Stealthy Linux 'Auto-color' Backdoor Paints US Institutions With Malware

Palo Alto Networks Unit 42 identified a stealthy Linux backdoor dubbed "Auto-color" deployed in attacks targeting educational and public-sector organizations in North America and Asia; the backdoor uses variable benign file names, a root-only library implant to hide network activity (manipulating /proc/net/tcp), prevents uninstallation, and encrypts C2/configuration with proprietary algorithms, and Unit 42 published IoCs and mitigation guidance.