"We track this activity as CL-UNK-1211," Unit 42 reports — a concise label for an AI-accelerated espionage campaign that targeted government entities and state‑affiliated infrastructure between October 2025 and April 2026.
How AI was embedded in the attackers’ workflow
Unit 42 found multiple artifacts that contained conversational annotations and developer reasoning comments, language the researchers say is "consistent with AI-assisted code generation." Scripts carried step‑by‑step notes rather than standard developer documentation, suggesting code either copied from large language model output or deployed by an automated AI agent. The operation also showed characteristic behaviors the report lists as common in AI‑operated attacks: section headers in scripts, heavy use of Base64‑encoded commands, and rapid switching among PHP, JavaScript, Bash and Python.
Targets and objectives: Linux servers, mailboxes and databases
The attackers focused on enterprise Linux and database environments belonging to government and state‑affiliated infrastructure. Their stated objectives included maintaining persistent access, dumping entire database contents, and enumerating mailboxes to locate social‑media‑related credentials. Unit 42 observed scripts that scanned /var/qmail/mailnames/ and counted messages in Maildir/cur/ directories, a PHP script named search_social.php that searched email headers for social media indicators, and subsequent attempts to compress and exfiltrate whole mailboxes.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleTooling: web shells, SysGoRAT, scanners and tunneling
The toolset combined open‑source utilities, custom cross‑platform malware and widespread web shell deployment. Attackers modified global PHP settings — changing auto_prepend_file in /etc/php/ and /opt/plesk/php/ — to force a malicious loader to run before any PHP script. One example filename used to appear legitimate was /usr/lib/php/plesk_sys_driver.php.
Unit 42 identified a custom Go remote access trojan called SysGoRAT (first seen as sys-control-client). SysGoRAT supports cross‑platform execution, communicates over WebSocket to wss://<addr>/ws (defaulting to the hardcoded IP 104.194.158[.]65:443), and exposes seven command types with multiple persistence sub‑actions. The attackers also deployed a Go scanner for CVE‑2025‑55182 (React2Shell), used LinPEAS and an exploit for CVE‑2021‑4034 (PwnKit) to seek privilege escalation, and abused tunneling/proxy tools such as revsocks, pysoxy and GSocket/gs‑netcat to traverse internal networks.
The report lists multiple hashes and infrastructure indicators (examples include PHP web shell hashes and IPs such as 45.88.188[.]140 and 104.194.158[.]65, and domains including magento[.]ink and transfer[.]sh), which Unit 42 has shared with partners.
Defense evasion and anti‑forensics: techniques and outcomes
Defense evasion was central to the operation. Attackers attempted to disable endpoint protections by targeting Cortex XDR‑related processes via pgrep/pkill, tampered with system and application logs, used timestomping with touch -t to alter file timestamps, and planted deceptive markers (for example the key RedTeamOps2025 and a user password pentest123) to mimic red‑team activity. They also replaced .bashrc entries with command wrappers that phished sudo passwords and logged them to a file named Solarwinds.StatusLog.txt.
Despite these efforts, the investigators report successful detections: Cortex XDR telemetry confirmed that attempts to terminate the agent were identified and prevented, and the Cortex XDR Analytics Engine produced alerts such as "Uncommon attempt to clear shell history" during the campaign. Unit 42 describes repeated attacker procedures for removing single‑use scripts and running automated cleanup to remove traces after exfiltration attempts.
What this means for technologists, policymakers, and affected enterprises
- Technologists and security teams: Prioritize visibility into Linux hosts, PHP configuration baselines, and mailbox directories; monitor for global PHP changes (auto_prepend_file), Base64‑encoded execution, and unusual outbound WebSocket/HTTPS connections to the listed IPs and domains.
- Procurement leaders and enterprise IT: Vet server management panels and hardening procedures for Plesk and PHP configurations; ensure endpoint protections and behavioral EDR detections are kept current and can surface uncommon log‑clearing or process termination attempts.
- Policymakers and incident responders: Note Unit 42’s designation of CL‑UNK‑1211 — "UNK" indicating affiliation with nation‑state or cybercrime has not been determined — and consider cross‑agency information sharing for rapid mitigation of multi‑vector campaigns that mix AI tooling with traditional post‑exploitation techniques.
Unit 42’s examination of CL‑UNK‑1211 paints a specific portrait: attackers blending automated, AI‑generated payloads with tried‑and‑true Linux post‑exploitation methods, aiming at mail servers and databases while investing effort in erasing traces. The report concludes by offering detection and protection options — including Advanced WildFire, Cortex XDR and the Unit 42 incident response services — and by sharing indicators with the Cyber Threat Alliance to accelerate protective measures across the community.
https://unit42.paloaltonetworks.com/ai-campaign-targets-linux-infrastructure/
