Unit 42 (15 Oct): CL-UNK-1211 AI-assisted espionage against government Linux hosts — PHP/Plesk web shells, SysGoRAT, mailbox and database theft (Oct 2025–Apr 2026)
Palo Alto Networks Unit 42 published on 15 October 2026 an investigation into CL-UNK-1211, a still-unattributed cluster that targeted government entities and state-affiliated infrastructure from October 2025 through April 2026. Operators focused on Linux environments for reconnaissance and long-term access, attempting to dump databases and exfiltrate government mailboxes to reach linked social-media accounts. Initial access used custom and open-source PHP web shells, including persistence by rewriting auto_prepend_file under /etc/php/ and /opt/plesk/php/ (one implant posed as /usr/lib/php/plesk_sys_driver.php). Credential theft included a malicious sudo alias in .bashrc that logged passwords to a SolarWinds-named file, PHP login-page hooks, and searches of configs and shell history. A custom Go RAT Unit 42 names SysGoRAT (first seen as sys-control-client) talks over WebSocket to a hardcoded C2 (104.194.158.65:443 by default) with seven command types. Operators also used LinPEAS, PwnKit (CVE-2021-4034), a React2Shell (CVE-2025-55182) scanner, log wiping, endpoint-protection disablement, and red-team decoys (e.g. RedTeamOps2025). Multiple scripts carried conversational LLM-style reasoning comments, which Unit 42 takes as evidence of AI-generated or AI-agent-driven payloads. No individual victim country is named in the public report. Primary: Unit 42.
- Product
- Linux servers (PHP / Plesk hosting stacks); SysGoRAT custom Go implant
- Versions
- n/a — campaign / malware family (activity window Oct 2025–Apr 2026 per Unit 42)
- Exploited in Australia?
- unknown
- Patch to
- Hunt for unexpected auto_prepend_file changes under /etc/php/ and /opt/plesk/php/, plesk_sys_driver.php-style web shells, sudo aliases or .bashrc hooks that log credentials, and outbound WebSocket to 104.194.158.65:443. Review mailbox and database exfil paths, ensure EDR cannot be silently disabled, and keep privilege-escalation packages such as PwnKit and React2Shell scanners out of production images. Unit 42 IoCs and Cortex detections are in the report.
Primary: Unit 42 — AI-powered espionage campaign targets government Linux infrastructure (CL-UNK-1211 / SysGoRAT, 15 Oct 2026) · Vendor: Palo Alto Networks Unit 42 (primary research) · CVE: CVE-2021-4034, CVE-2025-55182 · Talkback — Unit 42 CL-UNK-1211 listing