Reported by 1 outlet

Timeline

1. original reporting

   Reverse Engineering the Auto-Color Linux Backdoor

   malware.news · 44d ago · August 30th, 2026

   Static and dynamic analysis of Auto-Color’s execution flow, C2 communication, and LD_PRELOAD rootkit. Auto-Color in a Nutshell Auto-Color is an emerging Linux backdoor first documented by Palo Alto Networks Unit 42 in February 2025. The earliest known samples were collected between November and December 2024, with universities and government offices in North America and Asia being the main observed targets. The family was named after the filename used by the payload after installation. Its initial delivery method is still unknown, but once executed it can provide an attacker with remote access while using several techniques to hide its activity. Technical Summary The sample analyzed in this report has two noticeably different execution paths. Without root privileges, it moves into the background, stores its state under /tmp/cross, and repeatedly tries to contact 146.70.41.178:443. When it runs as root, it goes a step further by installing itself under /var/log/cross and dropping a shared library named libcext.so.2. This library is the most interesting part of the sample. Auto-Color writes it to /lib/x86_64-linux-gnu/libcext.so.2 and adds its path to /etc/ld.so.preload. This causes the library to load inside other dynamically linked programs, where it can hide the malware's files and filter entries from /proc/net/tcp. Auto-Color therefore combines its backdoor functionality with a user-space rootkit designed to conceal its activity. The sample chooses /var/log/cross when runni