AI-Powered CL-UNK-1211 Espionage Campaign Targets Government Linux Servers With SysGoRAT
Kiran 
Unit 42 researchers say a still-unattributed cluster tracked as CL-UNK-1211 used AI-generated payloads to break into government and state-affiliated Linux infrastructure between October 2025 and April 2026. Palo Alto Networks published the findings on October 15, 2026.
The most unusual finding sits inside the scripts. Several PHP and shell payloads carried conversational, step-by-step reasoning notes, the kind an AI assistant writes to explain its work to a user. Unit 42 concluded the code was either pasted from an LLM’s output or run by an automated AI agent.
Other hallmarks included heavy Base64-encoded commands, section headers in shell output, and fluid switching between PHP, JavaScript, Bash and Python. Unit 42 designates such clusters “UNK” when it cannot yet say whether they are nation-state or cybercriminal operators.
AI-Powered CL-UNK-1211 Espionage Campaign
The intruders planted custom and open-source web shells on Linux servers. To survive reboots and cleanups, they edited the auto_prepend_file setting across PHP configurations under /etc/php/ and /opt/plesk/php/, so a malicious file runs before every PHP script. One shell, /usr/lib/php/plesk_sys_driver.php, was named to look like part of the Plesk hosting panel.
Credential theft used three routes. Attackers replaced .bashrc with a version that aliased sudo to show a fake password prompt, then logged what users typed into a file called Solarwinds.StatusLog.txt.
Unit 42 stresses that SolarWinds itself was not compromised; the name was only camouflage. They also inserted a logger into a PHP login page and searched configuration and history files for cleartext email, SMTP and database passwords.
Mail servers were a core target. The actors enumerated /var/qmail/mailnames/ directories, counted messages to pick targets, and ran search_social.php to find emails tied to social media accounts.
Likely to take over official government profiles. A script meant to zip whole mailboxes, zip_mails.sh, contained syntax errors and would have failed, a reminder that AI-written code still breaks.
The custom backdoor, SysGoRAT, is a Go-based remote access Trojan for Windows and Linux. It talks to its command server over WebSocket, defaults to the hardcoded address 104.194.158[.]65:443.
Supports seven command types, including arbitrary command execution, directory listing, interactive shells and proxying. The binary was renamed to blend in, using names such as sys-control-client, pip2.7, ea_install and ./semanage.
Across at least seven C2 servers, the operators also used in-memory reverse shells built from Netcat named pipes, Bash TCP redirects and Python subprocesses, leaving little on disk.
The attackers tried to kill Cortex XDR processes with pgrep and pkill, but Unit 42 says the product detected and blocked those attempts.
They timestomped long-lived files with touch -t, deleted authentication, history, mail, web server and PHP session logs, then ran a second cleanup and a script to check that their IPs were gone.
They also planted false flags, including the key RedTeamOps2025 and a created user password of pentest123, hoping investigators would write the intrusion off as a sanctioned pentest.
Unit 42 recommends strict outbound firewall rules and endpoint detection that flags standard utilities spawning interactive shells.
Teams should audit auto_prepend_file values, inspect .bashrc files for sudo aliases, and treat “red team” artifacts in an unplanned incident with suspicion.
Linux servers, databases and mail systems need the same visibility as Windows endpoints, because AI is now helping attackers produce and adapt tooling faster.
Site: Thecyberdef.com
Follow TheCyberDef on Google News, LinkedIn & X for the latest cybersecurity updates. Stay informed.
About the Author
