Key points
- Attackers used conversational annotations in malicious scripts, suggesting AI assistance during the intrusion.
- Operators deployed custom malware and modified system files to maintain persistent access to compromised servers.
- Credential theft involved intercepting sudo authentication and searching for database and email passwords.
Government entities and state-affiliated infrastructure were targeted by hackers who compromised Linux servers between October 2025 and April 2026, according to a report published on 15 October by Palo Alto Networks Unit 42. The campaign, tracked as CL-UNK-1211, involved the theft of credentials and the pursuit of sensitive databases and official mailboxes.
The attackers used malicious PHP and shell scripts containing conversational annotations that explained their logic step by step, indicating potential AI assistance. While the evidence suggests AI tools helped generate the code, researchers did not establish whether the execution was fully autonomous. The operators moved between multiple programming languages, including PHP, JavaScript, Bash and Python, throughout the intrusion.
Technical Tactics and Persistence
Unit 42 observed that the intruders deployed custom and publicly available web shells to maintain access. They modified PHP configuration files beneath /etc/php/ and /opt/plesk/php/ directories to change the auto_prepend_file setting. This allowed malicious code to execute before other legitimate PHP scripts ran. One implant, named /usr/lib/php/plesk_sys_driver.php, used a system-like filename to appear legitimate and avoid detection.
For credential theft, the operators replaced the .bashrc file with a modified version that intercepted sudo authentication. A malicious alias captured passwords before forwarding them to the legitimate command, preserving normal execution flow. Stolen credentials were recorded in Solarwinds.StatusLog.txt, although investigators found no evidence that SolarWinds infrastructure itself was compromised.
Who Is Affected
The investigation linked the operation to government entities and state-affiliated infrastructure, but attribution remains unresolved. Under Unit 42’s framework, the UNK designation means researchers have not determined whether the activity belongs to a state-sponsored or financially motivated group. The toolkit included SysGoRAT, a custom Go remote access Trojan supporting both Linux and Windows systems. Its WebSocket command-and-control connection defaulted to 104.194.158[.]65:443, though operators could override this address.
Our take on the response
The use of conversational comments in malware is a significant indicator of AI-assisted development. These annotations help operators understand the code logic, reducing the barrier to entry for sophisticated intrusions. Security teams should monitor for unusual script annotations and unexpected modifications to PHP configuration files. The presence of Base64-encoded commands and multiple programming languages further supports the assessment of automated or AI-generated code.
What affected people can do
Teams should review server logs for unexpected modifications to configuration files, particularly in PHP directories. Check for unusual aliases or changes to shell startup scripts that might intercept authentication. Monitor for outbound connections to unknown IP addresses on standard ports. Verify the integrity of system binaries and web shells. Be alert for phishing emails that reference this breach to trick staff into revealing further credentials. Regularly audit user permissions and ensure sudo logs are securely stored.
What to do and how to stay safe: Palo Alto Networks
- Inspect web server directories for unauthorized PHP files or modifications to auto_prepend_file settings.
- Review shell history and startup scripts for aliases that capture or redirect authentication data.
- Monitor network traffic for connections to known command-and-control IP addresses or unusual WebSocket activity.
- Verify the integrity of critical system binaries and check for the presence of the SysGoRAT Trojan.
General security guidance from the Breach Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CL-UNK-1211?
CL-UNK-1211 is the tracking designation for a campaign where hackers used AI-generated scripts to compromise government Linux servers and steal credentials.
Was SolarWinds compromised in this attack?
No, investigators found stolen credentials recorded in a file named Solarwinds.StatusLog.txt, but there was no evidence that SolarWinds infrastructure was compromised.
What malware was used in the intrusion?
The attackers used SysGoRAT, a custom Go remote access Trojan, along with modified PHP scripts and web shells to maintain access and steal data.