Auto-Color Linux Backdoor Reverse-Engineered: Root-Level LD_PRELOAD Persistence and Encrypted C2 — Threadlinqs Intelligence
As of 2026-08-31, Auto-Color Linux Backdoor Reverse-Engineered: Root-Level LD_PRELOAD Persistence and Encrypted C2 is a high-severity malware threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 22 indicators of compromise.
Threat ID: TL-2026-2264 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Independent reverse-engineering (Zyad Elzyat, published 2026-08-30) dissects Auto-Color, an x86-64 Linux rootkit-backdoor first documented by Unit 42 in February 2025, detailing its /etc/ld.so.preload
Auto-Color (Malpedia: elf.auto_color) is an x86-64 ELF Linux backdoor first documented by Palo Alto Networks Unit 42 on 2025-02-24 after samples were observed in the wild between November and December 2024 against universities and government offices in North America and Asia. A new independent reverse-engineering writeup by Zyad Elzyat, published 2026-08-30 (fetched via its malware.news mirror after the primary Medium URL returned HTTP 403; an archive.org snapshot is also on record), analyzes a captured 229,160-byte sample (SHA-256 270fc72074c697ba5921f7b61a6128b968ca6ccbf8906645e796cfc3072d4c43, x86-64 PIE, dynamically linked, stripped, Build ID 043cd4c5b9346b072d4c6dff0a87092556031018, detected by only 36 of 63 AV engines at capture) and confirms/extends the original Unit 42 findings with concrete artifacts.
On first execution, the dropper runs under a benign-looking name (Unit 42 documented 'door', 'egg', 'log', 'edus', 'edu', 'exup', and 'law'). If it has root privileges, it copies itself to /var/log/cross/auto-color (working directory /tmp/cross for non-root execution), drops an embedded 35,160-byte ELF shared library (SHA-256 bf503b5eb456f74187a17bb8c08bccc9b3d91a7f0f6fd50110540b051510d1ca) to /lib/x86_64-linux-gnu/libcext.so.2 — masquerading as the legitimate libcext.so.0 — and writes that library's path into /etc/ld.so.preload, forcing every subsequently-launched process on the host to load it (dynamic linker / LD_PRELOAD hijacking). The library additionally guards /etc/ld.so.preload against modification or removal. Three state files were identified in the working directory: config-err-A7F5EF0D (a lock file), config-err-20FF3326 (an 8-byte binary value), and config-err-03EB4BCE (probed by the sample but its purpose unconfirmed).
The injected library is a rootkit: it hooks open/open64/openat/openat64/fopen/fopen64 to redirect and hide access to its own artifacts using alternate .xxx/.real filenames, hooks readdir/readdir64 to strip its files from directory listings, hooks __xstat/statx/newfstatat/chmod/unlink/unlinkat/remove variants for further concealment, and filters /proc/net/tcp entries (via recvmsg/pcap_loop/pcap_dispatch wrappers and a wrapped memcpy) to remove its own C2 socket from tools that enumerate active connections. When running as root it also calls security_setenforce(0) to disable SELinux enforcement. To avoid triggering security tooling, it explicitly skips activation when running under processes named auditd, cron, crond, acpid, or atd found under /sbin or /usr/sbin, and daemonizes via a double-fork.
C2 uses a lightweight handshake followed by an encrypted channel: the sample repeatedly transmits a 16-byte value roughly every 4-5 seconds over TCP/443 to 146.70.41.178, and separately probes local loopback ports 127.0.0.1:9002 and 127.0.0.1:9003 in a non-blocking manner for an undetermined purpose. Per Unit 42's original analysis, messages are protected by a dynamically-generated 4-byte key that encrypts the remainder of each message's metadata and payload (rotated per session), and Unit 42 additionally observed C2 hosts 216.245.184.214, 146.70.87.67, 65.38.121.64, and 206.189.149.191, all on port 443. The command set gives attackers arbitrary command execution, file modification, a reverse shell (command ID 0x100) for direct interactive access, proxy/traffic-forwarding where the infected host acts as a middleman (command ID 0x300), dynamic configuration updates, and a kill-switch command set (IDs 0, 1, 2, 3, 0xF) that deletes infection artifacts to frustrate incident response.
Auto-Color has since been observed deployed via unrelated initial-access vectors: BleepingComputer (2025-07-29) reported threat actors exploiting the critical SAP NetWeaver Visual Composer Metadata Uploader unrestricted file-upload flaw (CVE-2025-31324, CVSS 10.0, added to the CISA KEV catalog 2025-05-15) to drop ELF Auto-Color payloads onto compromised NetWeaver hosts, beginning with zero-day exploitation in mid-March 2025
Target sectors: government administration, education, chemicals manufacturing, critical infrastructure
Target regions: North America, Asia
Timeline
- Earliest Auto-Color samples observed in the wild, per Unit 42's later analysis (November-December 2024 window).
- Palo Alto Networks Unit 42 publishes the first public analysis of Auto-Color, documenting root-level ld.so.preload persistence, rootkit behavior, and targeting of North American/Asian universities and government offices.
- Zero-day exploitation of SAP NetWeaver CVE-2025-31324 begins in the wild, per Mandiant findings, later used as a delivery vector for Auto-Color.
- Attackers exploit CVE-2025-31324 against a U.S. chemicals company, part of the campaign later reported to deliver Auto-Color.
- Active exploitation of CVE-2025-31324 observed delivering ELF Auto-Color payloads onto compromised SAP NetWeaver hosts.
- Reporting describes China-linked intrusion clusters (Chaya_004, UNC5221, UNC5174, CL-STA-0048) and ransomware affiliates exploiting CVE-2025-31324 at scale, with 581+ organizations reportedly breached.
- CISA adds CVE-2025-31324 (the SAP NetWeaver flaw used to deliver Auto-Color in these campaigns) to its Known Exploited Vulnerabilities catalog.
- BleepingComputer reports on an Auto-Color variant that suppresses most malicious behavior when it cannot reach its C2 server, hindering sandbox and offline reverse engineering.
- Zyad Elzyat publishes an independent reverse-engineering writeup of Auto-Color, confirming and extending Unit 42's findings with concrete sample/library hashes, state-file names, and C2 beacon details; source of this threat entry.
Detections & IOCs
As of 2026-09-06, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 22 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1190, T1204.002, T1059.004, T1574.006, T1036.005, T1014, T1564.001, T1685, T1070.004, T1140
