Kiberxavfsizlik tadqiqotchilari davlat tashkilotlari va davlatga aloqador infratuzilma bilan bog'liq Linux infratuzilmasiga qaratilgan kiberjosuslik kampaniyasi tafsilotlarini e'lon qildi.
Palo Alto Networks Unit 42 tomonidan 2025-yil oktyabr va 2026-yil aprel oylari orasida kuzatilgan faoliyat CL-UNK-1211 nomi bilan kuzatilgan, bu yerda "CL" klaster, "UNK" esa noma'lum motivatsiyani anglatadi.
Kampaniyaning e'tiborga molik jihati shundaki, unda katta til modellari (LLM) va/yoki avtomatlashtirilgan sun'iy intellekt (SI) agentlari yuklamalarni yaratish va zararli kodni bajarish uchun ishlatilgan.
"Ushbu faoliyat klasteri ortidagi hujumchilar Linux muhitlariga e'tibor qaratib, keng ko'lamli razvedka o'tkazish va razvedka ma'lumotlarini yig'ish uchun doimiy tarmoq kirishini saqlab qolishdi," deb aytishdi tadqiqotchilar Roey Porat va Tom Fakterman. "Hujumchilar ijtimoiy tarmoqlarga kirish uchun hukumat pochta qutilarini va sezgir ma'lumotlar bazalarini chiqarib olishga urinishdi."
Kampaniya "moslashuvchan operatsion o'yin kitobi"dan foydalanadi va ochiq manbali vositalar, maxsus ko'p platformali orqa eshiklar va veb-qobiqlar kombinatsiyasidan foydalanib kirishni saqlab qoladi. Yana bir xususiyat — yakuniy himoya tizimlarini o'chirish, tizim jurnallarini o'chirish va aldamchi qizil jamoa belgilarini joylashtirish orqali faoliyatni qonuniy xavfsizlik baholashi sifatida yashirishga urinishdir.
Tahdid aktori shuningdek, zararli PHP va qobiq skriptlaridan foydalanishda kuzatilgan, ular ehtimol SI yordamida yaratilgan bo'lib, doimiy kirishni saqlash, razvedka o'tkazish va ma'lumotlarni chiqarib olish uchun ishlatilgan.
"Standart ishlab chiquvchi hujjatlari o'rniga, bir nechta skriptlarda suhbat tarzidagi, qadam-baqadam tushuntirish eslatmalari mavjud edi. Bu eslatmalar kodning mantiqini dastlabki ko'rsatmalarni bergan operatorga tushuntirgan," deb aytdi kiberxavfsizlik kompaniyasi. "Ularning mavjudligi kodning to'g'ridan-to'g'ri SI so'rovi natijasidan nusxalanganini yoki avtomatlashtirilgan SI agenti tomonidan joylashtirilganini ko'rsatadi."
Ochiq manbali va maxsus PHP veb-qobiqlar aralashmasi xost tarmoqlariga doimiy orqa eshik sifatida kirishni saqlab qolish usuli sifatida ishlatiladi. Keyin bu kirish maqsadli muhitdan uch xil usul bilan ma'lumot olish uchun suiiste'mol qilinadi:
- .bashrc faylini zararli versiya bilan almashtirish, unda parollarni o'g'irlash buyrug'i mavjud.
- Admin ma'lumotlarini yig'ish uchun PHP kirish sahifalariga kod kiritish.
- Konfiguratsiya fayllari va buyruq tarixi fayllarida aniq matnli elektron pochta, SMTP va ma'lumotlar bazasi parollarini qidirish.
Shuningdek, hujumlar doirasida Go tilida yozilgan maxsus, ko'p platformali masofaviy kirish troyani joylashtirilgan bo'lib, u Windows va Linux tizimlarida uzoq muddatli kirishni saqlab qolish uchun turli doimiy kirish usullarini qo'llab-quvvatlaydi. SysGoRAT deb nomlangan bu troyan WebSocket orqali qattiq kodlangan IP manzilga ("104.194.158[.]65:443") buyruq va boshqaruv (C2) ulanishini o'rnatadi va yetti turdagi buyruqlarni oladi:
- command — Linuxda /bin/sh -c yoki Windowsda cmd /C orqali ixtiyoriy buyruqlarni bajarish
- control — kichik buyruqlar orqali interaktiv qobiq (shell_start), skrinshotlar (screenshot), fayllarni C2 serveriga chiqarib olish (download) va doimiy kirishni o'rnatish (persist) uchun jarayonni boshlash
- list_dir — katalog mazmunini ro'yxatlash
- shell_input — interaktiv qobiq sessiyasini yaratish
- proxy_connect — ixtiyoriy maqsadga TCP ulanishini o'rnatish
- proxy_data — o'rnatilgan proksi ulanishiga ma'lumotlarni ikki tomonlama uzatish
- proxy_close — proksi sessiyasini tugatish va o'chirish
Bundan tashqari, hujumlar diskda sud-tibbiy iz qoldirmaslik uchun xotirada ishlaydigan teskari qobiqlardan foydalanadi, shuningdek, "/var/qmail/mailnames/" kataloglarini sanab, ma'lum papkalarda saqlangan elektron pochta xabarlarining sonini hisoblaydi.
