Threat reportMalwareTL-2026-2264
Auto-Color Linux Backdoor Reverse-Engineered: Root-Level LD_PRELOAD Persistence and Encrypted C2
Independent reverse-engineering (Zyad Elzyat, published 2026-08-30) dissects Auto-Color, an x86-64 Linux rootkit-backdoor first documented by Unit 42 in February 2025, detailing its /etc/ld.so.preload shared-library hijack, libc-function hooking for file/connection concealment, SELinux tampering, and an encrypted TCP/443 C2 channel that beacons a 16-byte value every 4-5 seconds. First disclosed .
Key facts
| Identifiers | TL-2026-2264, CVE-2025-31324 |
|---|---|
| Also known as | Auto-Color, elf.auto_color |
| Severity | HIGH |
| First disclosed | |
| Exploitation status | Linked CVE exploited in the wild; Listed in CISA KEV: CVE-2025-31324 (added ) |
| EPSS | CVE-2025-31324: 99.4% (99.9th percentile) |
| Affected products | Linux Linux x86-64 servers (glibc dynamic linker); SAP SAP NetWeaver Visual Composer (Metadata Uploader) — observed delivery vector in related campaigns |
| Malware | Auto-Color, KillSwitch, root |
| MITRE ATT&CK techniques | T1014 Rootkit, T1036.005 Match Legitimate Resource Name or Location, T1057 Process Discovery, T1059.004 Unix Shell, T1070.004 File Deletion, T1090.002 External Proxy, T1140 Deobfuscate/Decode Files or Information, T1190 Exploit Public-Facing Application, T1204.002 Malicious File, T1497 Virtualization/Sandbox Evasion, T1564.001 Hidden Files and Directories, T1571 Non-Standard Port and 3 more in the attack flow |
| Motivation | ESPIONAGE |
| Target sectors | government administration, education, chemicals manufacturing, critical infrastructure |
| Target regions | North America, Asia |
| Detection rules | 9 (1 shown free) |
| Sources | 10 cited sources |
Detection coverage
As of 2026-08-30, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2264 across Splunk SPL, Microsoft KQL and Sigma, covering 22 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.
Free detection: Rootkit Library Drop to libcext.so.2 with /etc/ld.so.preload Modification
Detects the Auto-Color persistence mechanism: the embedded 35,160-byte shared library (SHA-256 bf503b5e...d1ca) written to /lib/x86_64-linux-gnu/libcext.so.2 masquerading as libcext.so.0, immediately followed by a write to /etc/ld.so.preload registering that library for global LD_PRELOAD injection into every subsequently launched process on the host.
- Languages: Splunk SPL, Microsoft KQL, Sigma
- ATT&CK: T1574.006, T1036.005, T1014
- Data sources: file_integrity_monitoring, osquery_file_events, auditd, microsoft_defender_for_endpoint_linux
- Severity: critical
- Confidence: high
Splunk SPL
index=linux (sourcetype="fim" OR sourcetype="osquery:file_events" OR sourcetype=auditd type=PATH)
(path="/lib/x86_64-linux-gnu/libcext.so.2" OR path="/etc/ld.so.preload")
(action="created" OR action="modified" OR action="write" OR syscall="open" OR syscall="openat")
| eval artifact=case(path="/lib/x86_64-linux-gnu/libcext.so.2", "rootkit_library", path="/etc/ld.so.preload", "preload_hijack")
| stats values(artifact) as artifacts, min(_time) as first_event, max(_time) as last_event, values(file_hash) as hashes by host
| where mvcount(artifacts) >= 1
| sort - last_eventMicrosoft KQL
DeviceFileEvents
| where Timestamp > ago(24h)
| where FolderPath in ("/lib/x86_64-linux-gnu/libcext.so.2", "/etc/ld.so.preload")
| where ActionType in ("FileCreated", "FileModified")
| summarize Artifacts = make_set(FolderPath), FirstSeen = min(Timestamp), LastSeen = max(Timestamp), Hashes = make_set(SHA256) by DeviceName
| project DeviceName, Artifacts, FirstSeen, LastSeen, Hashes
| order by LastSeen descSigma
title: Auto-Color LD_PRELOAD Rootkit Library Installation
id: 2b6c8d0e-4f1a-4b3c-9d5e-6f7a8b9c0d1e
status: experimental
description: Detects the write of the Auto-Color rootkit shared library to /lib/x86_64-linux-gnu/libcext.so.2 (masquerading as libcext.so.0) and/or the registration write to /etc/ld.so.preload that forces its global LD_PRELOAD injection
references:
- https://unit42.paloaltonetworks.com/new-linux-backdoor-auto-color/
- https://wazuh.com/blog/detecting-auto-color-malware-with-wazuh/
author: Threadlinqs Team
date: 2026-08-31
tags:
- attack.persistence
- attack.t1574.006
- attack.defense-evasion
- attack.t1036.005
- attack.t1014
logsource:
