AUTO-COLOR: AN EMERGING AND EVASIVE LINUX BACKDOOR

Summary from the TLDR InfoSec newsletter

Palo Alto's Unit 42 is monitoring a new malware known as Auto-Color. Upon startup, if the malware is not named Auto-Color, it will try to install a malware implant that imitates libcext.so. It also copies itself to /var/log/cross/auto-color and adds this library to ld.preload. Besides its command and control capabilities, the harmful library implant uses custom encryption and strives to conceal network communications by hooking into libc's open function.