🐧 Auto-Color Linux backdoor rootkit analysis, 🇨🇳 PackClient RAT tax phishing campaign, 🇩🇪 Berlin ransom demand widens, 🏥 PEAR leaks 1.4TB from Texas health org, 🏛️ US officials walk back China hack claims, 💊 McKesson 284M records claim

A new deep-dive analysis of Auto-Color reveals the inner workings of an emerging Linux backdoor that combines a remote access trojan with an LD_PRELOAD user-space rootkit. First documented by Palo Alto Networks Unit 42 in February 2025, Auto-Color targets universities and government offices in North America and Asia, with earliest samples collected in late 2024. The analysis shows two execution paths depending on privilege level: without root, it stores state under /tmp/cross and phones home to 146.70.41.178:443; with root, it installs itself under /var/log/cross and drops libcext.so.2 into the LD_PRELOAD chain, allowing it to hide its files and filter entries from /proc/net/tcp across all dynamically linked programs. The delivery vector remains unknown, but the rootkit's ability to conceal network connections from system monitoring tools makes detection significantly harder for defenders running standard forensics.

TA4922, a Chinese-speaking threat actor, is deploying PackClient RAT through tax-themed phishing campaigns targeting organizations in mainland China and India. Proofpoint observed the activity in May and July 2026, with the first campaign impersonating the Shandong Provincial Tax Bureau and warning recipients they had been selected for a 2026 tax inspection. Emails directed victims to download a ZIP archive from gov12366[.]com containing an executable that initiates the PackClient infection chain. PackClient is a modular RAT framework marketed through Chinese-language Telegram channels, providing data-theft, surveillance, remote control, payload delivery, and persistence capabilities. The first-stage downloader checks for elevated privileges and drops a DLL invoked through rundll32.exe, making the malware adaptable to espionage, financial crime, reconnaissance, or follow-on ransomware operations.

Berlin's state government has declined to comment on the demands made by hackers who targeted the city's administrative data network two weeks ago, with a spokeswoman confirming the government is withholding information about which data the attackers accessed and exactly who is behind the attack. The hackers are demanding 30 bitcoin, and the breach has widened as the government refuses to disclose the scope of compromised data, citing investigative tactics. The silence from Berlin's administration suggests the incident may be more severe than initially communicated, and the refusal to identify the threat actor leaves open whether this is a financially motivated group or a state-linked operation.

PEAR ransomware group claims to have exfiltrated approximately 1.4 TB of data from South Plains Rural Health Services, a nonprofit healthcare organization that has served rural communities across West Texas for decades. The group has begun leaking data while SPRHS remains silent on the incident, following the pattern of healthcare ransomware groups using data publication as leverage when victims refuse to negotiate. The breach adds to the ongoing wave of attacks targeting small and rural healthcare providers that often lack the security resources of larger hospital systems.

U.S. officials are backpedaling on claims that several government agencies were hacked by Chinese spies, now saying the organizations were among the hackers' targets rather than confirmed victims. In a freshly edited statement, the Justice Department said the U.S. Senate, the Federal Reserve, NASA, and others were "among the targets," walking back earlier language that implied successful intrusions. The revision suggests the initial assessment may have been overstated or that classification boundaries prevented accurate public communication about the scope of the compromise.

Two different threat groups have recently attacked Interim HealthCare franchise entities, raising concerns about whether other locations in the home care franchise network face similar risks. Interim HealthCare of West Texas LLC notified HHS that 2,071 patients were affected, while the Amarillo franchise reported 666 patients impacted. The involvement of two separate groups suggests the franchise model itself may be creating attack surface, with individual locations maintaining inconsistent security postures that threat actors are exploiting at scale.

ShinyHunters claims to have stolen 284 million patient data records from McKesson, one of the largest healthcare and pharmaceutical distributors in the United States. The breach continues to develop as the scale of claimed theft would make it one of the largest healthcare data breaches on record, with compromised data potentially spanning patients across numerous provider networks served by McKesson's distribution infrastructure. McKesson has confirmed unauthorized access to third-party applications and data exfiltration in its SEC filing, but the investigation remains in early stages.

TerminalFix continues to gain attention as additional security outlets publish analysis of the ClickFix variant that uses fake Cloudflare CAPTCHA overlays to trick users into pasting malicious PowerShell commands. The attack chain, documented by Microsoft Threat Intelligence, downloads a ZIP archive containing a legitimate signed binary and a malicious DLL for sideloading, then extracts steganographic payloads from PNG images and establishes persistence through Registry Run keys and scheduled tasks, ultimately deploying a custom reverse-tunnel implant that turns compromised Windows devices into network pivot points.

Gogs CVE-2026-52813 continues to draw coverage as additional outlets report on the critical path traversal vulnerability that allows authenticated attackers to achieve remote code execution through unsanitized organization usernames. The flaw, reported by Aikido researcher Jorian Woltjer and fixed in Gogs 0.14.3, lets attackers create organizations with directory traversal sequences in the name, placing bare repositories at attacker-chosen filesystem locations and writing malicious Git hook files. With self-registration enabled by default and over 2,300 internet-exposed instances tracked by Shadowserver, the combination of default open registration and straightforward privilege escalation makes this a high-priority patch target.

The TanStack Query npm supply-chain compromise continues to be analyzed as security researchers dig into the tradecraft behind 10 malicious versions of @7nohe/openapi-react-query-codegen published within a 20-minute window. The attackers abused a weakness in a GitHub Actions workflow to carry valid provenance attestations, meaning attestation checks that normally signal trust cannot catch a compromised workflow itself. The payload identifies itself as "Trinitite: Sponsored by Preview 2 Effects" and uses binding.gyp during installation to execute obfuscated code via Python's class hierarchy, ultimately running a Node.js payload that steals developer credentials and can backdoor repositories.

Hasbro disclosed a data breach that exposed employee personal information, though the toy and entertainment company has provided limited details about the scope or method of the intrusion. The breach adds to the growing list of major corporations experiencing data exposure incidents affecting their workforce, and the lack of specificity about what personal information was compromised leaves employees uncertain about their exposure to identity theft or other follow-on attacks.

Watchlist: monitor Auto-Color C2 infrastructure at 146.70.41.178 and audit Linux systems for LD_PRELOAD modifications to libcext.so.2; track the Berlin breach for ransom payment or data publication decisions; investigate Interim HealthCare franchise locations for additional compromise and assess whether the franchise model creates systemic security gaps; watch McKesson's investigation for breach scope confirmation and downstream impact on US healthcare supply chains; patch Gogs to 0.14.3 and audit for organization names containing traversal sequences; audit npm dependencies for openapi-react-query-codegen and rotate any credentials exposed through CI/CD pipelines that used the compromised package.