Hackers Use AI-Generated Scripts to Hijack Linux Sudo Commands and Steal Passwords
Unit 42 says CL-UNK-1211 used AI-assisted scripts to steal Linux sudo passwords from government targets.
Unit 42 tracks cluster CL-UNK-1211 for activity from October 2025 to April 2026 against government entities and state-affiliated infrastructure. Attackers replaced .bashrc with a sudo alias that captured passwords into Solarwinds.StatusLog.txt while still invoking legitimate sudo, and Unit 42 found no SolarWinds compromise. They also deployed web shells, a custom Go remote access Trojan named SysGoRAT, mailbox and credential searches, and log-clearing attempts. Several scripts contained comments consistent with AI-assisted code, and IoCs included scanners labeled for CVE-2025-55182.
76