LD_PRELOAD

The Auto-Color Linux backdoor provides remote access while employing a user-space rootkit to hide its presence. It achieves persistence by dropping a shared library and registering it via /etc/ld.so.preload, which loads the library into other dynamically linked processes. The rootkit component hooks libc functions to hide files, filter network connections in /proc/net/tcp, and disable SELinux enforcement.