category: file_event
product: linux
detection:
selection_library:
TargetFilename|endswith: '/lib/x86_64-linux-gnu/libcext.so.2'
selection_preload:
TargetFilename: '/etc/ld.so.preload'
condition: selection_library or selection_preload
falsepositives:
- Legitimate installation/upgrade of a package that genuinely ships libcext (rare; verify against the package manager's file manifest and the file's SHA-256 against bf503b5eb456f74187a17bb8c08bccc9b3d91a7f0f6fd50110540b051510d1ca)
- Authorized administrator intentionally configuring LD_PRELOAD for legitimate library shimming (should be documented/change-controlled)
level: criticalKnown false positives:
- Legitimate package installs that ship a genuine libcext library — verify the written file's SHA-256 against the known-good vendor hash and against the malicious hash bf503b5e...d1ca before escalating; documented administrator-driven LD_PRELOAD configuration changes tracked via change control
Tuning notes: Enable file-integrity monitoring specifically on /etc/ld.so.preload and standard library directories (/lib, /lib/x86_64-linux-gnu, /usr/lib) as a first-class control if not already covered; cross-reference the written file hash against bf503b5eb456f74187a17bb8c08bccc9b3d91a7f0f6fd50110540b051510d1ca for a zero-false-positive confirmation.
- Auto-Color Dropper First-Stage Execution with Root Privilege Escalation to /var/[indicator]/cross · unlock with TL Creds
- SELinux Enforcement Disabled via security_setenforce Call Correlated with Rootkit Artifacts · unlock with TL Creds
- Non-Blocking Loopback Probes to Localhost Ports 9002/9003 Consistent with Auto-Color · unlock with TL Creds
- SAP Web-Shell-Delivered ELF Execution with Benign Alias Naming · unlock with TL Creds
- Anti-Forensic Process-Name Evasion Check Consistent with Auto-Color Rootkit Behavior · unlock with TL Creds
- Auto-Color Reverse Shell or Proxy Command Execution Consistent with C2 Tasking · unlock with TL Creds
- SAP NetWeaver Metadata Uploader Exploitation (CVE-2025-31324) Followed by Auto-Color Dropper Execution · unlock with TL Creds
- Encrypted TCP/443 Beacon to Known Auto-Color C2 Infrastructure · unlock with TL Creds
Indicators of compromise
As of 2026-08-30, Threadlinqs Intelligence tracks 22 indicators of compromise for TL-2026-2264.
Sample indicators (3 of 22)
- IP address:
146.70.41[.]178 - File hash:
270fc72074c697ba5921f7b61a6128b968ca6ccbf8906645e796cfc3072d4c43 - IP address:
216.245.184[.]214
Defanged, TLP:CLEAR. Full set of 22 indicators: unlock with TL Creds.
Technical analysis
Auto-Color (Malpedia: elf.auto_color) is an x86-64 ELF Linux backdoor first documented by Palo Alto Networks Unit 42 on 2025-02-24 after samples were observed in the wild between November and December 2024 against universities and government offices in North America and Asia. A new independent reverse-engineering writeup by Zyad Elzyat, published 2026-08-30 (fetched via its malware.news mirror after the primary Medium URL returned HTTP 403; an archive.org snapshot is also on record), analyzes a captured 229,160-byte sample (SHA-256 270fc72074c697ba5921f7b61a6128b968ca6ccbf8906645e796cfc3072d4c43, x86-64 PIE, dynamically linked, stripped, Build ID 043cd4c5b9346b072d4c6dff0a87092556031018, detected by only 36 of 63 AV engines at capture) and confirms/extends the original Unit 42 findings with concrete artifacts.
On first execution, the dropper runs under a benign-looking name (Unit 42 documented 'door', 'egg', 'log', 'edus', 'edu', 'exup', and 'law'). If it has root privileges, it copies itself to /var/log/cross/auto-color (working directory /tmp/cross for non-root execution), drops an embedded 35,160-byte ELF shared library (SHA-256 bf503b5eb456f74187a17bb8c08bccc9b3d91a7f0f6fd50110540b051510d1ca) to /lib/x86_64-linux-gnu/libcext.so.2 — masquerading as the legitimate libcext.so.0 — and writes that library's path into /etc/ld.so.preload, forcing every subsequently-launched process on the host to load it (dynamic linker / LD_PRELOAD hijacking). The library additionally guards /etc/ld.so.preload against modification or removal. Three state files were identified in the working directory: config-err-A7F5EF0D (a lock file), config-err-20FF3326 (an 8-byte binary value), and config-err-03EB4BCE (probed by the sample but its purpose unconfirmed).
