Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Auto-Color: An Emerging and Evasive Linux Backdoor

Summary: Palo Alto Networks researchers discovered a new Linux backdoor called Auto-color, with samples collected between Nov. 5 and Dec. 5, 2024, that has primarily targeted universities and government offices in North America and Asia. Once installed with root privileges, the malware plants a library implant named libcext.so.2, writes it into /etc/ld.preload to hook libc functions, and hides its network connections by filtering entries out of /proc/net/tcp.

Why it matters: The malware gives threat actors full remote access and is difficult to remove without specialized software, and because each sample carries a statically compiled encrypted command-and-control payload, hashes differ from sample to sample even though file sizes stay the same - so hash-based detection alone will not catch it.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Detection & Response
Related
YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026