AI-Powered Espionage Campaign Targets Government Linux Infrastructure

Summary

Unit 42 attributes a cluster of activity it tracks as CL-UNK-1211 to a campaign targeting government entities and state-affiliated infrastructure, with observed activity spanning October 2025 through April 2026. The operators focused on enterprise Linux and database environments to conduct reconnaissance, maintain persistent access, dump sensitive databases, and exfiltrate government mailboxes in order to reach social media accounts tied to government email addresses.^[0]

A defining characteristic of this campaign is heavy reliance on AI-generated payloads. Multiple PHP and shell scripts contained conversational, step-by-step reasoning notes explaining code logic to an operator, along with section headers, extensive Base64 encoding, and seamless switching between PHP, JavaScript, Bash and Python — patterns Unit 42 assesses as consistent with LLM-assisted generation or execution by an automated AI agent.^[0]

The toolkit combined open-source utilities (LinPEAS, PwnKit, revsocks, pysoxy, GSocket/gs-netcat) with custom tooling including a cross-platform Go RAT dubbed SysGoRAT and a custom Go scanner for CVE-2025-55182 (React2Shell). The operators maintained persistence via global PHP configuration hijacking and widespread web shells, and employed extensive anti-forensics such as disabling endpoint protection, timestomping, log deletion, and planting deceptive red-team markers. Despite these efforts, Cortex XDR detected and prevented key stages of the activity.^[0][5][6]

Attack chain

1. Initial Access: The attackers gained access by deploying a variety of custom and open-source web shells on targeted Linux servers, and used a custom Go scanner for CVE-2025-55182 (React2Shell) to identify vulnerable servers.^[0][6]
2. Persistence: They modified the auto_prepend_file value across all PHP configurations under /etc/php/ and /opt/plesk/php/ so a malicious web shell (e.g. /usr/lib/php/plesk_sys_driver.php) loads before any PHP script runs, and injected SSH public keys into authorized_keys for passwordless access. SysGoRAT added persistence via systemd units, cron, Windows Run keys and scheduled tasks.^[0]
3. Credential Harvesting: The attackers hijacked .bashrc with a malicious sudo alias that captured passwords to a log file named Solarwinds.StatusLog.txt, inserted a credential logger into a PHP login page, and scanned configuration and history files for cleartext email, SMTP and database passwords.^[0]
4. Privilege Escalation: After deploying LinPEAS to find escalation paths, they used PwnKit (CVE-2021-4034) to attempt root, plus renamed Python interpreters (.libpython-helper), a custom SUID root shell (.libsystemd-helper) and a SUID /bin/bash copy (.tourch) to execute commands as root.^[0][5]
5. Command and Control: SysGoRAT connected over WebSocket (wss://.../ws) defaulting to 104.194.158[.]65:443, and the attackers ran in-memory reverse shells (netcat named-pipe, bash /dev/tcp redirects, Python subprocess shells) across at least seven distinct C2 servers.^[0]
6. Lateral Movement: They enabled xp_cmdshell on an internal MSSQL server, built a double-hop sqlcmd execution chain to reach secondary SQL servers, used sshpass with hard-coded credentials to pivot over SSH, and deployed revsocks, pysoxy and GSocket/gs-netcat tunneling tools.^[0]
7. Collection and Exfiltration: The attackers enumerated /var/qmail/mailnames/ directories, deployed search_social.php to find social-media emails, attempted zip_mails.sh to compress mailboxes, dumped database tables to CSV/SQLite, and attempted exfiltration via netcat, curl to file-hosting sites and the catbox[.]moe API.^[0]
8. Anti-Forensics: The attackers attempted to kill Cortex XDR processes with pgrep/pkill, used touch -t timestomping, removed single-use scripts after execution, deleted authentication, history, email, OS, web and PHP session logs, and ran verify scripts to confirm their IPs were scrubbed.^[0]

Disclosure timeline

Actor profile

CL-UNK-1211

Unit 42 tracks this activity as CL-UNK-1211, using the UNK designation for clusters whose affiliation with nation-state or cybercrime activity has not yet been determined. The cluster shows a deep understanding of Linux, a methodical defense-evasion playbook, and reliance on AI to accelerate payload creation. Operational focus is intelligence-gathering: database theft and mailbox exfiltration from government entities and state-affiliated infrastructure, including attempts to disguise activity as a legitimate red-team assessment.^[0]

How it works

Persistence relied on abusing PHP's auto_prepend_file directive: by setting it across all configuration files under /etc/php/ and /opt/plesk/php/, any attacker-specified file (e.g. a web shell planted as /usr/lib/php/plesk_sys_driver.php) automatically loads and executes before every PHP script runs.^[0]

The attackers leveraged PwnKit, a self-contained exploit for CVE-2021-4034, to attempt to gain root, and deployed a custom Go scanner targeting CVE-2025-55182 (React2Shell) with options for WAF bypass, Vercel WAF bypass, digest bypass and exploit command execution.^[0][5][6]

SysGoRAT establishes a WebSocket C2 (wss://.../ws) defaulting to the hardcoded IP 104.194.158[.]65:443, supports seven command types (command, control, list_dir, shell_input, proxy_connect, proxy_data, proxy_close) and control sub-actions (shell_start, screenshot, download, persist) with six cross-platform persistence methods.^[0]

Affected versions and patch status

Indicators of Compromise

Key takeaways

• CL-UNK-1211 demonstrates attackers blending traditional Linux post-exploitation with AI-accelerated workflows, using LLM-generated scripts to rapidly build and adapt operational payloads while minimizing manual development overhead.^[0]
• The operation emphasized intelligence-gathering — database dumps and government mailbox exfiltration to reach social media accounts — paired with aggressive anti-forensics and deceptive red-team markers (RedTeamOps2025, pentest123, Solarwinds.StatusLog.txt) to disguise the intrusion.^[0]
• Despite extensive evasion, endpoint controls neutralized key stages: Cortex XDR detected and prevented the agent-termination attempts and reverse shells, underscoring the value of comprehensive Linux server and database visibility.^[0]

Defensive actions

• Enforce strict outbound firewall rules and monitor standard system utilities that spawn interactive shells.: The attackers used in-memory reverse shells via netcat named pipes, bash /dev/tcp redirects and Python subprocesses across at least seven C2 servers, which outbound controls and EDR can detect.^[0]
• Audit PHP auto_prepend_file settings under /etc/php/ and /opt/plesk/php/ and inspect for unexpected web shells such as plesk_sys_driver.php.: Global PHP configuration hijacking was the attackers' primary persistence mechanism, causing a malicious web shell to load before every PHP script.^[0]
• Hunt for the published SHA-256 hashes, C2 IP addresses and domains, and monitor for SysGoRAT WebSocket beaconing to 104.194.158[.]65.: These indicators are directly associated with CL-UNK-1211 tooling and infrastructure.^[0]
• Monitor for shell-history clearing, mass log truncation and timestomping, and alert on attempts to terminate endpoint agent processes (traps, pmd, cortex) via pgrep/pkill.: The attackers' anti-forensics playbook included disabling endpoint protection and erasing authentication, history, email, OS and web logs; Cortex XDR's 'Uncommon attempt to clear shell history' detector flagged this activity.^[0]
• Patch polkit (CVE-2021-4034) and servers affected by CVE-2025-55182 (React2Shell), and review authorized_keys files for unexpected SSH public keys.: The attackers exploited PwnKit for root escalation, scanned for React2Shell, and injected SSH keys for passwordless persistence.^[0][5][6]