A new Backdoor Linux hits American universities and governments

Unit 42 Notice a new Malware Linux
Auto-Color may give the attackers Full access to compromised final points
The initial infection vector is unknown but universities and governments hit

Government universities and offices in North America and Asia are targeted by a new Backdoor Linux, called “Auto-Color”, experts said.

Cyber security researchers from unit 42 42 Palo Alto Networks revealed at the beginning of November 2024, came across a backdoor that was relatively difficult to observe and impossible to eliminate without specialized software.

Backdoor has been able to open an reverse shell to provide complete distance access to attackers, running arbitrary controls on the target system, manipulating local files, acting as proxy or dynamically modifying its configuration. malware It also comes with a murder switch, which allows the threats to remove all compromises and thus to make the analysis and forensic.

Dangerous threat

Given its advanced characteristics of obtaining and an extensive list of dangerous, auto-color capabilities has been described as a very dangerous threat. However, unit 42 could not assign any known threat actor and did not want to discuss the victims more detail. Therefore, we do not know how many organizations have been infected and what is the final goal of the campaign.

What is not known and how the victims were infected first. Unit 42 says that the initial infection vector is not known, but added that it must start with the victim who executes a file on the target system. The file usually has a benign name, such as “door”, “journal” or “egg”.

Linux malware is becoming more sophisticated and more widespread due to the increased Linux adoption in Cloud Computing, servers for companies and IoT devices. Cybercriminals change the emphasis from traditional Windows targets to include Linux environments, operating wrong configurations, unpaid vulnerabilities and weak security practices.

Malware-CA-A-Service (MAAS) increases and automated attack tools also make Linux-based threats more efficient.

By Bleepingcomputer