An interesting read I came across this morning. It seems like it’s mostly been identified as targeting universities and government offices:
https://unit42.paloaltonetworks.com/new-linux-backdoor-auto-color/
2 Likes
The association between universities/government offices and payload distribution is not clear.