Auto-Color Linux Backdoor Reverse-Engineered: Root-Level LD_PRELOAD Persistence and Encrypted C2

Auto-Color Linux Backdoor Reverse-Engineered (TL-2026-2264), also tracked as Auto-Color, is a high-severity malware campaign, first published 2026-08-30. It has no confirmed attribution, affects Linux Linux x86-64 servers (glibc dynamic linker), maps to 15 MITRE ATT&CK techniques (T1014, T1036.005, T1057), and is covered by 9 detection rules and 22 indicators of compromise.

Key facts for TL-2026-2264

Threat ID
TL-2026-2264
Also known as
Auto-Color, elf.auto_color
Severity
HIGH
Status
ACTIVE
Category
MALWARE
First published
2026-08-30
Last reviewed
2026-08-30
Attribution confidence
LOW
Motivation
ESPIONAGE
Target sectors
government administration, education, chemicals manufacturing, critical infrastructure
Target regions
North America, Asia
Detection rules
9
Indicators of compromise
22

Malware and tooling in Auto-Color Linux Backdoor Reverse-Engineered

Malware and tooling: Auto-Color, KillSwitch, root

Independent reverse-engineering (Zyad Elzyat, published 2026-08-30) dissects Auto-Color, an x86-64 Linux rootkit-backdoor first documented by Unit 42 in February 2025, detailing its /etc/ld.so.preload shared-library hijack, libc-function hooking for file/connection concealment, SELinux tampering, and an encrypted TCP/443 C2 channel that beacons a 16-byte value every 4-5 seconds.

How Auto-Color Linux Backdoor Reverse-Engineered works

Auto-Color (Malpedia: elf.auto_color) is an x86-64 ELF Linux backdoor first documented by Palo Alto Networks Unit 42 on 2025-02-24 after samples were observed in the wild between November and December 2024 against universities and government offices in North America and Asia. A new independent reverse-engineering writeup by Zyad Elzyat, published 2026-08-30 (fetched via its malware.news mirror after the primary Medium URL returned HTTP 403; an archive.org snapshot is also on record), analyzes a captured 229,160-byte sample (SHA-256 270fc72074c697ba5921f7b61a6128b968ca6ccbf8906645e796cfc3072d4c43, x86-64 PIE, dynamically linked, stripped, Build ID 043cd4c5b9346b072d4c6dff0a87092556031018, detected by only 36 of 63 AV engines at capture) and confirms/extends the original Unit 42 findings with concrete artifacts.

On first execution, the dropper runs under a benign-looking name (Unit 42 documented 'door', 'egg', 'log', 'edus', 'edu', 'exup', and 'law'). If it has root privileges, it copies itself to /var/log/cross/auto-color (working directory /tmp/cross for non-root execution), drops an embedded 35,160-byte ELF shared library (SHA-256 bf503b5eb456f74187a17bb8c08bccc9b3d91a7f0f6fd50110540b051510d1ca) to /lib/x86_64-linux-gnu/libcext.so.2 — masquerading as the legitimate libcext.so.0 — and writes that library's path into /etc/ld.so.preload, forcing every subsequently-launched process on the host to load it (dynamic linker / LD_PRELOAD hijacking). The library additionally guards /etc/ld.so.preload against modification or removal. Three state files were identified in the working directory: config-err-A7F5EF0D (a lock file), config-err-20FF3326 (an 8-byte binary value), and config-err-03EB4BCE (probed by the sample but its purpose unconfirmed).

The injected library is a rootkit: it hooks open/open64/openat/openat64/fopen/fopen64 to redirect and hide access to its own artifacts using alternate .xxx/.real filenames, hooks readdir/readdir64 to strip its files from directory listings, hooks __xstat/statx/newfstatat/chmod/unlink/unlinkat/remove variants for further concealment, and filters /proc/net/tcp entries (via recvmsg/pcap_loop/pcap_dispatch wrappers and a wrapped memcpy) to remove its own C2 socket from tools that enumerate active connections. When running as root it also calls security_setenforce(0) to disable SELinux enforcement. To avoid triggering security tooling, it explicitly skips activation when running under processes named auditd, cron, crond, acpid, or atd found under /sbin or /usr/sbin, and daemonizes via a double-fork.

C2 uses a lightweight handshake followed by an encrypted channel: the sample repeatedly transmits a 16-byte value roughly every 4-5 seconds over TCP/443 to 146.70.41.178, and separately probes local loopback ports 127.0.0.1:9002 and 127.0.0.1:9003 in a non-blocking manner for an undetermined purpose. Per Unit 42's original analysis, messages are protected by a dynamically-generated 4-byte key that encrypts the remainder of each message's metadata and payload (rotated per session), and Unit 42 additionally observed C2 hosts 216.245.184.214, 146.70.87.67, 65.38.121.64, and 206.189.149.191, all on port 443. The command set gives attackers arbitrary command execution, file modification, a reverse shell (command ID 0x100) for direct interactive access, proxy/traffic-forwarding where the infected host acts as a middleman (command ID 0x300), dynamic configuration updates, and a kill-switch command set (IDs 0, 1, 2, 3, 0xF) that deletes infection artifacts to frustrate incident response.

