Unit 42 Says CL-UNK-1211 Used AI-Written Scripts to Backdoor Government Linux Servers Through PHP auto_prepend_file, Hijack sudo Passwords and Wipe Its Tracks

LONDON - Palo Alto Networks' Unit 42 said on Oct. 15, 2026 that an intrusion set it tracks as CL-UNK-1211 spent October 2025 through April 2026 inside Linux servers belonging to government entities and state-affiliated infrastructure, using scripts that bear the marks of large language model output to plant web shells, harvest credentials, dump databases and try to carry off government mailboxes. In a report by Roey Porat and Tom Fakterman, Unit 42 says multiple artifacts contained conversational, step-by-step reasoning notes addressed to the operator, which suggests the code was either copied from an AI prompt's output or deployed by an automated AI agent. Other traits it ties to AI-operated attacks include section headers inside scripts, heavy Base64 encoding and fast switching among PHP, JavaScript, Bash and Python. Unit 42 has not determined whether the cluster is tied to a nation-state or to cybercrime, which is what the UNK in its name signals. For detection teams, the value lies less in the AI angle than in Linux tradecraft that leaves durable host artifacts.

Persistence started at the web tier. According to Unit 42, the attackers combined custom web shells with open-source ones from GitHub, ran interactive commands from the php-fpm process, and rewrote the auto_prepend_file value in every PHP configuration under /etc/php/ and /opt/plesk/php/, so that a file of their choosing executes before any other PHP script runs. In one case that file was a web shell named /usr/lib/php/plesk_sys_driver.php. To collect credentials, they replaced a .bashrc file with a copy that aliases sudo to a look-alike password prompt, writes the captured password to a log named Solarwinds.StatusLog.txt and then hands it to the real sudo, so the user notices nothing. Unit 42 says SolarWinds systems were not compromised; the name was cover. The attackers also inserted a credential logger into a PHP login page and searched configuration and command history files for cleartext email, SMTP and database passwords.

The custom implant is SysGoRAT, a cross-platform remote access Trojan written in Go and first seen under the name sys-control-client, later renamed pip2.7, ea_install and ./semanage on other hosts. It talks to its controller over WebSocket at wss://<addr>/ws, defaulting to 104.194.158[.]65:443, and supports seven command types, including shell access, directory listing and TCP proxying. Its persist action can install a systemd unit at /etc/systemd/system/sys-update.service or a five-minute cron entry, or, on Windows, an Onedrive Update Run key or a daily task named Onedrive. Unit 42 counted in-memory reverse shells to at least seven C2 servers, along with revsocks, pysoxy and GSocket's gs-netcat, which ran from /dev/shm/.gs-10085/ under the disguised process name [kcached] with HISTFILE=/dev/null. For root, the attackers ran LinPEAS and tried the PwnKit exploit for CVE-2021-4034, then held it with a renamed Python interpreter called .libpython-helper, a SUID shell called .libsystemd-helper and a SUID copy of bash named .tourch. The toolkit also included a custom Go scanner for CVE-2025-55182, known as React2Shell.

The goal was data. Unit 42 says the attackers enumerated /var/qmail/mailnames/, counted messages in users' Maildir/cur/ folders, and ran a script called search_social.php that searches email headers for Facebook, Instagram, Twitter, TikTok and LinkedIn keywords to find mail tied to social media accounts, then tried to build a zip_mails.sh script to archive whole mailboxes. They sampled 100 rows from each of four tables into /tmp/dump.sqlite before full CSV dumps, and attempted to send compressed dumps out with netcat or to file-hosting sites such as transfer[.]sh and the catbox[.]moe API. Evasion included pgrep and pkill attempts against Cortex XDR processes, which Unit 42 says were detected and blocked; write-run-delete one-liners; touch -t timestomping; the key RedTeamOps2025 and a created user with the password pentest123, planted to pass the intrusion off as a red-team exercise; and mass deletion of authentication, history, mail, system, web server and PHP session logs, followed by a script that checked whether the attackers' IP addresses were gone.

Each of those steps leaves something to hunt. The artifacts Unit 42 documents include auto_prepend_file values that reference unexpected files in php.ini or Plesk configuration, sudo aliases in .bashrc, hidden root helpers named .libpython-helper and .libsystemd-helper, a SUID copy of bash named .tourch, a [kcached] process running from /dev/shm, a sys-update.service unit, php-fpm spawning shells, and the mkfifo /tmp/f netcat pattern. Unit 42 recommends strict outbound firewall rules and endpoint detection of standard utilities that spawn interactive shells, and says its Cortex XDR alert for an uncommon attempt to clear shell history fired on this activity. The cleanup scripts truncate /var/log/auth.log, wtmp, btmp and lastlog and empty root's .bash_history, which only erases the record where the server holds the sole copy of its logs. The report publishes 10 SHA-256 hashes for the scanner, backdoors, PwnKit and three PHP web shells, plus 17 IP addresses and four domains: magento[.]ink, solidmonpe[.]com, wibu-bau-bawang[.]online and beraskencur[.]site.