New Backdoor Auto-color Linux Targets Systems in US and Asia

Palo Alto Networks Unit 42 discovered Auto-color, a sophisticated Linux backdoor active between November and December 2024 that targets education and government organizations in North America and Asia. The malware uses innocuous filenames with varying hashes (due to embedded encrypted C2 payloads), installs a malicious library (using ld.preload to override system functions when possible), hooks libc functions to hide network activity by altering /proc/net/tcp, and communicates with attackers via a custom stream cipher; Unit 42 recommends stricter privilege controls, behavioural detection, and continuous Linux monitoring to mitigate the threat.