The injected library is a rootkit: it hooks open/open64/openat/openat64/fopen/fopen64 to redirect and hide access to its own artifacts using alternate .xxx/.real filenames, hooks readdir/readdir64 to strip its files from directory listings, hooks __xstat/statx/newfstatat/chmod/unlink/unlinkat/remove variants for further concealment, and filters /proc/net/tcp entries (via recvmsg/pcap_loop/pcap_dispatch wrappers and a wrapped memcpy) to remove its own C2 socket from tools that enumerate active connections. When running as root it also calls security_setenforce(0) to disable SELinux enforcement. To avoid triggering security tooling, it explicitly skips activation when running under processes named auditd, cron, crond, acpid, or atd found under /sbin or /usr/sbin, and daemonizes via a double-fork.
C2 uses a lightweight handshake followed by an encrypted channel: the sample repeatedly transmits a 16-byte value roughly every 4-5 seconds over TCP/443 to 146.70.41.178, and separately probes local loopback ports 127.0.0.1:9002 and 127.0.0.1:9003 in a non-blocking manner for an undetermined purpose. Per Unit 42's original analysis, messages are protected by a dynamically-generated 4-byte key that encrypts the remainder of each message's metadata and payload (rotated per session), and Unit 42 additionally observed C2 hosts 216.245.184.214, 146.70.87.67, 65.38.121.64, and 206.189.149.191, all on port 443. The command set gives attackers arbitrary command execution, file modification, a reverse shell (command ID 0x100) for direct interactive access, proxy/traffic-forwarding where the infected host acts as a middleman (command ID 0x300), dynamic configuration updates, and a kill-switch command set (IDs 0, 1, 2, 3, 0xF) that deletes infection artifacts to frustrate incident response.
Auto-Color has since been observed deployed via unrelated initial-access vectors: BleepingComputer (2025-07-29) reported threat actors exploiting the critical SAP NetWeaver Visual Composer Metadata Uploader unrestricted file-upload flaw (CVE-2025-31324, CVSS 10.0, added to the CISA KEV catalog 2025-05-15) to drop ELF Auto-Color payloads onto compromised NetWeaver hosts, beginning with zero-day exploitation in mid-March 2025 and a confirmed attack on a U.S. chemicals company on 2025-04-25; by May 2025 multiple China-nexus intrusion clusters (tracked as Chaya_004, UNC5221, UNC5174, and CL-STA-0048) and ransomware affiliates were separately abusing the same SAP flaw, with reporting describing breaches at 581+ organizations across critical-infrastructure sectors. A variant reported in that window additionally suppresses most malicious behavior when it cannot reach its C2 server, hindering sandbox-based and offline reverse engineering. No CVE applies to Auto-Color itself — it is deployed as a post-exploitation implant rather than exploiting a vulnerability on its own — and no single actor has been publicly attributed as its author; the SAP NetWeaver campaigns show it being reused as commodity/shared tradecraft by multiple, apparently unrelated intrusion sets.
