Loading story…
Researchers identified Auto-Color, an evasive Linux backdoor used against universities and government organizations in North America and Asia. Samples collected in late 2024 show that the malware requires initial execution by a victim, then provides attackers with host reconnaissance, file operations, payload execution, reverse-shell access, proxying, configuration updates, self-removal, and a kill-switch capability through a custom encrypted command-and-control protocol.
When executed as root, Auto-Color installs itself under /var/log/cross/auto-color, writes libcext.so.2 to the system library path, and registers it through /etc/ld.so.preload. This creates a user-space LD_PRELOAD rootkit that hooks libc functions to conceal malware files and filter its C2 connections from /proc/net/tcp; it also attempts to disable SELinux enforcement. Analysts observed connections to 146.70.41.178:443, while the implant uses benign-looking names, encrypted configuration data, and per-message encryption to resist detection and removal.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
Palo Alto Networks Unit 42 first documented the Auto-Color backdoor, describing its root-level LD_PRELOAD persistence, C2 communications, and remote-access capabilities. The researchers also published malware and implant hashes and C2 IP indicators.
Palo Alto Networks received the most recent Auto-Color sample covered in its initial research on December 5, 2024.
The first known Auto-Color Linux backdoor sample was collected on November 5, 2024. The malware was observed in attacks targeting universities and government organizations in North America and Asia.
A subsequent reverse-engineering analysis found that Auto-Color's libcext.so.2 preload library attempts to disable SELinux when run as root, conceals malware artifacts and selected TCP connections, and uses shared memory to maintain rootkit state. The analysis also observed repeated connection attempts to 146.70.41.178:443 and non-blocking localhost connections on ports 9002 and 9003.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 16 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
4 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcemedium.com
Open sourcezw01f.github.io
Open sourceunit42.paloaltonetworks.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers identified **RedXOR**, a Linux backdoor disguised as a `polkit` daemon, and assessed it was likely operated by a Chinese nation-state actor based on victimology, tactics, and code overlaps with malware associated with the **Winnti** umbrella. The malware targets Linux endpoints and servers, persists through init scripts, and uses the **Adore-ng** LKM rootkit for stealth. It supports host reconnaissance, file manipulation, remote shell access, self-update and uninstall functions, rootkit deployment, and network tunneling through a modified **Rinetd** component. RedXOR communicates with command-and-control infrastructure over TCP traffic made to resemble HTTP and uses XOR-based encoding to obscure data in transit. Researchers reported low antivirus detection and observed sample uploads from **Taiwan** and **Indonesia**, while intermittent command-and-control availability suggested the operation was active during analysis. The activity was framed against broader reporting on Chinese intrusion groups, including archived references to **APT41** and long-running Chinese cyber-espionage operations, reinforcing the assessment that RedXOR fits an established pattern of Linux-focused tooling used in state-linked campaigns.
Aug 15, 2026
Researchers detailed **Syslogk**, a Linux loadable-kernel-module rootkit that alters kernel execution paths to conceal malware. It inline-hooks `proc_root_readdir` to hide processes associated with `was_sys_relay`, `tcp4_seq_show` to remove selected listening ports from TCP socket listings, and VFS `readdir` operations to conceal files and directories containing `was-patch`. Syslogk also unlinks itself from kernel-module and sysfs listings, frustrating checks using `lsmod` and `/sys/module`; kernel-level investigation and remediation are required to restore visibility. The activity reflects a broader Linux rootkit tradecraft pattern spanning user-space dynamic-linker hijacking through `LD_PRELOAD`, malicious kernel modules, ftrace and syscall hooks, and newer eBPF or `io_uring`-assisted techniques. Recent malware including PUMAKIT has combined memory-resident execution, an LKM rootkit, and an `LD_PRELOAD` shared object for persistence, stealth, privilege escalation, and command execution. Defenders should monitor sensitive linker and SSH configuration changes, suspicious shared objects and kernel modules, loaded eBPF programs, kernel-function and VFS-pointer integrity, tracing/probe activity, and anomalous web-server or system-account behavior.
Sep 9, 2026
Researchers reported 14 trojanized npm packages posing as calendar, date, and streak utility libraries that secretly install the **RedShell** Linux beacon tied to the **RedC2 4.0** command-and-control framework. The malicious code runs when a package is merely imported—including through transitive dependencies—by using `dist/index.mjs` to mark a bundled ELF binary as executable and launch it as a detached background process, avoiding traditional npm install hooks and rendering mitigations such as `--ignore-scripts` ineffective. The implanted payload connects over TLS to a hardcoded C2 server at `217.60.77.63:8792` with certificate verification disabled and provides capabilities including persistence, credential theft, fileless execution, tunneling, SOCKS proxying, and data exfiltration. Researchers said RedC2 is marketed as a cross-platform toolkit for Windows, macOS, and Linux, and includes an AI-enabled **Red Agent** component that converts natural-language prompts into post-exploitation actions, underscoring how weaponized open-source packages can quietly deliver a full-featured backdoor and reduce the skill required for follow-on intrusions.
Aug 25, 2026