Executive Summary
Auto-Color is an emerging Linux backdoor first identified in late 2024, primarily targeting government and educational institutions in North America and Asia. The malware exhibits two distinct execution modes depending on user privileges. In non-root contexts, it functions as a simple background backdoor; however, when executed with root privileges, it deploys a sophisticated user-space rootkit to conceal its presence and ensure persistence.
The core technical threat involves the deployment of a shared library named libcext.so.2, which is registered via /etc/ld.so.preload. This library hooks critical libc functions to intercept system calls, effectively blinding security tools by filtering entries in /proc/net/tcp and hiding its own file artifacts. Furthermore, the malware attempts to proactively disable SELinux enforcement to maintain its foothold.
For organizations running Linux-based infrastructure, Auto-Color represents a high-risk threat due to its ability to bypass standard monitoring tools like 'ss', 'cat', or directory listing commands. Immediate inspection of preload configurations and unauthorized files in /var/log/cross or /tmp/cross is recommended.