"Keyin hujumchilar ijtimoiy tarmoqlar bilan bog'liq elektron pochta xabarlarini qidirdilar," deb tushuntirdi Unit 42. "Ular search_social.php nomli PHP skriptini joylashtirishdi, u elektron pochta sarlavhalarida ma'lum kalit so'zlarni qidirib, natijalarni foydalanuvchiga qulay formatda ko'rsatdi."
"Skript keyin javobni tahlil qilib, aniq fayl yo'lini, ijtimoiy tarmoq hisobining elektron pochta jo'natuvchisi, qabul qiluvchisi va mavzusini ko'rsatdi."
Hujumchilar shuningdek, "zip_mails.sh" nomli bash skriptini yaratishga urinishgan, bu skript qiziqish uyg'otgan elektron pochta xabarlarini ZIP arxivlariga siqib, ma'lumotni chiqarib olishga mo'ljallangan. Biroq, skriptdagi sintaksis xatolari dastur bajarilganda muvaffaqiyatsizlikka uchraganini anglatadi.
"Ushbu kampaniya hujumchilarning an'anaviy post-ekspluatatsiya usullarini SI tezlashtirilgan ish oqimlari bilan birlashtirib, hukumat Linux server infratuzilmasiga hujum qilishini ko'rsatadi," deb aytdi Unit 42. "SI yordamida operatsion skriptlarni tez yaratish, moslashtirish va joylashtirish orqali CL-UNK-1211 ortidagi hujumchilar tezkor operatsiya sur'atini saqlab qolishdi va qo'lda ishlab chiquvchi yukini minimallashtirishdi."
Bu rivojlanish Google Threat Intelligence Group (GTIG) va Mandiant, shuningdek Microsoft tomonidan hujjatlashtirilgan tahdid aktorlarining ARTEX, PentAGI, Hexstrike va CAIRN kabi ochiq manbali agentik kirish sinov tizimlaridan foydalanishi bilan bir vaqtda sodir bo'ldi, bu tizimlar hujum hayot siklining turli bosqichlarida "keng ko'lamli harakatlar"ni misli ko'rilmagan tezlik va miqyosda amalga oshirish uchun ishlatilgan.
ARTEX muallifi keng tarqalgan suiiste'mol haqidagi xabarlardan so'ng tizimni o'chirib tashlagan bo'lsa-da, u bir nechta versiyalarni, jumladan ARTEX PRO deb nomlangan tijorat taklifini va ScopeWeaver deb nomlangan mahalliylashtirilgan variantni keltirib chiqardi.
Ba'zi holatlar quyida keltirilgan:
- Storm-0940 (aka UNC7228) tomonidan ARTEXdan foydalanib, AQSh va Yevropadagi korxona dasturiy ta'minoti, sanoat avtomatlashtirish, yarimo'tkazgich ishlab chiqarish va loyihalash hamda telekommunikatsiya sohalaridagi tashkilotlarga qaratilgan ma'lumot o'g'irlash kampaniyalarini tashkil etish.
- Moliyaviy motivatsiyaga ega tahdid aktorlari tomonidan ARTEXdan foydalanib, ma'lumot o'g'irlash va tovlamachilikni osonlashtirish, jumladan Osiyodagi moliyaviy sektorga hujum qilish.
- Shimoliy Koreya davlat homiyligidagi xaker guruhlari, masalan Onyx Sleet (aka Andariel) va Pearl Sleet (aka Lawrencium) tomonidan operatsiyalarda ARTEXdan foydalanish.
- Osiyodagi tashkilotlarga qarshi tizimli razvedka va zaiflikni skanerlash uchun PentAGIdan foydalanish.
"ARTEX va shunga o'xshash agentik hujum tizimlarining paydo bo'lishi tahdid aktorlarining ochiq manbali ko'p agentli hujum tizimlarini, shuningdek, ehtimol maxsus agentik tizimlarni qabul qilish tomon kengroq siljishni ta'kidlaydi," deb aytishdi GTIG va Mandiant.
"ARTEX kabi tizimlar hujum muddatlarini mashina tezligiga qisqartiradi; biroq, ular hozirda tezlik evaziga yashirinlikni qurbon qiladi. Cheklovsiz avtonom bajarish sud-tibbiy trafikni yaratadi, tanish identifikatorlarga tayanadi va kod darajasida aniq iz qoldiradi, bu esa aniqlash va yumshatish ehtimolini oshiradi."
Cybersecurity researchers have disclosed details of a cyber espionage campaign specifically targeting Linux infrastructure associated with government entities and state-affiliated infrastructure.
The activity, observed by Palo Alto Networks Unit 42 between October 2025 and April 2026, has been tracked under the moniker CL-UNK-1211, where "CL" refers to cluster and "UNK" stands for unknown motivation.
