Τελικά, φαίνεται ότι είναι δύσκολο να διακρίνεις μεταξύ της βλακείας των ανθρώπων ή των #chatbots ... 
..."But while #Trump expressed intent to push back on anyone supposedly taking advantage of the US, some of the countries on the reciprocal #tariffs list puzzled experts and officials, who pointed out to The Guardian that Trump was, for some reason, #targeting #uninhabited #islands, some of them exporting nothing and populated with penguins. ... https://arstechnica.com/tech-policy/2025/04/critics-suspect-trumps-weird-tariff-math-came-from-chatbots/ ".
] New Auto-Color Linux Backdoor targets North American Universities and Government Organizations.![[⚠️How to Defend.⚠️]
Given its stealth, modular design and remote control features, Auto-Color is a serious threat to Linux systems, particularly those in government and academic environments targeted in the observed attacks.
Unit 42 suggests monitoring changes to '/etc/ld.preload,' which is a key persistence mechanism, checking '/proc/net/tcp' for output anomalies, and using behavior-based threat detection solutions.
The researchers have also listed indicators of compromise (IoCs) at the bottom of the report, so inspecting system logs and network traffic for connections to the listed C2 IPs is also crucial.](https://nerdculture.de/system/media_attachments/files/114/076/171/649/461/669/original/2937fe13b069c2c4.jpeg "[⚠️How to Defend.⚠️]
Given its stealth, modular design and remote control features, Auto-Color is a serious threat to Linux systems, particularly those in government and academic environments targeted in the observed attacks.
Unit 42 suggests monitoring changes to '/etc/ld.preload,' which is a key persistence mechanism, checking '/proc/net/tcp' for output anomalies, and using behavior-based threat detection solutions.
The researchers have also listed indicators of compromise (IoCs) at the bottom of the report, so inspecting system logs and network traffic for connections to the listed C2 IPs is also crucial.")
![[ImageSource: Unit 42]
Auto-Color Infection Chain.
Unit 42 does not have visibility into the initial infection vector, but the attack begins with the execution of a file disguised with benign names like"door", "egg", and "log."
If the malware runs with root privileges, it installs a malicious library implant (libcext.so.2), disguised as the legitimate libcext.so.0 library, copies itself to a system directory (/var/log/cross/auto-color), and modifies '/etc/ld.preload' to ensure the implant executes before any other system library.
If root access isn't available, the malware still executes but skips the persistent mechanisms. Although this limits its long-term impact, it still provides remote access to threat actors who may be able to achieve root through other means.](https://nerdculture.de/system/media_attachments/files/114/076/172/181/382/116/original/f19ba724f6ce33ec.png "[ImageSource: Unit 42]
Auto-Color Infection Chain.
Unit 42 does not have visibility into the initial infection vector, but the attack begins with the execution of a file disguised with benign names like\"door\", \"egg\", and \"log.\"
If the malware runs with root privileges, it installs a malicious library implant (libcext.so.2), disguised as the legitimate libcext.so.0 library, copies itself to a system directory (/var/log/cross/auto-color), and modifies '/etc/ld.preload' to ensure the implant executes before any other system library.
If root access isn't available, the malware still executes but skips the persistent mechanisms. Although this limits its long-term impact, it still provides remote access to threat actors who may be able to achieve root through other means.")
Keine profilbasierte Wahlwerbung unter Verwendung sensibler Daten nach Art. 9 DSGVO, wie zum Beispiel Parteizugehörigkeit oder -affinität 
