AI-Powered Espionage Campaign Targets Government Linux Infrastructure

What it is

CL-UNK-1211 is a Unit 42 activity cluster (October 2025 to April 2026) that targets government and state-affiliated Linux servers, mainly PHP/Plesk web hosts, qmail mail servers and MSSQL databases. "UNK" means Unit 42 has not decided whether it is nation-state or cybercrime. The page says the payloads carry conversational AI comments, so they were either pasted from an LLM or deployed by an automated agent.

How it works

• Persistence in PHP: the attackers changed auto_prepend_file in every PHP config under /etc/php/ and /opt/plesk/php/, so a web shell runs before any PHP script. One shell was /usr/lib/php/plesk_sys_driver.php.
• Credential theft: a replaced .bashrc aliases sudo to a fake password prompt and logs the result to Solarwinds.StatusLog.txt. A line added to a PHP login page logs admin credentials. The attackers also searched config and history files for email, SMTP and database passwords.
• SysGoRAT: a Go RAT for Windows and Linux with seven command types and six persistence methods. It connects over WebSocket to wss://<addr>/ws, defaulting to 104.194.158[.]65:443. Binary names seen: sys-control-client, pip2.7, ea_install, ./semanage.
• Root access: LinPEAS, then PwnKit (CVE-2021-4034). Backdoors left behind: a renamed Python 3 at .libpython-helper, a custom SUID shell at .libsystemd-helper, and a copy of /bin/bash named .tourch with chmod u+s.
• Lateral movement: XP_CMDSHELL on internal MSSQL, with a double hop through one SQL server to another subnet. They also used sshpass with hard-coded admin credentials and added keys to authorized_keys.
• Tunnels: revsocks, pysoxy, and GSocket gs-netcat run from /dev/shm/.gs-10085/ under the process name [kcached], with arguments in the GSOCKET_ARGS environment variable and HISTFILE=/dev/null.
• Mail and data theft: they listed /var/qmail/mailnames/ and counted Maildir/cur/ files. search_social.php searched headers for social-media emails. zip_mails.sh was meant to archive mailboxes. Databases went to /tmp/dump.sqlite and CSV, then out by netcat or curl to transfer[.]sh, bashupload[.]com, filebin[.]net and catbox[.]moe.
• Exposure scanning: a custom Go scanner for CVE-2025-55182 (React2Shell).
• Anti-forensics: touch -t timestomping, single-use scripts that write, run and rm themselves, and mass deletion of auth, history, mail, OS, web and PHP session logs. They planted RedTeamOps2025 in a script and created a user with the password pentest123 to pass as a red team.

What to do

Hunt for these on Linux web and mail hosts:

• auto_prepend_file values in /etc/php/ and /opt/plesk/php/ that point to unexpected files, and plesk_sys_driver.php.
• A sudo alias in any .bashrc, and a file named Solarwinds.StatusLog.txt.
• Hidden SUID binaries: .libpython-helper, .libsystemd-helper, .tourch.
• Processes named [kcached] and /dev/shm/.gs-10085/, plus outbound connections to gsocket[.]io.
• search_social.php, zip_mails.sh and /tmp/dump.sqlite.
• The strings RedTeamOps2025 and pentest123, which indicate the false red-team cover story.
• Outbound traffic to the page's IP and domain list (17 IPs; magento[.]ink, solidmonpe[.]com, wibu-bau-bawang[.]online, beraskencur[.]site), and the SHA-256 hashes for the React2Shell scanner, PwnKit, GSocket shell, privilege-escalation backdoor and three PHP web shells.

The page recommends strict outbound firewall rules and endpoint detection for standard utilities that spawn interactive shells. The Cortex XDR alert "Uncommon attempt to clear shell history" fired on this activity. Check exposed React servers for CVE-2025-55182 and patch hosts for CVE-2021-4034.

Caveats

• Several commands appear only in figures, so this text does not reproduce them.
• zip_mails.sh had syntax errors (user=\;)) and would have failed.
• Cortex XDR detected and blocked the attempts to kill its processes with pgrep and pkill.
• Unit 42 found no evidence that SolarWinds systems were compromised; the name was only borrowed as camouflage.
• The page does not say how initial access was gained, and it does not attribute the campaign to a nation-state or criminal group.