Skip to main content
Live Webinar with SANS (June 25)— Agentic CTI Automation for Fun & ProfitRegister Free
Mallory
MalwareUsed by 1 actorExploits 4 CVEs

Auto-color

Auto-color is a Linux backdoor first reported by Palo Alto Networks Unit 42 in late 2024. It provides full remote access to compromised systems and has been observed targeting universities, educational institutions, government offices, and government entities in North America and Asia. The malware appears to require explicit execution of the initial binary on a Linux host, though later reporting also states it has been delivered through exploitation of SAP NetWeaver, including CVE-2025-31324, in attacks such as a reported intrusion against a U.S. company.

Auto-color uses benign-looking filenames and has been observed masquerading as a legitimate PAM library under the filename pamssod. During installation, if executed with root privileges, it copies itself to /var/log/cross/auto-color, installs a malicious shared library named libcext.so.2, and writes that library into /etc/ld.preload for persistence and evasion. The implant is designed to mimic a legitimate library name and hooks libc open-family functions to intercept access to /proc/net/tcp, filtering entries tied to configured ports or remote IPs to hide command-and-control activity. This network-hiding technique has been described as similar to Symbiote. The malware also deletes its original executable and may use alternate benign filenames such as door and egg.

Configuration data is stored in encrypted form either in external files such as /tmp/cross/config-err-XXXXXXXX or /var/log/cross/config-err-XXXXXXXX, or embedded in the binary. The malware uses a proprietary stream-cipher-like decryption routine rather than standard algorithms for this configuration payload. Auto-color communicates with attacker infrastructure using a custom binary protocol over TCP, including observed command-and-control IPs on port 443, and performs an initial handshake requiring the server to echo a random 16-byte value. Each message uses a unique random key.

Documented capabilities include host information collection, a kill switch, reverse shell access, file manipulation, local command or payload execution, network proxying, and global payload reconfiguration. Reported indicators and artifacts include the filenames auto-color, pamssod, and libcext.so.2; persistence via /etc/ld.preload; staging paths under /var/log/cross/ and /tmp/cross/; and previously published malware hashes and command-and-control IP addresses from Palo Alto Networks. Additional reporting noted likely links between later activity and infrastructure previously associated with Auto-Color command-and-control.

Share:
For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

EXPLOITED CVES

Vulnerabilities exploited

4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

4 CVES
CVE-2025-4428RCE in Ivanti Endpoint Manager Mobile APIExploited in the wild

“analysts observed a likely link to Auto-Color, a Linux backdoor first reported by Palo Alto Networks in late 2024… previously associated with Auto-Color command-and-control infrastructure…” | On Thursday, May 15, 2025, Ivanti disclosed two critical vulnerabilities - CVE-2025-4427 and CVE-2025-4428 - affecting Ivanti Endpoint Manager Mobile (EPMM) version 12.5.0.0 and earlier. These vulnerabilities can be chained to achieve unauthenticated remote code execution (RCE) on exposed systems.

via eclecticiq blogblog.eclecticiq.com
CVE-2025-4427Ivanti Endpoint Manager Mobile API Authentication BypassExploited in the wild

On Thursday, May 15, 2025, Ivanti disclosed two critical vulnerabilities - CVE-2025-4427 and CVE-2025-4428 - affecting Ivanti Endpoint Manager Mobile (EPMM) version 12.5.0.0 and earlier. These vulnerabilities can be chained to achieve unauthenticated remote code execution (RCE) on exposed systems. | “analysts observed a likely link to Auto-Color, a Linux backdoor first reported by Palo Alto Networks in late 2024… previously associated with Auto-Color command-and-control infrastructure…”

via eclecticiq blogblog.eclecticiq.com
CVE-2025-55182React2ShellExploited in the wild

Unit 42 has observed post-exploitation activity following the exploitation of CVE-2025-55182... automated scanning for the remote code execution (RCE) vulnerability... The flaw allows unauthenticated attackers to execute arbitrary code on the server via insecure deserialization of malicious HTTP requests.

via palo alto networks unit 42 blogunit42.paloaltonetworks.com
CVE-2025-31324Unauthenticated Arbitrary File Upload in SAP NetWeaver Visual Composer Metadata UploaderExploited in the wild

Auto-color was observed... August 2025 in exploitation of CVE‑2025‑31324.

via palo alto networks unit 42 blogunit42.paloaltonetworks.com
THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details
UNC5221

“analysts observed a likely link to Auto-Color, a Linux backdoor first reported by Palo Alto Networks in late 2024… previously associated with Auto-Color command-and-control infrastructure…”

via eclecticiq blogblog.eclecticiq.com
MITRE ATT&CK

Techniques & procedures

17 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique
T1190Exploit Public-Facing ApplicationEvidence3

“threat actors gained initial access by exploiting an unauthenticated RCE vulnerability in Ivanti EPMM deployments… targeted the /mifs/rs/api/v2/ endpoint, where the ?format= parameter was used to send malicious remote commands.”

