# Auto-Color Linux Backdoor Reverse-Engineered: Root-Level LD_PRELOAD Persistence and Encrypted C2

> Independent reverse-engineering (Zyad Elzyat, published 2026-08-30) dissects Auto-Color, an x86-64 Linux rootkit-backdoor first documented by Unit 42 in February 2025, detailing its /etc/ld.so.preload shared-library hijack, libc-function hooking for file/connection concealment, SELinux tampering, and an encrypted TCP/443 C2 channel that beacons a 16-byte value every 4-5 seconds.

- **Published:** 2026-08-30T00:00:00Z
- **Last reviewed:** 2026-08-30T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2264
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-auto-color-ld-preload-rootkit-tl-2026-2264.webp?v=f1c79ab5 (Threadlinqs threat intel: Auto-Color Linux Rootkit: Detection & IOCs (TL-2026-2264) — High severity, 22 IOCs, 9 detection rules.)
- **ID:** TL-2026-2264
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 22 (3 shown free below)
- **CVEs:** CVE-2025-31324

## Description

Auto-Color (Malpedia: elf.auto_color) is an x86-64 ELF Linux backdoor first documented by Palo Alto Networks Unit 42 on 2025-02-24 after samples were observed in the wild between November and December 2024 against universities and government offices in North America and Asia. A new independent reverse-engineering writeup by Zyad Elzyat, published 2026-08-30 (fetched via its malware.news mirror after the primary Medium URL returned HTTP 403; an archive.org snapshot is also on record), analyzes a captured 229,160-byte sample (SHA-256 270fc72074c697ba5921f7b61a6128b968ca6ccbf8906645e796cfc3072d4c43, x86-64 PIE, dynamically linked, stripped, Build ID 043cd4c5b9346b072d4c6dff0a87092556031018, detected by only 36 of 63 AV engines at capture) and confirms/extends the original Unit 42 findings with concrete artifacts.

On first execution, the dropper runs under a benign-looking name (Unit 42 documented 'door', 'egg', 'log', 'edus', 'edu', 'exup', and 'law'). If it has root privileges, it copies itself to /var/log/cross/auto-color (working directory /tmp/cross for non-root execution), drops an embedded 35,160-byte ELF shared library (SHA-256 bf503b5eb456f74187a17bb8c08bccc9b3d91a7f0f6fd50110540b051510d1ca) to /lib/x86_64-linux-gnu/libcext.so.2 — masquerading as the legitimate libcext.so.0 — and writes that library's path into /etc/ld.so.preload, forcing every subsequently-launched process on the host to load it (dynamic linker / LD_PRELOAD hijacking). The library additionally guards /etc/ld.so.preload against modification or removal. Three state files were identified in the working directory: config-err-A7F5EF0D (a lock file), config-err-20FF3326 (an 8-byte binary value), and config-err-03EB4BCE (probed by the sample but its purpose unconfirmed).

The injected library is a rootkit: it hooks open/open64/openat/openat64/fopen/fopen64 to redirect and hide access to its own artifacts using alternate .xxx/.real filenames, hooks readdir/readdir64 to strip its files from directory listings, hooks __xstat/statx/newfstatat/chmod/unlink/unlinkat/remove variants for further concealment, and filters /proc/net/tcp entries (via recvmsg/pcap_loop/pcap_dispatch wrappers and a wrapped memcpy) to remove its own C2 socket from tools that enumerate active connections. When running as root it also calls security_setenforce(0) to disable SELinux enforcement. To avoid triggering security tooling, it explicitly skips activation when running under processes named auditd, cron, crond, acpid, or atd found under /sbin or /usr/sbin, and daemonizes via a double-fork.

C2 uses a lightweight handshake followed by an encrypted channel: the sample repeatedly transmits a 16-byte value roughly every 4-5 seconds over TCP/443 to 146.70.41.178, and separately probes local loopback ports 127.0.0.1:9002 and 127.0.0.1:9003 in a non-blocking manner for an undetermined purpose. Per Unit 42's original analysis, messages are protected by a dynamically-generated 4-byte key that encrypts the remainder of each message's metadata and payload (rotated per session), and Unit 42 additionally observed C2 hosts 216.245.184.214, 146.70.87.67, 65.38.121.64, and 206.189.149.191, all on port 443. The command set gives attackers arbitrary command execution, file modification, a reverse shell (command ID 0x100) for direct interactive access, proxy/traffic-forwarding where the infected host acts as a middleman (command ID 0x300), dynamic configuration updates, and a kill-switch command set (IDs 0, 1, 2, 3, 0xF) that deletes infection artifacts to frustrate incident response.

Auto-Color has since been observed deployed via unrelated initial-access vectors: BleepingComputer (2025-07-29) reported threat actors exploiting the critical SAP NetWeaver Visual Composer Metadata Uploader unrestricted file-upload flaw (CVE-2025-31324, CVSS 10.0, added to the CISA KEV catalog 2025-05-15) to drop ELF Auto-Color payloads onto compromised NetWeaver hosts, beginning with zero-day exploitation in mid-March 2025 and a confirmed attack on a U.S. chemicals company on 2025-04-25; by May 2025 multiple China-nexus intrusion clusters (tracked as Chaya_004, UNC5221, UNC5174, and CL-STA-0048) and ransomware affiliates were separately abusing the same SAP flaw, with reporting describing breaches at 581+ organizations across critical-infrastructure sectors. A variant reported in that window additionally suppresses most malicious behavior when it cannot reach its C2 server, hindering sandbox-based and offline reverse engineering. No CVE applies to Auto-Color itself — it is deployed as a post-exploitation implant rather than exploiting a vulnerability on its own — and no single actor has been publicly attributed as its author; the SAP NetWeaver campaigns show it being reused as commodity/shared tradecraft by multiple, apparently unrelated intrusion sets.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1204.002 Malicious File
- T1059.004 Unix Shell
- T1574.006 Dynamic Linker Hijacking
- T1036.005 Match Legitimate Resource Name or Location
- T1014 Rootkit
- T1564.001 Hidden Files and Directories
- T1685 Disable or Modify Tools
- T1070.004 File Deletion
- T1140 Deobfuscate/Decode Files or Information
- T1497 Virtualization/Sandbox Evasion
- T1057 Process Discovery
- T1571 Non-Standard Port
- T1573.001 Symmetric Cryptography
- T1090.002 External Proxy

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Rootkit Library Drop to libcext.so.2 with /etc/ld.so.preload Modification** (`TL-2026-2264-SPL-002`)

Detects the Auto-Color persistence mechanism: the embedded 35,160-byte shared library (SHA-256 bf503b5e...d1ca) written to /lib/x86_64-linux-gnu/libcext.so.2 masquerading as libcext.so.0, immediately followed by a write to /etc/ld.so.preload registering that library for global LD_PRELOAD injection into every subsequently launched process on the host.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1574.006, T1036.005, T1014
- **Data sources:** file_integrity_monitoring, osquery_file_events, auditd, microsoft_defender_for_endpoint_linux
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=linux (sourcetype="fim" OR sourcetype="osquery:file_events" OR sourcetype=auditd type=PATH)
(path="/lib/x86_64-linux-gnu/libcext.so.2" OR path="/etc/ld.so.preload")
(action="created" OR action="modified" OR action="write" OR syscall="open" OR syscall="openat")
| eval artifact=case(path="/lib/x86_64-linux-gnu/libcext.so.2", "rootkit_library", path="/etc/ld.so.preload", "preload_hijack")
| stats values(artifact) as artifacts, min(_time) as first_event, max(_time) as last_event, values(file_hash) as hashes by host
| where mvcount(artifacts) >= 1
| sort - last_event
```

### Microsoft KQL

```kql
DeviceFileEvents
| where Timestamp > ago(24h)
| where FolderPath in ("/lib/x86_64-linux-gnu/libcext.so.2", "/etc/ld.so.preload")
| where ActionType in ("FileCreated", "FileModified")
| summarize Artifacts = make_set(FolderPath), FirstSeen = min(Timestamp), LastSeen = max(Timestamp), Hashes = make_set(SHA256) by DeviceName
| project DeviceName, Artifacts, FirstSeen, LastSeen, Hashes
| order by LastSeen desc
```

### Sigma