A notable aspect of the campaign concerns the use of large language models (LLMs) and/or automated artificial intelligence (AI) agents to generate payloads and execute malicious code.
"The attackers behind this cluster of activity focused on Linux environments to conduct extensive reconnaissance and maintain persistent network access to support intelligence-gathering," researchers Roey Porat and Tom Fakterman said. "The attackers attempted to dump sensitive databases and exfiltrate government mailboxes to access social media accounts."
The campaign employs a "versatile operational playbook," leveraging a combination of open-source tools, custom cross-platform backdoors, and web shells to maintain access. Another hallmark involves attempts to disable endpoint protections, wipe system logs, and plant deceptive red-team markers so as to disguise the activity as a legitimate security assessment.
The threat actor has also been observed using malicious PHP and shell scripts, likely generated using AI, to maintain persistence, perform reconnaissance, and exfiltrate data.
"Rather than standard developer documentation, multiple scripts contained conversational, step-by-step reasoning notes. These notes explained the code's logic to the operator who provided the initial instructions," the cybersecurity company said. "Their presence suggests that the code was either copied directly from an AI prompt output or deployed by an automated AI agent."
A mix of open-source and bespoke PHP web shells is used as a way to maintain a persistent backdoor into the host networks. The access is then abused to gather credentials from the targeted environment using three different methods -
- Replacing the .bashrc file with a malicious version containing a command to steal passwords.
- Injecting code into PHP login pages to harvest admin credentials.
- Scanning for cleartext email, SMTP, and database passwords within configuration files and command history files.
Also deployed as part of the attacks is a custom, multi-platform remote access trojan written in Go that supports various persistence methods to maintain long-term access on Windows and Linux systems. Called SysGoRAT, it establishes a command-and-control (C2) connection over WebSocket to a hard-coded IP address ("104.194.158[.]65:443") and fetches seven types of commands -
- command, to execute arbitrary commands via /bin/sh -c (Linux) or cmd /C (Windows)
- control, to spawn via sub-commands an interactive shell (shell_start), screenshots (screenshot), exfiltrate files to the C2 server (download), and install persistence (persist)
- list_dir, to list directory content
- shell_input, to create an interactive shell session
- proxy_connect, to establish a TCP connection to an arbitrary target
- proxy_data, to relay data bidirectionally to an established proxy connection
- proxy_close, to terminate and remove a proxy session
Furthermore, the attacks make use of in-memory reverse shells to avoid leaving forensic artifacts on disk, as well as enumerate "/var/qmail/mailnames/" directories to count the number of emails stored in specific folders.
"Next, the attackers searched for social media-related emails," Unit 42 explained. "They deployed a PHP script, named search_social.php, that searched for specific keywords in email headers and displayed the results in a user-friendly format."
"The script then parsed the response and displayed the exact file path, social media account email sender, recipient and subject."
The attackers have also been found attempting to generate a bash script named "zip_mails.sh" in a bid to compress emails of interest into ZIP archives and exfiltrate the information. However, syntax errors present in the script meant that the program failed upon execution.
"This campaign demonstrates how attackers are combining traditional post-exploitation techniques with AI-accelerated workflows to target governmental Linux server infrastructure," Unit 42 said. "By leveraging AI to rapidly generate, adapt and deploy operational scripts, the attackers behind CL-UNK-1211 maintained a fast pace of operation while minimizing manual developer overhead."
The development comes as Google Threat Intelligence Group (GTIG) and Mandiant, along with Microsoft, documented threat actors' abuse of open-source agentic penetration testing frameworks like ARTEX, PentAGI, Hexstrike, and CAIRN to carry out a "broad range of actions" across various stages of the attack life cycle at an unprecedented speed and scale.
Although ARTEX was taken down by its author after reports of widespread misuse emerged, it has spawned multiple versions, including a commercial offering dubbed ARTEX PRO and a localized variation called ScopeWeaver.
Some of the cases are listed below -
- Use of ARTEX by Storm-0940 (aka UNC7228) to orchestrate data theft campaigns targeting entities in the U.S. and Europe across the enterprise software, industrial automation, semiconductor manufacturing and design, and telecommunications industry verticals.
- Use of ARTEX by financially motivated threat actors to facilitate data theft extortion, including the targeting of the financial sector in Asia.
- Use of ARTEX by North Korean state-sponsored hacking groups like Onyx Sleet (aka Andariel) and Pearl Sleet (aka Lawrencium) in operations.
- Use of PentAGI for WHOIS asset mapping and systematic reconnaissance and vulnerability scanning against organizations in Asia.
"The emergence of ARTEX and similar agentic offensive intrusion frameworks underscores a broader shift toward threat actor adoption of open source multi-agent offensive frameworks, as well as potentially custom agentic harnesses," GTIG and Mandiant said.
"Frameworks such as ARTEX compress attack timelines to machine speed; however, they currently trade stealth for velocity. Unrestricted autonomous execution generates forensic traffic, relies on recognizable identifiers, and leaves behind distinct code-level traces, increasing the likelihood of detection and mitigation."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
