Hackers used apparently AI-generated scripts to compromise government Linux infrastructure, harvest credentials and pursue sensitive databases and official mailboxes in a campaign tracked as CL-UNK-1211.
The investigation, published October 15, linked the operation to government entities and state-affiliated infrastructure.
Attribution remains unresolved: under Unit 42’s attribution framework, the UNK designation means researchers have not established whether the activity belongs to a state-sponsored or financially motivated operation.
Malicious PHP and shell scripts contained conversational annotations and step-by-step reasoning explaining their logic to an operator.
The evidence suggests AI assistance but does not establish autonomous execution.
The attackers also used sectioned scripts, Base64-encoded commands and multiple programming languages, moving between PHP, JavaScript, Bash and Python throughout the intrusion.
These characteristics supported the researchers’ assessment alongside the more distinctive conversational comments.
Palo Alto Networks’ Unit 42 observed activity, between October 2025 and April 2026, documenting persistent access, custom malware and extensive attempts to conceal the intrusions.
Unit 42 assessed these artifacts, as consistent with code copied from large language model output or deployed through an automated AI agent.
Interactive web shell ac t ivity, as shown in Cortex XDR (Source : Unit42).
For persistence, the operators deployed custom and publicly available web shells, then modified PHP configuration files beneath /etc/php/ and /opt/plesk/php/.
They changed auto_prepend_file so malicious code would execute before other PHP scripts. One implant, /usr/lib/php/plesk_sys_driver.php, adopted a system-like filename to appear legitimate.
Credential theft included replacing .bashrc with a modified version that intercepted sudo authentication.
A malicious alias captured passwords before forwarding them to the legitimate command, preserving normal execution.
Stolen credentials were recorded in Solarwinds.StatusLog.txt; investigators found no evidence that SolarWinds infrastructure was compromised.
Additional payloads injected credential logging into a PHP authentication page and searched configuration files and command histories for database, SMTP and email passwords.
The Python-based reverse shell, as detected and prevented by Cortex XDR (Source : Unit42).
The toolkit included SysGoRAT, a custom Go remote access Trojan supporting Linux and Windows.
Its WebSocket command-and-control connection defaulted to 104.194.158[.]65:443, although operators could override the address. Capabilities included command execution, interactive shells, directory enumeration, file theft and TCP proxying.
SysGoRAT supported Linux persistence access through systemd services and cron, alongside Windows registry and scheduled-task mechanisms.
Operators renamed binaries to resemble legitimate utilities, including pip2.7 and semanage. Reverse shells using Netcat, Bash and Python connected to at least seven distinct command-and-control servers.
On government mail servers, attackers enumerated /var/qmail/mailnames/ and deployed search_social.php to locate messages associated with social media accounts.
They subsequently attempted mailbox archiving with zip_mails.sh, but one observed script contained syntax errors that would prevent execution. Successful mailbox theft should therefore not be inferred from that artifact.
Database collection progressed from limited samples to full dumps stored locally and compressed for attempted exfiltration. Attackers also abused legitimate file-hosting services to disguise outbound transfers as ordinary web traffic.
Cleanup scripts targeted authentication, email, operating-system and web-server logs.
Operators altered file access and modification timestamps, a technique documented by MITRE ATT&CK as timestomping, and planted red-team labels to misrepresent malicious activity as authorized testing.
Defenders should restrict outbound connections and monitor utilities spawning interactive shells, while investigating unauthorized PHP configuration changes and suspicious history-clearing activity across Linux servers and databases.
Indicators of Compromise
| Type | Indicator |
|---|---|
| IP address | 45.88.188[.]140 |
| IP address | 198.23.185[.]234 |
| IP address | 138.68.244[.]146 |
| IP address | 185.21.136[.]6 |
| Domain | magento[.]ink |
| Domain | solidmonpe[.]com |
| Domain | wibu-bau-bawang[.]online |
| Domain | beraskencur[.]site |
Note:IP addresses and domains are intentionally defanged (e.g.,[.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.
