_at": "2026-01-24T03:42:30.732Z" }, "description_available": false, "evidence_ids": [ "3c4ed719-1a23-4538-bce0-ec21c8e5e5ae", "d1ef7489-e412-4254-bc01-53379622042e" ], "external_id": null, "id": "3c4ed719-1a23-4538-bce0-ec21c8e5e5ae", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": null, "modified": "2026-01-24T03:42:30.732Z", "name": "TA0010", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "TA0010", "id": "e17eefd7-f8f6-4eda-913c-2508d56b7270", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/TA0010" } ], "relationship_ids": [ "d1ef7489-e412-4254-bc01-53379622042e" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "tactics": [], "url": null, "via_entities": [ { "id": "657ff382-024b-45a4-974a-3e41f1762074", "name": "Cobalt Strike - S0154", "type": "Malware" } ] }, { "aliases": [], "attributes": { "x_mitre_id": "T1086" }, "authorized_members": [], "confidence": 50, "created": "2026-01-18T18:06:32.388Z", "created_by": null, "dates": { "created": "2026-01-18T18:06:32.388Z", "created_at": "2026-01-19T07:30:45.408Z", "modified": "2026-01-19T07:30:46.032Z", "updated_at": "2026-01-19T07:30:46.032Z" }, "description_available": false, "evidence_ids": [ "1abc6712-067a-4c79-9bc6-52cadb947b78", "49e99359-b1d6-4e62-b704-5336d333ed05" ], "external_id": "T1086", "id": "49e99359-b1d6-4e62-b704-5336d333ed05", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": "T1086", "modified": "2026-01-19T07:30:46.032Z", "name": "T1086", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "T1086", "id": "9aee59f9-5700-4980-a072-87df39de0dfd", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1086" } ], "relationship_ids": [ "1abc6712-067a-4c79-9bc6-52cadb947b78" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "tactics": [], "url": "https://attack.mitre.org/techniques/T1086/", "via_entities": [ { "id": "657ff382-024b-45a4-974a-3e41f1762074", "name": "Cobalt Strike - S0154", "type": "Malware" } ] }, { "aliases": [], "attributes": { "x_mitre_id": "TA0005" }, "authorized_members": [], "confidence": 50, "created": "2026-01-19T16:41:04.446Z", "created_by": null, "dates": { "created": "2026-01-19T16:41:04.446Z", "created_at": "2026-02-10T07:30:32.216Z", "modified": "2026-02-10T07:30:32.428Z", "updated_at": "2026-02-10T07:30:32.428Z" }, "description_available": false, "evidence_ids": [ "3807de46-2db8-4f96-a5a9-7754776911c8", "50941343-5131-46d0-acab-3576025e11f7" ], "external_id": null, "id": "50941343-5131-46d0-acab-3576025e11f7", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": null, "modified": "2026-02-10T07:30:32.428Z", "name": "TA0005", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "TA0005", "id": "a9112572-039f-413c-83b9-8baf4225ca60", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/TA0005" } ], "relationship_ids": [ "3807de46-2db8-4f96-a5a9-7754776911c8" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "tactics": [], "url": null, "via_entities": [ { "id": "657ff382-024b-45a4-974a-3e41f1762074", "name": "Cobalt Strike - S0154", "type": "Malware" } ] }, { "aliases": [], "attributes": { "x_mitre_id": "T1023" }, "authorized_members": [], "confidence": 50, "created": "2026-01-18T18:05:20.838Z", "created_by": null, "dates": { "created": "2026-01-18T18:05:20.838Z", "created_at": "2026-01-19T04:00:19.227Z", "modified": "2026-01-19T04:00:19.824Z", "updated_at": "2026-01-19T04:00:19.824Z" }, "description_available": false, "evidence_ids": [ "017556d5-24b2-4dc2-8752-c31cadda6456", "6dc3b6a2-d526-4427-a8df-edeef4fc095e" ], "external_id": "T1023", "id": "6dc3b6a2-d526-4427-a8df-edeef4fc095e", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": "T1023", "modified": "2026-01-19T04:00:19.824Z", "name": "T1023", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "T1023", "id": "05232979-69bd-4f87-9874-3fe49f8ba171", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1023" } ], "relationship_ids": [ "017556d5-24b2-4dc2-8752-c31cadda6456" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "tactics": [], "url": "https://attack.mitre.org/techniques/T1023/", "via_entities": [ { "id": "657ff382-024b-45a4-974a-3e41f1762074", "name": "Cobalt Strike - S0154", "type": "Malware" } ] }, { "aliases": [], "attributes": { "x_mitre_id": "T1081" }, "authorized_members": [], "confidence": 50, "created": "2026-01-18T18:31:36.615Z", "created_by": null, "dates": { "created": "2026-01-18T18:31:36.615Z", "created_at": "2026-01-21T20:49:48.192Z", "modified": "2026-01-21T20:49:48.560Z", "updated_at": "2026-01-21T20:49:48.560Z" }, "description_available": false, "evidence_ids": [ "7ea7cb32-9909-4ee9-9a11-41a64fbb0d98", "c9ce065e-9319-40f8-9b44-01abc213f470" ], "external_id": "T1081", "id": "7ea7cb32-9909-4ee9-9a11-41a64fbb0d98", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": "T1081", "modified": "2026-01-21T20:49:48.560Z", "name": "T1081", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "T1081", "id": "a7b8c2bf-d09e-432b-a8e6-952e1d0aa432", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1081" } ], "relationship_ids": [ "c9ce065e-9319-40f8-9b44-01abc213f470" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "tactics": [], "url": "https://attack.mitre.org/techniques/T1081/", "via_entities": [ { "id": "657ff382-024b-45a4-974a-3e41f1762074", "name": "Cobalt Strike - S0154", "type": "Malware" } ] }, { "aliases": [], "attributes": { "x_mitre_id": "T1076" }, "authorized_members": [], "confidence": 50, "created": "2026-01-18T18:10:33.837Z", "created_by": null, "dates": { "created": "2026-01-18T18:10:33.837Z", "created_at": "2026-01-19T19:18:03.982Z", "modified": "2026-01-19T19:18:05.388Z", "updated_at": "2026-01-19T19:18:05.388Z" }, "description_available": false, "evidence_ids": [ "87c0091a-bb57-4ddd-8be3-849dd3ee13bb", "afc68bd6-780a-446b-ac07-01c998c20543" ], "external_id": "T1076", "id": "87c0091a-bb57-4ddd-8be3-849dd3ee13bb", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": "T1076", "modified": "2026-01-19T19:18:05.388Z", "name": "T1076", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "T1076", "id": "61ff2bcd-7406-40c2-8261-ef53f8248d9f", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1076" } ], "relationship_ids": [ "afc68bd6-780a-446b-ac07-01c998c20543" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "tactics": [], "url": "https://attack.mitre.org/techniques/T1076/", "via_entities": [ { "id": "657ff382-024b-45a4-974a-3e41f1762074", "name": "Cobalt Strike - S0154", "type": "Malware" } ] }, { "aliases": [], "attributes": { "x_mitre_id": "T1060" }, "authorized_members": [], "confidence": 50, "created": "2026-01-18T18:02:56.955Z", "created_by": null, "dates": { "created": "2026-01-18T18:02:56.955Z", "created_at": "2026-01-18T18:20:19.945Z", "modified": "2026-01-18T18:20:20.258Z", "updated_at": "2026-01-18T18:20:20.258Z" }, "description_available": false, "evidence_ids": [ "7ff60055-21c1-409a-9560-13b0dcf950ce", "8cbc136d-7185-4164-a1a0-8a5e3934d4ad" ], "external_id": "T1060", "id": "8cbc136d-7185-4164-a1a0-8a5e3934d4ad", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": "T1060", "modified": "2026-01-18T18:20:20.258Z", "name": "T1060", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "T1060", "id": "e3370d72-be82-43ba-a214-9485a9e8708c", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1060" } ], "relationship_ids": [ "7ff60055-21c1-409a-9560-13b0dcf950ce" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "tactics": [], "url": "https://attack.mitre.org/techniques/T1060/", "via_entities": [ { "id": "657ff382-024b-45a4-974a-3e41f1762074", "name": "Cobalt Strike - S0154", "type": "Malware" } ] }, { "aliases": [], "attributes": { "x_mitre_id": "TA0007" }, "authorized_members": [], "confidence": 50, "created": "2026-01-19T18:04:26.693Z", "created_by": null, "dates": { "created": "2026-01-19T18:04:26.693Z", "created_at": "2026-02-24T10:59:25.122Z", "modified": "2026-02-24T10:59:25.604Z", "updated_at": "2026-02-24T10:59:25.604Z" }, "description_available": false, "evidence_ids": [ "974f2eb7-8de9-4a1c-b2ec-240a523c6f54", "b567183b-d314-4266-96a5-7c9ed53ab2b0" ], "external_id": null, "id": "b567183b-d314-4266-96a5-7c9ed53ab2b0", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": null, "modified": "2026-02-24T10:59:25.604Z", "name": "TA0007", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "TA0007", "id": "9e1f03d3-a465-4763-b502-2eb00bbd87eb", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/TA0007" } ], "relationship_ids": [ "974f2eb7-8de9-4a1c-b2ec-240a523c6f54" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "tactics": [], "url": null, "via_entities": [ { "id": "657ff382-024b-45a4-974a-3e41f1762074", "name": "Cobalt Strike - S0154", "type": "Malware" } ] }, { "aliases": [], "attributes": { "x_mitre_id": "T1574.002" }, "authorized_members": [], "confidence": 50, "created": "2026-01-18T18:28:11.149Z", "created_by": null, "dates": { "created": "2026-01-18T18:28:11.149Z", "created_at": "2026-01-21T11:31:18.951Z", "modified": "2026-01-21T11:31:19.843Z", "updated_at": "2026-01-21T11:31:19.843Z" }, "description_available": false, "evidence_ids": [ "62f6950e-034b-4a45-90cc-a7c2171423c2", "ea4de683-0cad-4497-a044-65b61045d534" ], "external_id": "T1574.002", "id": "ea4de683-0cad-4497-a044-65b61045d534", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": "T1574.002", "modified": "2026-01-21T11:31:19.843Z", "name": "T1574.002", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "T1574.002", "id": "7a1e1096-14a3-4673-8aa4-da93b15cb955", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1574/002" } ], "relationship_ids": [ "62f6950e-034b-4a45-90cc-a7c2171423c2" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "tactics": [], "url": "https://attack.mitre.org/techniques/T1574/002/", "via_entities": [ { "id": "657ff382-024b-45a4-974a-3e41f1762074", "name": "Cobalt Strike - S0154", "type": "Malware" } ] } ], "via_entity": { "id": "657ff382-024b-45a4-974a-3e41f1762074", "name": "Cobalt Strike - S0154", "type": "Malware" } }, { "complete": true, "relationships": [ { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-03-18T09:13:59.146Z", "created_at": "2026-04-24T13:22:16.887Z", "modified": "2026-04-24T13:22:17.771Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-04-24T13:22:17.771Z" }, "description_available": false, "entity_type": "uses", "fromId": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "from_id": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "from_name": "TernDoor", "from_type": "Malware", "id": "07fd1b33-8e0a-4bb5-80a8-7a2029318f61", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--be910e87-c097-5e6a-ab22-46ba14698d05", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" } ], "scope": "entity-context", "techniques": [ { "aliases": [], "attributes": { "x_mitre_id": "T1574.002" }, "authorized_members": [], "confidence": 50, "created": "2026-01-18T18:28:11.149Z", "created_by": null, "dates": { "created": "2026-01-18T18:28:11.149Z", "created_at": "2026-01-21T11:31:18.951Z", "modified": "2026-01-21T11:31:19.843Z", "updated_at": "2026-01-21T11:31:19.843Z" }, "description_available": false, "evidence_ids": [ "07fd1b33-8e0a-4bb5-80a8-7a2029318f61", "ea4de683-0cad-4497-a044-65b61045d534" ], "external_id": "T1574.002", "id": "ea4de683-0cad-4497-a044-65b61045d534", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": "T1574.002", "modified": "2026-01-21T11:31:19.843Z", "name": "T1574.002", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "T1574.002", "id": "7a1e1096-14a3-4673-8aa4-da93b15cb955", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1574/002" } ], "relationship_ids": [ "07fd1b33-8e0a-4bb5-80a8-7a2029318f61" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "tactics": [], "url": "https://attack.mitre.org/techniques/T1574/002/", "via_entities": [ { "id": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "name": "TernDoor", "type": "Malware" } ] } ], "via_entity": { "id": "92ee9da0-00d3-4362-bf8c-018cc2894cbc", "name": "TernDoor", "type": "Malware" } }, { "complete": true, "relationships": [ { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-03-18T09:13:59.184Z", "created_at": "2026-04-24T13:23:33.611Z", "modified": "2026-04-24T13:23:35.833Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-04-24T13:23:35.833Z" }, "description_available": false, "entity_type": "uses", "fromId": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "from_id": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "from_name": "CrowDoor", "from_type": "Malware", "id": "3e680da4-4583-45c2-b88c-564d89e55d51", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--2f597f4f-a263-5964-b913-9fb8aa0043e9", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" } ], "scope": "entity-context", "techniques": [ { "aliases": [], "attributes": { "x_mitre_id": "T1574.002" }, "authorized_members": [], "confidence": 50, "created": "2026-01-18T18:28:11.149Z", "created_by": null, "dates": { "created": "2026-01-18T18:28:11.149Z", "created_at": "2026-01-21T11:31:18.951Z", "modified": "2026-01-21T11:31:19.843Z", "updated_at": "2026-01-21T11:31:19.843Z" }, "description_available": false, "evidence_ids": [ "3e680da4-4583-45c2-b88c-564d89e55d51", "ea4de683-0cad-4497-a044-65b61045d534" ], "external_id": "T1574.002", "id": "ea4de683-0cad-4497-a044-65b61045d534", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": "T1574.002", "modified": "2026-01-21T11:31:19.843Z", "name": "T1574.002", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "T1574.002", "id": "7a1e1096-14a3-4673-8aa4-da93b15cb955", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1574/002" } ], "relationship_ids": [ "3e680da4-4583-45c2-b88c-564d89e55d51" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "tactics": [], "url": "https://attack.mitre.org/techniques/T1574/002/", "via_entities": [ { "id": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "name": "CrowDoor", "type": "Malware" } ] } ], "via_entity": { "id": "d2e9a54d-b7a3-4ced-a500-75e86e693745", "name": "CrowDoor", "type": "Malware" } }, { "complete": true, "relationships": [ { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T16:23:00.252Z", "created_at": "2026-02-06T21:23:37.100Z", "modified": "2026-02-06T21:23:37.477Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-02-06T21:23:37.477Z" }, "description_available": false, "entity_type": "uses", "fromId": "fab79403-9d60-420c-bc87-42b644d12f6d", "from_id": "fab79403-9d60-420c-bc87-42b644d12f6d", "from_name": "ShadowPad - S0596", "from_type": "Malware", "id": "3a0176c0-e1aa-48fe-9c9c-3d10075cf12a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--34df28a9-90b6-529b-bb30-c99219b158a8", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" } ], "scope": "entity-context", "techniques": [ { "aliases": [], "attributes": { "x_mitre_id": "T1574.002" }, "authorized_members": [], "confidence": 50, "created": "2026-01-18T18:28:11.149Z", "created_by": null, "dates": { "created": "2026-01-18T18:28:11.149Z", "created_at": "2026-01-21T11:31:18.951Z", "modified": "2026-01-21T11:31:19.843Z", "updated_at": "2026-01-21T11:31:19.843Z" }, "description_available": false, "evidence_ids": [ "3a0176c0-e1aa-48fe-9c9c-3d10075cf12a", "ea4de683-0cad-4497-a044-65b61045d534" ], "external_id": "T1574.002", "id": "ea4de683-0cad-4497-a044-65b61045d534", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": "T1574.002", "modified": "2026-01-21T11:31:19.843Z", "name": "T1574.002", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "T1574.002", "id": "7a1e1096-14a3-4673-8aa4-da93b15cb955", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1574/002" } ], "relationship_ids": [ "3a0176c0-e1aa-48fe-9c9c-3d10075cf12a" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "tactics": [], "url": "https://attack.mitre.org/techniques/T1574/002/", "via_entities": [ { "id": "fab79403-9d60-420c-bc87-42b644d12f6d", "name": "ShadowPad - S0596", "type": "Malware" } ] } ], "via_entity": { "id": "fab79403-9d60-420c-bc87-42b644d12f6d", "name": "ShadowPad - S0596", "type": "Malware" } }, { "complete": true, "relationships": [ { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T19:06:37.180Z", "created_at": "2026-03-06T10:46:16.026Z", "modified": "2026-03-06T10:46:16.236Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-03-06T10:46:16.236Z" }, "description_available": false, "entity_type": "uses", "fromId": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "from_id": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "from_name": "PlugX - S0013", "from_type": "Malware", "id": "6fa2c3af-1f68-4c93-ab5d-0d477566a83e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--0ce56d0e-8779-5cd4-8c75-3dd8d6a007e5", "toId": "bcecf1fa-9234-4501-b5a0-e8e443ad40b6", "to_id": "bcecf1fa-9234-4501-b5a0-e8e443ad40b6", "to_name": "T1179", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-18T18:44:37.332Z", "created_at": "2026-01-22T22:03:42.166Z", "modified": "2026-01-22T22:03:42.803Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-22T22:03:42.803Z" }, "description_available": false, "entity_type": "uses", "fromId": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "from_id": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "from_name": "PlugX - S0013", "from_type": "Malware", "id": "7b26f71b-cece-41fd-8c75-7c9e1081fccd", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--cb0deb72-198a-5594-85b1-98d50edfe0cc", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T19:39:35.322Z", "created_at": "2026-03-12T16:34:23.205Z", "modified": "2026-03-12T16:34:24.533Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-03-12T16:34:24.533Z" }, "description_available": false, "entity_type": "uses", "fromId": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "from_id": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "from_name": "PlugX - S0013", "from_type": "Malware", "id": "bb525bd9-1c4e-453a-91fa-b0a3cabb90f3", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "standard_id": "relationship--a367e49d-771d-5973-97db-cdef97801c18", "toId": "cc1e1224-78af-4b0b-a9da-38f8730313e7", "to_id": "cc1e1224-78af-4b0b-a9da-38f8730313e7", "to_name": "T1089", "to_type": "AttackPattern" } ], "scope": "entity-context", "techniques": [ { "aliases": [], "attributes": { "x_mitre_id": "T1179" }, "authorized_members": [], "confidence": 50, "created": "2026-01-18T18:05:35.103Z", "created_by": null, "dates": { "created": "2026-01-18T18:05:35.103Z", "created_at": "2026-01-19T04:22:16.828Z", "modified": "2026-01-19T04:22:17.182Z", "updated_at": "2026-01-19T04:22:17.182Z" }, "description_available": false, "evidence_ids": [ "6fa2c3af-1f68-4c93-ab5d-0d477566a83e", "bcecf1fa-9234-4501-b5a0-e8e443ad40b6" ], "external_id": "T1179", "id": "bcecf1fa-9234-4501-b5a0-e8e443ad40b6", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": "T1179", "modified": "2026-01-19T04:22:17.182Z", "name": "T1179", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "T1179", "id": "203db34a-72aa-4468-be6e-d704951c7f9e", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1179" } ], "relationship_ids": [ "6fa2c3af-1f68-4c93-ab5d-0d477566a83e" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "tactics": [], "url": "https://attack.mitre.org/techniques/T1179/", "via_entities": [ { "id": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "name": "PlugX - S0013", "type": "Malware" } ] }, { "aliases": [], "attributes": { "x_mitre_id": "T1089" }, "authorized_members": [], "confidence": 50, "created": "2026-01-18T18:06:29.681Z", "created_by": null, "dates": { "created": "2026-01-18T18:06:29.681Z", "created_at": "2026-01-19T07:21:20.898Z", "modified": "2026-01-19T07:21:21.289Z", "updated_at": "2026-01-19T07:21:21.289Z" }, "description_available": false, "evidence_ids": [ "bb525bd9-1c4e-453a-91fa-b0a3cabb90f3", "cc1e1224-78af-4b0b-a9da-38f8730313e7" ], "external_id": "T1089", "id": "cc1e1224-78af-4b0b-a9da-38f8730313e7", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": "T1089", "modified": "2026-01-19T07:21:21.289Z", "name": "T1089", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "T1089", "id": "a0290b77-0ef9-4700-8cab-88f7fa020d1a", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1089" } ], "relationship_ids": [ "bb525bd9-1c4e-453a-91fa-b0a3cabb90f3" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "tactics": [], "url": "https://attack.mitre.org/techniques/T1089/", "via_entities": [ { "id": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "name": "PlugX - S0013", "type": "Malware" } ] }, { "aliases": [], "attributes": { "x_mitre_id": "T1574.002" }, "authorized_members": [], "confidence": 50, "created": "2026-01-18T18:28:11.149Z", "created_by": null, "dates": { "created": "2026-01-18T18:28:11.149Z", "created_at": "2026-01-21T11:31:18.951Z", "modified": "2026-01-21T11:31:19.843Z", "updated_at": "2026-01-21T11:31:19.843Z" }, "description_available": false, "evidence_ids": [ "7b26f71b-cece-41fd-8c75-7c9e1081fccd", "ea4de683-0cad-4497-a044-65b61045d534" ], "external_id": "T1574.002", "id": "ea4de683-0cad-4497-a044-65b61045d534", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": "T1574.002", "modified": "2026-01-21T11:31:19.843Z", "name": "T1574.002", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "T1574.002", "id": "7a1e1096-14a3-4673-8aa4-da93b15cb955", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1574/002" } ], "relationship_ids": [ "7b26f71b-cece-41fd-8c75-7c9e1081fccd" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/", "tactics": [], "url": "https://attack.mitre.org/techniques/T1574/002/", "via_entities": [ { "id": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "name": "PlugX - S0013", "type": "Malware" } ] } ], "via_entity": { "id": "ffc069ef-4ed2-4173-9cc0-4008e5b52a29", "name": "PlugX - S0013", "type": "Malware" } } ], "direct_techniques": [], "official_catalog": { "complete": true, "fetched_at": "2026-10-10T18:17:18Z", "schema_version": 1, "source_sha256": "6227cd8ff0e21fc6355dc871dcad6a354b0d36570d2c3b783667577320378730", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/master/enterprise-attack/enterprise-attack.json", "techniques": [ { "attack_version": "1.1", "canonical_url": "https://attack.mitre.org/techniques/T1023/", "created": "2017-05-31T21:30:30.757Z", "deprecated": false, "matched": true, "mitre_id": "T1023", "modified": "2025-10-24T17:49:07.761Z", "official_name": "Shortcut Modification", "official_status": "revoked", "official_tactics": [ { "mitre_id": "TA0003", "name": "Persistence", "shortname": "persistence" } ], "replacements": [ { "canonical_url": "https://attack.mitre.org/techniques/T1547/009/", "mitre_id": "T1547.009", "official_name": "Shortcut Modification", "official_status": "active", "relationship_id": "relationship--fe8358f5-ead6-4ae7-a88c-831dda8ab123", "stix_id": "attack-pattern--4ab929c6-ee2d-4fb5-aab4-b14be2ed7179" } ], "revoked": true, "stix_id": "attack-pattern--970cdb5c-02fb-4c38-b17e-d6327cf3c810" }, { "attack_version": "1.2", "canonical_url": "https://attack.mitre.org/techniques/T1045/", "created": "2017-05-31T21:30:43.472Z", "deprecated": false, "matched": true, "mitre_id": "T1045", "modified": "2026-04-14T22:53:14.880Z", "official_name": "Software Packing", "official_status": "revoked", "official_tactics": [ { "mitre_id": "TA0005", "name": "Stealth", "shortname": "stealth" } ], "replacements": [ { "canonical_url": "https://attack.mitre.org/techniques/T1027/002/", "mitre_id": "T1027.002", "official_name": "Software Packing", "official_status": "active", "relationship_id": "relationship--3d131e85-111d-4df2-ba93-274acba5146f", "stix_id": "attack-pattern--deb98323-e13f-4b0c-8d94-175379069062" } ], "revoked": true, "stix_id": "attack-pattern--6ff403bc-93e3-48be-8687-e102fdba8c88" }, { "attack_version": "1.1", "canonical_url": "https://attack.mitre.org/techniques/T1060/", "created": "2017-05-31T21:30:49.988Z", "deprecated": false, "matched": true, "mitre_id": "T1060", "modified": "2025-10-24T17:49:07.015Z", "official_name": "Registry Run Keys / Startup Folder", "official_status": "revoked", "official_tactics": [ { "mitre_id": "TA0003", "name": "Persistence", "shortname": "persistence" } ], "replacements": [ { "canonical_url": "https://attack.mitre.org/techniques/T1547/001/", "mitre_id": "T1547.001", "official_name": "Registry Run Keys / Startup Folder", "official_status": "active", "relationship_id": "relationship--330c49c0-a785-46f9-99c1-74322e26e20d", "stix_id": "attack-pattern--9efb1ea7-c37b-4595-9640-b7680cd84279" } ], "revoked": true, "stix_id": "attack-pattern--9422fc14-1c43-410d-ab0f-a709b76c72dc" }, { "attack_version": "1.1", "canonical_url": "https://attack.mitre.org/techniques/T1076/", "created": "2017-05-31T21:30:59.769Z", "deprecated": false, "matched": true, "mitre_id": "T1076", "modified": "2025-10-24T17:48:46.864Z", "official_name": "Remote Desktop Protocol", "official_status": "revoked", "official_tactics": [ { "mitre_id": "TA0008", "name": "Lateral Movement", "shortname": "lateral-movement" } ], "replacements": [ { "canonical_url": "https://attack.mitre.org/techniques/T1021/001/", "mitre_id": "T1021.001", "official_name": "Remote Desktop Protocol", "official_status": "active", "relationship_id": "relationship--fd31c763-8e36-4f6f-9238-fed081b524b3", "stix_id": "attack-pattern--eb062747-2193-45de-8fa2-e62549c37ddf" } ], "revoked": true, "stix_id": "attack-pattern--51dea151-0898-4a45-967c-3ebee0420484" }, { "attack_version": "1.3", "canonical_url": "https://attack.mitre.org/techniques/T1081/", "created": "2017-05-31T21:31:02.188Z", "deprecated": false, "matched": true, "mitre_id": "T1081", "modified": "2025-10-24T17:49:17.543Z", "official_name": "Credentials in Files", "official_status": "revoked", "official_tactics": [ { "mitre_id": "TA0006", "name": "Credential Access", "shortname": "credential-access" } ], "replacements": [ { "canonical_url": "https://attack.mitre.org/techniques/T1552/001/", "mitre_id": "T1552.001", "official_name": "Credentials In Files", "official_status": "active", "relationship_id": "relationship--25ca7826-9f46-45e4-97e8-c942f9a2611d", "stix_id": "attack-pattern--837f9164-50af-4ac0-8219-379d8a74cefc" } ], "revoked": true, "stix_id": "attack-pattern--ba8e391f-14b5-496f-81f2-2d5ecd646c1c" }, { "attack_version": "1.2", "canonical_url": "https://attack.mitre.org/techniques/T1086/", "created": "2017-05-31T21:31:06.512Z", "deprecated": false, "matched": true, "mitre_id": "T1086", "modified": "2025-10-24T17:49:36.765Z", "official_name": "PowerShell", "official_status": "revoked", "official_tactics": [ { "mitre_id": "TA0002", "name": "Execution", "shortname": "execution" } ], "replacements": [ { "canonical_url": "https://attack.mitre.org/techniques/T1059/001/", "mitre_id": "T1059.001", "official_name": "PowerShell", "official_status": "active", "relationship_id": "relationship--d948a3b2-4873-4175-be18-ddef1c20347d", "stix_id": "attack-pattern--970a3432-3237-47ad-bcca-7d8cbb217736" } ], "revoked": true, "stix_id": "attack-pattern--f4882e23-8aa7-4b12-b28a-b349c12ee9e0" }, { "attack_version": "1.1", "canonical_url": "https://attack.mitre.org/techniques/T1089/", "created": "2017-05-31T21:31:07.958Z", "deprecated": false, "matched": true, "mitre_id": "T1089", "modified": "2026-04-14T22:53:15.926Z", "official_name": "Disabling Security Tools", "official_status": "revoked", "official_tactics": [ { "mitre_id": "TA0005", "name": "Stealth", "shortname": "stealth" } ], "replacements": [ { "canonical_url": "https://attack.mitre.org/techniques/T1685/", "mitre_id": "T1685", "official_name": "Disable or Modify Tools", "official_status": "active", "relationship_id": "relationship--a2f2622d-ca70-418a-ba20-50e19f946253", "stix_id": "attack-pattern--bbde9781-60aa-4b8a-a911-895b0c1b3872" } ], "revoked": true, "stix_id": "attack-pattern--2e0dd10b-676d-4964-acd0-8a404c92b044" }, { "attack_version": "1.1", "canonical_url": "https://attack.mitre.org/techniques/T1094/", "created": "2017-05-31T21:31:10.314Z", "deprecated": false, "matched": true, "mitre_id": "T1094", "modified": "2025-10-24T17:49:37.745Z", "official_name": "Custom