A new backdoor malware campaign targeting Linux systems and exploiting a critical vulnerability in SAP has been uncovered by cybersecurity researchers. The malware, known as Auto-Color, was deployed in a targeted intrusion against a US-based chemicals company in April 2025. Threat Exploits SAP NetWeaver Vulnerability According to an advisory published by Darktrace on July 29, the attack began when a threat actor exploited CVE-2025-31324, a critical flaw in SAP NetWeaver that allows remote file uploads and potential system compromise. Despite SAP disclosing the vulnerability on April 24, threat actors quickly moved to weaponize it. Jason Soroko, senior fellow at Sectigo said, "Organizations running SAP NetWeaver need to recognize that the Visual Composer Metadata Uploader flaw…