Hackers used apparently AI-generated scripts to compromise government Linux infrastructure, harvest credentials and pursue sensitive databases and official mailboxes in a campaign tracked as CL-UNK-1211.
The investigation, published October 15, linked the operation to government entities and state-affiliated infrastructure.
Attribution remains unresolved: under Unit 42’s attribution framework, the UNK designation means researchers have not established whether the activity belongs to a state-sponsored or financially motivated operation.
Malicious PHP and shell scripts contained conversational annotations and step-by-step reasoning explaining their logic to an operator.
The evidence suggests AI assistance but does not establish autonomous execution.
The attackers also used sectioned scripts, Base64-encoded commands and multiple programming languages, moving between PHP, JavaScript, Bash and Python throughout the intrusion.
These characteristics supported the researchers’ assessment alongside the more distinctive conversational comments.
Palo Alto Networks’ Unit 42 observed activity, between October 2025 and April 2026, documenting persistent access, custom malware and extensive attempts to conceal the intrusions.
Unit 42 assessed these artifacts, as consistent with code copied from large language model output or deployed through an automated AI agent.
Interactive web shell ac t ivity, as shown in Cortex XDR (Source : Unit42).
For persistence, the operators deployed custom and publicly available web shells, then modified PHP configuration files beneath /etc/php/ and /opt/plesk/php/.
They changed auto_prepend_file so malicious code would execute before other PHP scripts. One implant, /usr/lib/php/plesk_sys_driver.php, adopted a system-like filename to appear legitimate.
Credential theft included replacing .bashrc with a modified version that intercepted sudo authentication.
A malicious alias captured passwords before forwarding them to the legitimate command, preserving normal execution.
Stolen credentials were recorded in Solarwinds.StatusLog.txt; investigators found no evidence that SolarWinds infrastructure was compromised.
Additional payloads injected credential logging into a PHP authentication page and searched configuration files and command histories for database, SMTP and email passwords.
The Python-based reverse shell, as detected and prevented by Cortex XDR (Source : Unit42).
The toolkit included SysGoRAT, a custom Go remote access Trojan supporting Linux and Windows.
Its WebSocket command-and-control connection defaulted to 104.194.158[.]65:443, although operators could override the address. Capabilities included command execution, interactive shells, directory enumeration, file theft and TCP proxying.
SysGoRAT supported Linux persistence access through systemd services and cron, alongside Windows registry and scheduled-task mechanisms.
Operators renamed binaries to resemble legitimate utilities, including pip2.7 and semanage. Reverse shells using Netcat, Bash and Python connected to at least seven distinct command-and-control servers.
On government mail servers, attackers enumerated /var/qmail/mailnames/ and deployed search_social.php to locate messages associated with social media accounts.
They subsequently attempted mailbox archiving with zip_mails.sh, but one observed script contained syntax errors that would prevent execution. Successful mailbox theft should therefore not be inferred from that artifact.
Database collection progressed from limited samples to full dumps stored locally and compressed for attempted exfiltration. Attackers also abused legitimate file-hosting services to disguise outbound transfers as ordinary web traffic.
Cleanup scripts targeted authentication, email, operating-system and web-server logs.
Operators altered file access and modification timestamps, a technique documented by MITRE ATT&CK as timestomping, and planted red-team labels to misrepresent malicious activity as authorized testing.
Defenders should restrict outbound connections and monitor utilities spawning interactive shells, while investigating unauthorized PHP configuration changes and suspicious history-clearing activity across Linux servers and databases.
Indicators of Compromise
| Type | Indicator |
|---|---|
| IP address | 45.88.188[.]140 |
| IP address | 198.23.185[.]234 |
| IP address | 138.68.244[.]146 |
| IP address | 185.21.136[.]6 |
| Domain | magento[.]ink |
| Domain | solidmonpe[.]com |
| Domain | wibu-bau-bawang[.]online |
| Domain | beraskencur[.]site |
Note:IP addresses and domains are intentionally defanged (e.g.,[.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.