Command and Control Protocol", "official_status": "revoked", "official_tactics": [ { "mitre_id": "TA0011", "name": "Command and Control", "shortname": "command-and-control" } ], "replacements": [ { "canonical_url": "https://attack.mitre.org/techniques/T1095/", "mitre_id": "T1095", "official_name": "Non-Application Layer Protocol", "official_status": "active", "relationship_id": "relationship--e4a43af9-e8f0-42cf-a707-b2393efb44f5", "stix_id": "attack-pattern--c21d5a77-d422-4a69-acd7-2c53c1faa34b" } ], "revoked": true, "stix_id": "attack-pattern--f72eb8a8-cd4c-461d-a814-3f862befbf00" }, { "attack_version": "1.1", "canonical_url": "https://attack.mitre.org/techniques/T1179/", "created": "2018-01-16T16:13:52.465Z", "deprecated": false, "matched": true, "mitre_id": "T1179", "modified": "2025-10-24T17:48:52.925Z", "official_name": "Hooking", "official_status": "revoked", "official_tactics": [ { "mitre_id": "TA0006", "name": "Credential Access", "shortname": "credential-access" }, { "mitre_id": "TA0003", "name": "Persistence", "shortname": "persistence" }, { "mitre_id": "TA0004", "name": "Privilege Escalation", "shortname": "privilege-escalation" } ], "replacements": [ { "canonical_url": "https://attack.mitre.org/techniques/T1056/004/", "mitre_id": "T1056.004", "official_name": "Credential API Hooking", "official_status": "active", "relationship_id": "relationship--fb82f6d3-0e6b-4fa5-a54a-f7deb28f8324", "stix_id": "attack-pattern--f5946b5e-9408-485f-a7f7-b5efc88909b6" } ], "revoked": true, "stix_id": "attack-pattern--66f73398-8394-4711-85e5-34c8540b22a5" }, { "attack_version": "2.1", "canonical_url": "https://attack.mitre.org/techniques/T1574/002/", "created": "2020-03-13T19:41:37.908Z", "deprecated": false, "matched": true, "mitre_id": "T1574.002", "modified": "2026-04-15T22:56:43.434Z", "official_name": "DLL Side-Loading", "official_status": "revoked", "official_tactics": [ { "mitre_id": "TA0002", "name": "Execution", "shortname": "execution" }, { "mitre_id": "TA0005", "name": "Stealth", "shortname": "stealth" } ], "replacements": [ { "canonical_url": "https://attack.mitre.org/techniques/T1574/001/", "mitre_id": "T1574.001", "official_name": "DLL", "official_status": "active", "relationship_id": "relationship--7bb3a367-c3fd-4981-8d95-8ba142f92cf2", "stix_id": "attack-pattern--2fee9321-3e71-4cf4-af24-d4d40d355b34" } ], "revoked": true, "stix_id": "attack-pattern--e64c62cf-9cd7-4a14-94ec-cdaac43ab44b" } ] } }, "report_metadata": { "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-10T22:17:12.082Z", "created_at": "2026-09-26T06:12:22.841Z", "modified": "2026-09-26T06:12:25.079Z", "published": "2026-09-10T22:17:12.082Z", "updated_at": "2026-09-26T06:12:25.079Z" }, "description_available": true, "id": "15f5b121-2252-47e8-9fee-e0cdb8fc688c", "is_inferred": false, "labels": [ "cobalt strike", "crowdoor", "hellobot", "hemigate", "linux implant", "mélofée", "plugx", "ratels", "reptile", "shadowpad", "spark", "stowaway", "terndoor" ], "lang": "en", "name": "Melofee: a look back at a Linux implant and its new variants", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "published": "2026-09-10T22:17:12.082Z", "references": [ { "external_id": null, "id": "1c099f55-65b1-47b9-9c62-50f5ec3a6f32", "source_name": "alien-vault", "url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/" }, { "external_id": "6aa32c68adf3f06777eb0318", "id": "4cd45098-b50f-4ae0-9427-0b5891bcce1f", "source_name": "alien-vault", "url": "https://otx.alienvault.com/pulse/6aa32c68adf3f06777eb0318" } ], "report_types": [ "threat-report" ], "restrict_access": false, "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/" }, "targets": [], "techniques": [], "vulnerabilities": [] }, "report_id": "15f5b121-2252-47e8-9fee-e0cdb8fc688c", "schema_version": 1, "selected_date": "2026-09-11", "source_url": "https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/" }