Execution

3 techniques
T1059.004Unix ShellEvidence1

0x100 Reverse shell Creates a reverse shell for the remote server to interact with the victim machine directly

T1203Exploitation for Client ExecutionEvidence1

"The flaw allows unauthenticated attackers to execute arbitrary code on the server via insecure deserialization of malicious HTTP requests... This results in RCE" (CVE-2025-55182).

T1574.006Dynamic Linker HijackingEvidence1

Finally, the malware writes the malicious library file name into /etc/ld.preload , which is a standard file on Linux systems. The OS’ loader uses this file when loading executables on a Linux system.

Persistence

2 techniques
T1543Create or Modify System ProcessEvidence1

"KSwapDoor... renames itself to [kswapd1], mimicking a legitimate Linux kernel swap daemon" and "Auto-color masquerades as a legitimate Pluggable Authentication Module (PAM) library (pamssod)"

T1556.003Pluggable Authentication ModulesEvidence1

"Auto-color masquerades as a legitimate Pluggable Authentication Module (PAM) library (pamssod)"

Privilege Escalation

1 technique
T1543Create or Modify System ProcessEvidence1

"KSwapDoor... renames itself to [kswapd1], mimicking a legitimate Linux kernel swap daemon" and "Auto-color masquerades as a legitimate Pluggable Authentication Module (PAM) library (pamssod)"

Stealth

6 techniques
T1014RootkitEvidence1

This is also known as “hooking” any executable that tries to call libc functions.

T1027Obfuscated Files or InformationEvidence1

Deploying proprietary encryption algorithms to hide communication and configuration information.

T1036MasqueradingEvidence2

Each time the malware deploys on a different target, it uses a different file name. The file name is usually a simple, ordinary word such as door or egg.

T1070.004File DeletionEvidence1

The malware deletes its original executable in both cases. However, with root privileges, it preserves the Auto-color binary at /var/log/cross/auto-color .

T1564.001Hidden Files and DirectoriesEvidence1

When /proc/net/tcp is passed into the malicious library’s open() function, it parses the file contents... the malware will not write the specific entry containing the remote IP address or local port... Finally, the malicious library’s open() function returns a file descriptor for the modified file, concealing the manipulation from the victim.

T1574.006Dynamic Linker HijackingEvidence1

Finally, the malware writes the malicious library file name into /etc/ld.preload , which is a standard file on Linux systems. The OS’ loader uses this file when loading executables on a Linux system.

Defense Impairment

2 techniques
T1222File and Directory Permissions ModificationEvidence1

0x2XX File operations and manipulation Create and/or modify files and execute programs locally

T1556.003Pluggable Authentication ModulesEvidence1

"Auto-color masquerades as a legitimate Pluggable Authentication Module (PAM) library (pamssod)"

Credential Access

1 technique
T1556.003Pluggable Authentication ModulesEvidence1

"Auto-color masquerades as a legitimate Pluggable Authentication Module (PAM) library (pamssod)"

Discovery

1 technique
T1082System Information DiscoveryEvidence1

0, 1, 2, 3, 0xF General options and kill switch Sends host information and includes a kill switch to uninstall itself from the system

Command and Control

4 techniques
T1071Application Layer ProtocolEvidence1

Upon connecting to the threat actor’s machine, the malware initiates a simple handshake with the remote server... Each message from the infected machine or the remote server follows a specific protocol structure unique to this malware family.

T1071.001Web ProtocolsEvidence1

“forming a reliable command-and-control (C2) mechanism using server-side Java injection” and repeated use of HTTP GET/curl/wget to retrieve payloads

T1090ProxyEvidence1

0x300 Network proxy The infected machine will act as a middleman proxy for any connections between the remote target and the IP address given in the argument

T1219Remote Access ToolsEvidence1

Once installed, Auto-color allows threat actors full remote access to compromised machines...

INDICATORS OF COMPROMISE

IOCs tracked for this family

14 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app
Network
5 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes
8 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other
1 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting
ip.v4●●●●●●●●●●●●View more in app1 year ago
uri●●●●●●●●●●●●View more in app1 year ago
hash.sha256●●●●●●●●●●●●View more in app1 year ago
hash.sha256●●●●●●●●●●●●View more in app1 year ago
ip.v4●●●●●●●●●●●●View more in app1 year ago
ip.v4●●●●●●●●●●●●View more in app1 year ago
What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.
IOC matching14

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities4

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping17

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.