Auto-Color has since been observed deployed via unrelated initial-access vectors: BleepingComputer (2025-07-29) reported threat actors exploiting the critical SAP NetWeaver Visual Composer Metadata Uploader unrestricted file-upload flaw (CVE-2025-31324, CVSS 10.0, added to the CISA KEV catalog 2025-05-15) to drop ELF Auto-Color payloads onto compromised NetWeaver hosts, beginning with zero-day exploitation in mid-March 2025 and a confirmed attack on a U.S. chemicals company on 2025-04-25; by May 2025 multiple China-nexus intrusion clusters (tracked as Chaya_004, UNC5221, UNC5174, and CL-STA-0048) and ransomware affiliates were separately abusing the same SAP flaw, with reporting describing breaches at 581+ organizations across critical-infrastructure sectors. A variant reported in that window additionally suppresses most malicious behavior when it cannot reach its C2 server, hindering sandbox-based and offline reverse engineering. No CVE applies to Auto-Color itself — it is deployed as a post-exploitation implant rather than exploiting a vulnerability on its own — and no single actor has been publicly attributed as its author; the SAP NetWeaver campaigns show it being reused as commodity/shared tradecraft by multiple, apparently unrelated intrusion sets.

MITRE ATT&CK techniques used in TL-2026-2264

Defense Evasion

T1014 Rootkit; T1036.005 Match Legitimate Resource Name or Location; T1070.004 File Deletion; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion; T1564.001 Hidden Files and Directories

Discovery

T1057 Process Discovery

Execution

T1059.004 Unix Shell; T1204.002 Malicious File

Command and Control

T1090.002 External Proxy; T1571 Non-Standard Port; T1573.001 Symmetric Cryptography

Initial Access

T1190 Exploit Public-Facing Application

stealth

T1574.006 Dynamic Linker Hijacking

defense-impairment

T1685 Disable or Modify Tools

Affected products and versions in Auto-Color Linux Backdoor Reverse-Engineered

  • Linux — Linux x86-64 servers (glibc dynamic linker)
    Vulnerable versions: Any glibc-based Linux distribution supporting /etc/ld.so.preload
  • SAP — SAP NetWeaver Visual Composer (Metadata Uploader) — observed delivery vector in related campaigns
    Vulnerable versions: Instances unpatched for CVE-2025-31324 prior to the April 2025 SAP security patch
    Fixed in: Patched per SAP's April 2025 security note for CVE-2025-31324

Remediation for Auto-Color Linux Backdoor Reverse-Engineered

Patches

  • Apply the SAP security patch for CVE-2025-31324 (SAP NetWeaver Visual Composer Metadata Uploader unrestricted file upload) released April 2025 to all internet-facing NetWeaver instances

Immediate actions

  • Block outbound TCP/443 connections to known Auto-Color C2 hosts 146.70.41.178, 216.245.184.214, 146.70.87.67, 65.38.121.64, and 206.189.149.191 at the perimeter
  • Audit /etc/ld.so.preload on Linux hosts for unexpected entries, especially references to libcext.so.2 or unrecognized libraries masquerading as system libraries
  • Search for and quarantine /var/log/cross/ and /tmp/cross/ directories and their config-err-* contents, and the auto-color binary
  • Verify SELinux is in enforcing mode where required and alert on unexpected security_setenforce(0) calls or getenforce state changes

Workarounds

  • Where patching NetWeaver is not immediately possible, restrict or disable the Visual Composer Metadata Uploader endpoint (/developmentserver/metadatauploader) and the /irj/servlet_jsp servlet from untrusted networks

Longer-term hardening

  • Deploy kernel-level (eBPF/auditd) monitoring for open/openat/readdir syscall hooking and LD_PRELOAD-based library injection, since userspace tools that rely on libc for enumeration can be blinded by this rootkit class
  • Baseline and alert on writes to /etc/ld.so.preload and unauthorized shared libraries dropped into standard library paths (/lib, /lib/x86_64-linux-gnu)
  • Deploy EDR/XDR with kernel-level (not purely libc-mediated) process and network visibility on internet-facing Linux servers
  • Apply Wazuh or equivalent Auto-Color-specific detection content referenced by the vendor community

Timeline of Auto-Color Linux Backdoor Reverse-Engineered

  • Earliest Auto-Color samples observed in the wild, per Unit 42's later analysis (November-December 2024 window).
  • Palo Alto Networks Unit 42 publishes the first public analysis of Auto-Color, documenting root-level ld.so.preload persistence, rootkit behavior, and targeting of North American/Asian universities and government offices.
  • Zero-day exploitation of SAP NetWeaver CVE-2025-31324 begins in the wild, per Mandiant findings, later used as a delivery vector for Auto-Color.
  • Attackers exploit CVE-2025-31324 against a U.S. chemicals company, part of the campaign later reported to deliver Auto-Color.
  • Active exploitation of CVE-2025-31324 observed delivering ELF Auto-Color payloads onto compromised SAP NetWeaver hosts.
  • Reporting describes China-linked intrusion clusters (Chaya_004, UNC5221, UNC5174, CL-STA-0048) and ransomware affiliates exploiting CVE-2025-31324 at scale, with 581+ organizations reportedly breached.
  • CISA adds CVE-2025-31324 (the SAP NetWeaver flaw used to deliver Auto-Color in these campaigns) to its Known Exploited Vulnerabilities catalog.
  • BleepingComputer reports on an Auto-Color variant that suppresses most malicious behavior when it cannot reach its C2 server, hindering sandbox and offline reverse engineering.
  • Zyad Elzyat publishes an independent reverse-engineering writeup of Auto-Color, confirming and extending Unit 42's findings with concrete sample/library hashes, state-file names, and C2 beacon details; source of this threat entry.

Sources cited for Auto-Color Linux Backdoor Reverse-Engineered

More in malware

Detection coverage for TL-2026-2264

As of 2026-08-30, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2264 across Splunk SPL, Microsoft KQL and Sigma, covering 22 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats