AI-Assisted Linux Espionage Campaign Exposed

A campaign tracked by Palo Alto Networks’ Unit 42 shows how familiar Linux post-compromise methods can be combined into a flexible espionage operation—and potentially accelerated with artificial intelligence. The activity, tracked as CL-UNK-1211, targeted government entities and state-affiliated infrastructure, with observed operations spanning October 2025 through April 2026.

Unit 42 describes an intrusion set built around persistent access to Linux servers, credential collection, internal reconnaissance, database theft and mailbox targeting. The operators deployed web shells, custom malware, open-source utilities and reverse shells, while attempting to suppress endpoint protections and remove forensic evidence.

The researchers also identified conversational comments and developer-style reasoning notes embedded in several malicious scripts. Unit 42 assesses that these artifacts are consistent with code produced using large language models or deployed by an automated AI agent. That is an assessment about the development workflow, not proof that an autonomous system conducted the entire operation.

What Unit 42 observed

The campaign focused on Linux and database environments supporting government or state-affiliated organizations. The attackers used compromised web-facing infrastructure as a foothold, then expanded their access through PHP configuration changes, shell commands, database features, SSH and tunneling tools.

Unit 42 reported the deployment of multiple web shells, including both custom scripts and open-source shells. In one case, the attackers changed the PHP auto_prepend_file setting across configuration files under /etc/php/ and /opt/plesk/php/. This setting causes a selected PHP file to load before other PHP scripts, giving the attackers a durable execution mechanism. A malicious file named /usr/lib/php/plesk_sys_driver.php was used to appear compatible with legitimate system software.

This persistence method is particularly important for administrators because it can survive ordinary web-application cleanup. Removing an individual web shell may not be sufficient if PHP’s global configuration continues to load an attacker-controlled file.

Credential theft was layered into the intrusion

The operators did not rely on a single credential-collection method. Unit 42 observed changes to users’ .bashrc files, modifications to PHP login pages and searches for cleartext credentials in configuration and command-history files.

In one technique, the attackers replaced a .bashrc file and created a malicious alias for sudo. The alias displayed a password prompt designed to resemble normal system authentication, recorded the supplied password in an attacker-controlled log file, and then passed the password to the legitimate command. The log was named Solarwinds.StatusLog.txt to make it look legitimate. Unit 42 found no evidence that SolarWinds infrastructure was compromised; the name was used as a disguise.

In another case, malicious code was inserted into a PHP login page, apparently associated with database authentication. The added code captured administrator usernames and passwords. The attackers also searched files and command histories for email, SMTP and database credentials that had been stored in cleartext.

These observations support a defensive focus on shell initialization files, authentication code and secrets management—not only on malware files. Password prompts and login workflows should be treated as potential collection points when a host is suspected of compromise.

SysGoRAT provided cross-platform remote access

Unit 42 identified a custom Go malware family that it named SysGoRAT. The binary was first observed under the less suspicious name sys-control-client and was also renamed to filenames including pip2.7, ea_install and ./semanage.

The malware supports both Linux and Windows. Its documented functions include arbitrary command execution, directory listing, interactive shell access, TCP proxying and bidirectional proxy data transfer. It communicates with its operator over WebSocket. Unit 42 reported a hardcoded default address of 104.194.158[.]65:443, while noting that the operator can provide a different address at execution time.

SysGoRAT also contains several persistence options. On Linux, these include a systemd service and a cron entry configured to run at five-minute intervals. On Windows, the malware can use a registry Run key or a scheduled task. Its persistence routines use names intended to resemble legitimate software, and the malware can select a method based on the operating system and, in some cases, available permissions.

The malware’s control functions include interactive shell creation, file download and screen capture, according to Unit 42. These capabilities make the binary more than a simple command runner: it can support continued access, collection and movement of data after installation.

Reverse shells and internal movement

In addition to SysGoRAT, the operators used reverse shells that relied primarily on standard Linux utilities. Unit 42 observed named-pipe shells involving Netcat, Bash TCP redirects and Python subprocesses that connected an outbound socket to an interactive Bash process. The researchers identified activity involving at least seven command-and-control servers.

The campaign also used proxy and tunneling tools to reach internal systems. Reported tools included revsocks, pysoxy and GSocket components. A GSocket binary was stored in /dev/shm/.gs-10085/ and executed under the disguised process name [kcached]; another component used the name gs-dbus. Unit 42 said command-line parameters were passed through an environment variable and shell history was disabled for some sessions.

For lateral movement, the attackers used SSH with hardcoded administrative credentials and also established SSH persistence by adding a public key to a user’s authorized_keys file. They searched compromised systems for password hashes, WordPress configuration files, home directories and Git repositories.

Unit 42 further reported attempts to use database functionality to execute operating-system commands and to chain access through multiple SQL servers on different network segments. These findings underline the importance of treating database servers as execution and pivoting risks, not merely as repositories of application data.

Mailbox and data targeting

The campaign had a clear intelligence-collection component. The operators enumerated Qmail mailbox directories under /var/qmail/mailnames/, counted messages in selected Maildir locations and searched email headers for social-media-related terms. A PHP utility named search_social.php displayed message paths, senders, recipients and subjects to help identify relevant accounts.

The attackers then attempted to create a script called zip_mails.sh to compress mailbox contents. Unit 42 noted that this script contained syntax errors and would fail in the observed form. This is an important distinction: the research documents the intention and attempted preparation, but not successful exfiltration of every targeted mailbox.

Database collection followed a similar pattern. The operators first sampled data, then wrote selected tables to local files or SQLite databases, compressed the results and attempted to send them to external infrastructure. They also tried to use legitimate file-transfer services, including transfer[.]sh, bashupload[.]com, filebin[.]net and the catbox[.]moe API, to blend collection with ordinary web traffic.

Privilege escalation and vulnerability scanning

After gaining access to Linux servers, the attackers used LinPEAS to identify local privilege-escalation opportunities. Unit 42 also observed an attempt to use PwnKit, associated with CVE-2021-4034, to obtain root privileges.

The researchers identified several mechanisms intended to preserve privileged access, including a renamed Python interpreter, a custom SUID shell named .libsystemd-helper and a renamed Bash binary named .tourch with elevated execution permissions.

The operators also deployed a Go-based scanner for CVE-2025-55182, referred to in the report as React2Shell. The supplied research identifies the scanner and its target vulnerability, but does not establish that every scanned system was successfully exploited through it.

Anti-forensics and deceptive signals

Defense evasion was a recurring part of the campaign. The attackers attempted to terminate Cortex XDR-related processes using pgrep and pkill. Unit 42 reported that these attempts were detected and mitigated, and that endpoint protections were not suppressed in the observed cases.

Short-lived scripts were often written, executed and deleted in a single sequence. Longer-lived files were timestomped with touch -t. The operators also attempted to make their activity resemble an authorized red-team exercise, using markers such as RedTeamOps2025 and the password pentest123. These artifacts should not be treated as proof that a legitimate assessment occurred.

Finally, the attackers attempted to delete authentication, command-history, email, operating-system, web-server and PHP-session logs. They also checked whether traces of their external addresses had been removed. Such cleanup can create gaps in host telemetry, making centralized logging and write-protected collection essential.

What organizations should do now

• Review PHP configuration integrity. Compare auto_prepend_file values across PHP and Plesk configurations with an approved baseline, and investigate unexpected files loaded globally.
• Audit shell startup files. Examine .bashrc, profile files, aliases and authorized SSH keys for unauthorized changes. Pay particular attention to aliases for authentication or privilege-management commands.
• Protect credentials. Remove cleartext secrets from configuration files and command histories, rotate credentials exposed on affected systems, and review database, email, SMTP and administrator accounts.
• Monitor unusual interpreter behavior. Alert when PHP, Python, Bash or Netcat creates interactive shells, opens unexpected outbound connections or runs from unusual directories such as /tmp and /dev/shm.
• Inspect persistence locations. Review systemd units, cron entries, Windows Run keys, scheduled tasks and SUID files for new or disguised entries.
• Restrict outbound traffic. Use egress filtering to limit unauthorized WebSocket, SSH, Netcat and proxy connections. Monitor uploads to public file-transfer services from servers that do not normally use them.
• Centralize and preserve logs. Forward authentication, shell, web, PHP, database and endpoint telemetry to systems attackers cannot modify. Alert on attempts to clear history or terminate security agents.
• Validate patch exposure. Confirm whether Linux systems are vulnerable to CVE-2021-4034 and CVE-2025-55182 using trusted asset and patch-management data. Do not assume that the presence of the reported scanner proves exploitation.
• Scope suspected incidents broadly. Search for SysGoRAT filenames, the reported defanged indicators, unexpected database command execution, mailbox enumeration and outbound connections from internal servers. Preserve evidence before performing cleanup.

Conclusion

CL-UNK-1211 demonstrates the operational risk of combining web-shell persistence, credential interception, Linux-native reverse shells, custom remote-access malware and aggressive cleanup. Unit 42’s findings also suggest that AI-assisted code generation can help operators move between PHP, Bash, Python, JavaScript and Go without requiring a uniform tooling model.

The evidence does not establish a named nation-state or criminal group. Unit 42 classifies the activity as an unconfirmed cluster whose affiliation remains undetermined. For defenders, the practical lesson is clear: Linux servers, PHP control planes, databases, mail systems and identity stores must be monitored as one connected attack surface.

Sources

Palo Alto Networks Unit 42: AI-Powered Espionage Campaign Targets Government Linux Infrastructure

Selected indicators reported by Unit 42: 104.194.158[.]65; 45.88.188[.]140; 198.23.185[.]234; magento[.]ink; solidmonpe[.]com; wibu-bau-bawang[.]online; beraskencur[.]site. Organizations should validate these indicators against current telemetry and avoid treating them as exhaustive.