```yaml
title: Auto-Color LD_PRELOAD Rootkit Library Installation
id: 2b6c8d0e-4f1a-4b3c-9d5e-6f7a8b9c0d1e
status: experimental
description: Detects the write of the Auto-Color rootkit shared library to /lib/x86_64-linux-gnu/libcext.so.2 (masquerading as libcext.so.0) and/or the registration write to /etc/ld.so.preload that forces its global LD_PRELOAD injection
references:
    - https://unit42.paloaltonetworks.com/new-linux-backdoor-auto-color/
    - https://wazuh.com/blog/detecting-auto-color-malware-with-wazuh/
author: Threadlinqs Team
date: 2026-08-31
tags:
    - attack.persistence
    - attack.t1574.006
    - attack.defense-evasion
    - attack.t1036.005
    - attack.t1014
logsource:
    category: file_event
    product: linux
detection:
    selection_library:
        TargetFilename|endswith: '/lib/x86_64-linux-gnu/libcext.so.2'
    selection_preload:
        TargetFilename: '/etc/ld.so.preload'
    condition: selection_library or selection_preload
falsepositives:
    - Legitimate installation/upgrade of a package that genuinely ships libcext (rare; verify against the package manager's file manifest and the file's SHA-256 against bf503b5eb456f74187a17bb8c08bccc9b3d91a7f0f6fd50110540b051510d1ca)
    - Authorized administrator intentionally configuring LD_PRELOAD for legitimate library shimming (should be documented/change-controlled)
level: critical
```

**Known false positives:**

- Legitimate package installs that ship a genuine libcext library — verify the written file's SHA-256 against the known-good vendor hash and against the malicious hash bf503b5e...d1ca before escalating; documented administrator-driven LD_PRELOAD configuration changes tracked via change control

**Tuning notes:** Enable file-integrity monitoring specifically on /etc/ld.so.preload and standard library directories (/lib, /lib/x86_64-linux-gnu, /usr/lib) as a first-class control if not already covered; cross-reference the written file hash against bf503b5eb456f74187a17bb8c08bccc9b3d91a7f0f6fd50110540b051510d1ca for a zero-false-positive confirmation.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Auto-Color Dropper First-Stage Execution with Root Privilege Escalation to /var/[indicator]/cross (locked: unlock with TL Creds)
- SELinux Enforcement Disabled via security_setenforce Call Correlated with Rootkit Artifacts (locked: unlock with TL Creds)
- Non-Blocking Loopback Probes to Localhost Ports 9002/9003 Consistent with Auto-Color (locked: unlock with TL Creds)
- SAP Web-Shell-Delivered ELF Execution with Benign Alias Naming (locked: unlock with TL Creds)
- Anti-Forensic Process-Name Evasion Check Consistent with Auto-Color Rootkit Behavior (locked: unlock with TL Creds)
- Auto-Color Reverse Shell or Proxy Command Execution Consistent with C2 Tasking (locked: unlock with TL Creds)
- SAP NetWeaver Metadata Uploader Exploitation (CVE-2025-31324) Followed by Auto-Color Dropper Execution (locked: unlock with TL Creds)
- Encrypted TCP/443 Beacon to Known Auto-Color C2 Infrastructure (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 22)

Defanged, TLP:CLEAR.

- IP address: `146.70.41[.]178`
- File hash: `270fc72074c697ba5921f7b61a6128b968ca6ccbf8906645e796cfc3072d4c43`
- IP address: `216.245.184[.]214`

Full set of 22 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Reverse Engineering the Auto-Color Linux Backdoor](https://medium.com/@0xzyadelzyat/reverse-engineering-the-auto-color-linux-backdoor-db2aecbd2887)
- [Reverse Engineering the Auto-Color Linux Backdoor (mirror)](https://malware.news/t/reverse-engineering-the-auto-color-linux-backdoor/125196)
- [Malpedia elf.auto_color catalog entry](https://malpedia.caad.fkie.fraunhofer.de/library/0e190355-5b0c-45d3-b9c6-0f5c9a754958/)
- [Auto-Color: An Emerging and Evasive Linux Backdoor](https://unit42.paloaltonetworks.com/new-linux-backdoor-auto-color/)
- [Hackers exploit SAP NetWeaver bug to deploy Linux Auto-Color malware](https://www.bleepingcomputer.com/news/security/hackers-exploit-sap-netweaver-bug-to-deploy-linux-auto-color-malware/)
- [New Linux Malware 'Auto-Color' Grants Hackers Full Remote Access](https://thehackernews.com/2025/02/new-linux-malware-auto-color-grants.html)
- [China-Linked APTs Exploit SAP CVE-2025-31324 to Breach 581 Critical Orgs](https://thehackernews.com/2025/05/china-linked-apts-exploit-sap-cve-2025.html)
- [Detecting Auto-color malware with Wazuh](https://wazuh.com/blog/detecting-auto-color-malware-with-wazuh/)
- [CISA Known Exploited Vulnerabilities Catalog (CVE-2025-31324 entry)](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?f%5B0%5D=vendor_project%3A835)
- [AL2025_15 Auto-Color Linux Backdoor Targets North American Governments and Universities](https://cirt.gy/static/8deda62cdc8ae9dd88a58e650c82199c/AL2025_15-Auto-Color-Linux-Backdoor-Targets-North-American-Governments-and-Universities.pdf)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2264