MITRE ATT&CK techniques by tactic:
Defense Evasion
T1014 Rootkit; T1036.005 Match Legitimate Resource Name or Location; T1070.004 File Deletion; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion; T1564.001 Hidden Files and Directories
Discovery
Execution
T1059.004 Unix Shell; T1204.002 Malicious File
Command and Control
T1090.002 External Proxy; T1571 Non-Standard Port; T1573.001 Symmetric Cryptography
Initial Access
T1190 Exploit Public-Facing Application
stealth
T1574.006 Dynamic Linker Hijacking
defense-impairment
Remediation
Patches
- Apply the SAP security patch for CVE-2025-31324 (SAP NetWeaver Visual Composer Metadata Uploader unrestricted file upload) released April 2025 to all internet-facing NetWeaver instances
Immediate actions
- Block outbound TCP/443 connections to known Auto-Color C2 hosts 146.70.41.178, 216.245.184.214, 146.70.87.67, 65.38.121.64, and 206.189.149.191 at the perimeter
- Audit /etc/ld.so.preload on Linux hosts for unexpected entries, especially references to libcext.so.2 or unrecognized libraries masquerading as system libraries
- Search for and quarantine /var/log/cross/ and /tmp/cross/ directories and their config-err-* contents, and the auto-color binary
- Verify SELinux is in enforcing mode where required and alert on unexpected security_setenforce(0) calls or getenforce state changes
Workarounds
- Where patching NetWeaver is not immediately possible, restrict or disable the Visual Composer Metadata Uploader endpoint (/developmentserver/metadatauploader) and the /irj/servlet_jsp servlet from untrusted networks
Longer-term hardening
- Deploy kernel-level (eBPF/auditd) monitoring for open/openat/readdir syscall hooking and LD_PRELOAD-based library injection, since userspace tools that rely on libc for enumeration can be blinded by this rootkit class
- Baseline and alert on writes to /etc/ld.so.preload and unauthorized shared libraries dropped into standard library paths (/lib, /lib/x86_64-linux-gnu)
- Deploy EDR/XDR with kernel-level (not purely libc-mediated) process and network visibility on internet-facing Linux servers
- Apply Wazuh or equivalent Auto-Color-specific detection content referenced by the vendor community
Affected and fixed versions
- Linux — Linux x86-64 servers (glibc dynamic linker)
Vulnerable versions: Any glibc-based Linux distribution supporting /etc/ld.so.preload - SAP — SAP NetWeaver Visual Composer (Metadata Uploader) — observed delivery vector in related campaigns
Vulnerable versions: Instances unpatched for CVE-2025-31324 prior to the April 2025 SAP security patch
Fixed in: Patched per SAP's April 2025 security note for CVE-2025-31324
Timeline
- Earliest Auto-Color samples observed in the wild, per Unit 42's later analysis (November-December 2024 window).
- Palo Alto Networks Unit 42 publishes the first public analysis of Auto-Color, documenting root-level ld.so.preload persistence, rootkit behavior, and targeting of North American/Asian universities and government offices.
- Zero-day exploitation of SAP NetWeaver CVE-2025-31324 begins in the wild, per Mandiant findings, later used as a delivery vector for Auto-Color.
- Attackers exploit CVE-2025-31324 against a U.S. chemicals company, part of the campaign later reported to deliver Auto-Color.
- Active exploitation of CVE-2025-31324 observed delivering ELF Auto-Color payloads onto compromised SAP NetWeaver hosts.
- Reporting describes China-linked intrusion clusters (Chaya_004, UNC5221, UNC5174, CL-STA-0048) and ransomware affiliates exploiting CVE-2025-31324 at scale, with 581+ organizations reportedly breached.
- CISA adds CVE-2025-31324 (the SAP NetWeaver flaw used to deliver Auto-Color in these campaigns) to its Known Exploited Vulnerabilities catalog.
- BleepingComputer reports on an Auto-Color variant that suppresses most malicious behavior when it cannot reach its C2 server, hindering sandbox and offline reverse engineering.
- Zyad Elzyat publishes an independent reverse-engineering writeup of Auto-Color, confirming and extending Unit 42's findings with concrete sample/library hashes, state-file names, and C2 beacon details; source of this threat entry.
Sources cited
- CISA Known Exploited Vulnerabilities Catalog (CVE-2025-31324 entry) CISA · Government advisory · 2025-05-15
- AL2025_15 Auto-Color Linux Backdoor Targets North American Governments and Universities cirt.gy · Advisory · 2025-02-27
- Malpedia elf.auto_color catalog entry malpedia.caad.fkie.fraunhofer.de · Research · 2026-08-30
- Auto-Color: An Emerging and Evasive Linux Backdoor Unit 42 · Vendor report · 2025-02-24
- Reverse Engineering the Auto-Color Linux Backdoor medium.com · Blog · 2026-08-30
- Reverse Engineering the Auto-Color Linux Backdoor (mirror) malware.news · Blog · 2026-08-30
- Detecting Auto-color malware with Wazuh wazuh.com · Blog · 2025-03-01
- Hackers exploit SAP NetWeaver bug to deploy Linux Auto-Color malware BleepingComputer · News · 2025-07-29
- New Linux Malware 'Auto-Color' Grants Hackers Full Remote Access The Hacker News · News · 2025-02-25
- China-Linked APTs Exploit SAP CVE-2025-31324 to Breach 581 Critical Orgs The Hacker News · News · 2025-05-01
Other reports on CVE-2025-31324
Previous and next in malware
Drafted by the Threadlinqs research pipeline from 10 sources; published ; last updated —.
