Overview

• Darktrace has confirmed the first documented instance of threat actors exploiting CVE-2025-31324 to deploy the Auto-Color Linux backdoor.
• A multi-stage intrusion against a US chemicals company in April delivered a malicious ZIP file, established DNS tunnels and downloaded an ELF payload within 48 hours.
• Auto-Color leverages ld.so.preload for stealthy persistence and stalls its malicious behavior when its command-and-control server is unreachable.
• Security firms ReliaQuest, Onapsis and watchTowr observed active exploit attempts days after SAP patched the unauthenticated NetWeaver flaw on April 24.
• Organizations are urged to install the April patch, isolate exposed NetWeaver instances and adopt zero-trust architectures to mitigate ongoing threats.