01 10 11

Table of Contents

  1. New Auto-Color Linux Backdoor Targets North American Govts, Universities 
  2. Update: CISA Adds Microsoft and Zimbra Flaws to KEV Catalog Amid Active Exploitation 
  3. Update: LightSpy Expands to 100+ Commands, Increasing Control Over Windows, macOS, Linux, and Mobile 
  4. New Undetectable Batch Script Uses PowerShell and Visual Basic to Install XWorm 
  1. A newly discovered Linux malware, Auto-Color, targeted universities and government organizations across North America and Asia between November and December 2024. The initial delivery method remains unknown, but victims must explicitly execute the malware for infection to occur. This evasive backdoor grants attackers full remote access to infected machines, making it highly persistent and difficult to remove. Once executed with root privileges, Auto-Color installs a malicious library implant (libcext[.]so[.]2), modifies /etc/ld[.]preload to maintain persistence, and renames itself to /var/log/cross/auto-color. If launched without root access, it still establishes remote access for attackers while awaiting privilege escalation. Auto-Color is designed to evade detection using proprietary encryption algorithms, stealthy file names, and libc function hooking, which manipulates /proc/net/tcp to conceal command-and-control (C2) connections. Attackers can use the malware to execute arbitrary commands, modify files, act as a proxy, and spawn reverse shells. It also features a built-in kill switch to erase infection traces upon command, preventing forensic investigation. The malware uses a custom encryption algorithm to obfuscate its C2 infrastructure, dynamically generating encryption keys to avoid detection. Defenders are advised to monitor /etc/ld[.]preload modifications, inspect /proc/net/tcp for anomalies, and implement behavior-based threat detection to identify suspicious activity. Given its advanced stealth mechanisms and persistent control over infected systems, Auto-Color represents a significant threat to Linux environments, particularly in government and academic sectors. 

 

  1. CISA has added two newly exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, highlighting ongoing cyber threats targeting widely used enterprise platforms. The first, CVE-2024-49035, is an improper access control flaw in Microsoft Partner Center, allowing privilege escalation and unauthorized actions. This vulnerability, actively exploited in the wild, was patched in November 2024, though Microsoft has yet to disclose specifics on its real-world abuse. The second, CVE-2023-34192, is a cross-site scripting (XSS) vulnerability in Synacor Zimbra Collaboration Suite (ZCS), permitting remote attackers to execute arbitrary scripts via the /h/autoSaveDraft function. Fixed in July 2023 (version 8.8.15 Patch 40), there are no confirmed reports of in-the-wild exploitation, though its addition to the KEV list suggests a heightened risk. Federal Civilian Executive Branch (FCEB) agencies must apply patches by March 18, 2025, as part of Binding Operational Directive (BOD) 22-01, which mandates swift remediation of actively exploited vulnerabilities. While the directive applies to federal entities, CISA strongly advises all organizations to prioritize these patches as part of their cybersecurity strategy. The agency continues to track and expand its KEV catalog, emphasizing that unpatched vulnerabilities remain a prime target for cybercriminals.   

  

  1. Researchers have identified an updated version of LightSpy, a modular spyware implant capable of targeting Facebook and Instagram database files to extract private messages, contacts, and account metadata. Initially discovered in 2020, LightSpy has evolved into a cross-platform surveillance tool, infecting Windows, macOS, Linux, iOS, Android, and routers. The latest version expands beyond data collection to include transmission management and plugin tracking, supporting over 100 commands and introducing 15 Windows-specific plugins focused on keylogging, audio recording, and USB data theft. Previously documented with device sabotage capabilities, the updated implant has removed iOS-specific destructive features, suggesting a shift toward long-term intelligence gathering rather than disruption. LightSpy's sophisticated design allows it to conceal C2 communications, intercept system functions, and persist on compromised devices for extended periods. Cyfirma researchers have also noted its potential links to similar malware, reinforcing its adaptability for multi-platform surveillance. With its growing capabilities and refined evasion tactics, LightSpy represents a significant threat, expanding its reach beyond messaging apps to social media espionage and broader system infiltration across various operating environments. 

 

  1. Researchers have uncovered a stealthy malware delivery framework leveraging obfuscated Batch scripts, PowerShell, and Visual Basic Script (VBS) to deploy XWorm or AsyncRAT, evading detection for over 48 hours. The attack begins with a heavily obfuscated Batch script to bypass traditional static analysis tools. This script conducts environmental checks to ensure execution on a real machine before activating PowerShell commands that fetch additional payloads from remote servers. The second-stage malware utilizes Telegram’s API for exfiltrating system metadata and screenshots, complicating detection efforts since Telegram traffic blends with legitimate activity. Security analysts suspect AI-generated code patterns in the script, characterized by unusual verbosity and inconsistent variable naming, suggesting that attackers may use generative AI tools to automate malware development and refine evasion techniques. The deployment of XWorm or AsyncRAT grants attackers full remote access, enabling credential theft, lateral movement, and data exfiltration. By combining legacy scripting techniques with modern cloud-based C2 infrastructure, the malware dynamically adapts to enterprise environments, making traditional signature-based detection ineffective. Security teams are advised to restrict unsigned PowerShell execution, implement behavioral analytics for anomalous script activity, and monitor outbound Telegram connections, particularly those transmitting compressed images or system metadata. With AI-assisted malware creation on the rise, cybersecurity defenses must shift towards real-time behavior analysis and proactive threat hunting to keep pace with evolving attack methodologies. 
💡
Hunter Strategy encourages our readers to look for updates in our daily Trending Topics and on Twitter.