Reverse Engineering the Auto-Color Linux Backdoor
Brief
Static and dynamic analysis of Auto-Color’s execution flow, C2 communication, and LD_PRELOAD rootkit.
Auto-Color in a Nutshell
Auto-Color is an emerging Linux backdoor first documented by Palo Alto Networks Unit 42 in February 2025. The earliest known samples were collected between November and December 2024, with universities and government offices in North America and Asia being the main observed targets. The family was named after the filename used by the payload after installation.
Its initial delivery method is still unknown, but once executed it can provide an attacker with remote access while using several techniques to hide its activity.
Technical Summary
The sample analyzed in this report has two noticeably different execution paths. Without root privileges, it moves into the background, stores its state under /tmp/cross, and repeatedly tries to contact 146.
- 41.