Unit 42 links suspected AI-generated scripts to SysGoRAT campaign against government Linux servers

Palo Alto Networks Unit 42 observed a cyber espionage campaign aimed at Linux infrastructure connected to government entities and state-affiliated infrastructure from October 2025 through April 2026, tracking the activity as CL-UNK-1211. Roey Porat and Tom Fakterman said the attackers concentrated on Linux environments for extensive reconnaissance and persistent network access. The campaign deployed SysGoRAT, a custom Go-based remote access trojan built for multiple platforms that first appeared under the file name sys-control-client.

SysGoRAT accepts seven command types, including command execution, interactive shell access, file theft, directory listings, screenshots, persistence setup, and proxying. It connects to its command-and-control server over WebSocket at the hard-coded address 104.194.158[.]65:443, and Unit 42 said operators can change the default address through a command-line parameter when the malware runs. Attackers gave the SysGoRAT binary benign names such as sys-control-client, pip2.7, ea_install and ./semanage.

Files used in the breach contained AI-style conversational notes along with developer reasoning comments inside the code during the October 2025–April 2026 campaign. Unit 42 listed characteristics consistent with AI-operated attacks, including Base64-encoded commands and movement between PHP, JavaScript, Bash and Python. Suspected AI use does not identify the AI system involved or prove that the operation was fully automated.

Attackers swapped .bashrc for a malicious sudo alias that records passwords and writes them to SolarWinds.StatusLog.txt. Unit 42 found no sign that attackers compromised SolarWinds systems or infrastructure. Attackers added code to PHP login pages to collect administrator usernames and passwords and send them to an attackers’ log file, and they searched configuration files and command histories for cleartext e-mail, SMTP and database credentials.

Attackers checked /var/qmail/mailnames/ directories to count messages in particular users’ Maildir/cur/ directories to identify targets, and they used search_social.php to search e-mail headers for social media keywords and show file paths, senders, recipients and subjects. “The attackers attempted to dump sensitive databases and exfiltrate government mailboxes to access social media accounts,” Roey Porat and Tom Fakterman said.

Attackers changed PHP auto_prepend_file settings under /etc/php/ and under /opt/plesk/php/, so a malicious web shell loads before other scripts, and placed a shell at /usr/lib/php/plesk_sys_driver.php to appear legitimate. Unit 42 said the file mimicked a legitimate Plesk web hosting component and loaded via the modified auto_prepend_file value. The intruders relied on custom web shells and publicly available shells from GitHub to maintain lasting access.

During the October 2025–April 2026 campaign, attackers ran in-memory reverse shells through at least seven command-and-control servers to avoid leaving disk artifacts. The methods included Netcat named pipes on three C2 servers, Bash TCP redirects alongside Python subprocesses. Attackers used timestomping, running touch -t, to alter file timestamps so malicious files seemed older than the attack, and they deleted authentication, command history, e-mail, operating system, web server and PHP session logs before checking whether system logs still contained their IP addresses.

Attackers placed deceptive markers of a red-team operation, including RedTeamOps2025 in a script and pentest123 as a user password, which Unit 42 said intended to disguise activity as a legitimate security assessment or red-team operation. They tried to create zip_mails.sh to compress e-mails into ZIP archives, but syntax errors made it fail when executed. Attackers deleted single-use scripts after running them and removed temporary files from /tmp/.

Attackers tried to stop Cortex XDR-related processes with pgrep and pkill, and Cortex XDR detected and blocked the attempts. Unit 42 said telemetry confirmed endpoint protections were not suppressed, and the report concluded that endpoint controls neutralized the activity despite log deletion and protection-disabling efforts.

Unit 42 ran the Cortex Agentic Assistant, powered by Cortex AgentiX, to streamline its investigation, and Palo Alto Networks shared CL-UNK-1211 findings with members of the Cyber Threat Alliance. Unit 42 said alliance members use the intelligence to deploy protections and disrupt malicious actors.

The Hacker News and thedailytechfeed.com reported that Google Threat Intelligence Group, Mandiant, and Microsoft documented threat actor abuse of agentic frameworks including ARTEX, PentAGI, Hexstrike and CAIRN. Storm-0940, also tracked as UNC7228, used ARTEX in data theft campaigns hitting U.S. and European targets in enterprise software and industrial automation, semiconductors, and telecommunications. Financially motivated actors have used ARTEX for data-theft extortion against Asia’s financial sector.

SecNews.gr said AI-generated code may include errors, repeated structures and revealing comments that give defenders detection opportunities. Government Linux servers frequently operate with fewer endpoint protections than Windows workstations, which creates a strategic blind spot, Hamer Intelligence Services said. Compromised government e-mail servers can expose sensitive negotiations, early legislation drafts, internal assessments and contact lists.

Which government organizations were targeted and how far the intrusions reached are not established, and the reporting does not show that data was successfully exfiltrated. Unit 42 uses UNK for activity clusters with undetermined ties to nation-state or cybercrime groups. “We designate the term UNK to clusters of activity whose affiliation with either nation-state or cybercrime activity we have not yet determined,” Unit 42 said.