AI-scripted campaign hit government Linux servers, Unit 42 says
Original title: Hackers Used AI-Generated Scripts to Break Into Government Linux Servers and Hunt for Secrets
Cluster CL-UNK-1211 used web shells, a sudo-password hook, and SysGoRAT while hunting databases and mailboxes.
Palo Alto Networks Unit 42 says operators used apparently AI-generated PHP and shell scripts against government Linux infrastructure between October 2025 and April 2026. The cluster, tracked as CL-UNK-1211, planted web shells, stole credentials, deployed the SysGoRAT remote access Trojan, and tried to collect databases and mail. Attribution is unresolved, and a broken mailbox-archive script does not prove those messages were stolen.
Unconfirmed: Unit 42 has not determined whether CL-UNK-1211 is state-sponsored or financially motivated, and mailbox theft is not confirmed.
- Activity ran from October 2025 through April 2026.
- SysGoRAT is a custom Go RAT for Linux and Windows.
- A modified .bashrc alias captured sudo passwords into Solarwinds.StatusLog.txt.
- Default WebSocket C2 was 104.194.158[.]65:443.
- zip_mails.sh had syntax errors, so mailbox theft is not shown.
Impact: Credential theft and attempts to take databases and mail
- 1.Restrict outbound connections and watch utilities that spawn interactive shells.
- 2.Investigate unauthorized PHP auto_prepend_file changes under /etc/php/ and /opt/plesk/php/.
- 3.Look for history-clearing and the published defanged IP and domain indicators.
- ATT&CK
- T1505.003 Web ShellT1546.004 Unix Shell Configuration ModificationT1070.006 TimestompT1059.004 Unix ShellT1071.001 Web Protocols
- Threat actors
- CL-UNK-1211
- Malware
- SysGoRAT
- Organizations
- Palo Alto NetworksUnit 42
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | beraskencur.site | ain solidmonpe[.]com Domain wibu-bau-bawang[.]online Domain beraskencur[.]site Note: IP addresses and domains are intentionally defanged |
| domain | magento.ink | P address 138.68.244[.]146 IP address 185.21.136[.]6 Domain magento[.]ink Domain solidmonpe[.]com Domain wibu-bau-bawang[.]online D |
| domain | solidmonpe.com | .]146 IP address 185.21.136[.]6 Domain magento[.]ink Domain solidmonpe[.]com Domain wibu-bau-bawang[.]online Domain beraskencur[.]site |
| domain | wibu-bau-bawang.online | 136[.]6 Domain magento[.]ink Domain solidmonpe[.]com Domain wibu-bau-bawang[.]online Domain beraskencur[.]site Note: IP addresses and domains |
| ipv4 | 104.194.158.65 | . Its WebSocket command-and-control connection defaulted to 104.194.158[.]65:443 , although operators could override the address. Capa |
| ipv4 | 138.68.244.146 | ress 45.88.188[.]140 IP address 198.23.185[.]234 IP address 138.68.244[.]146 IP address 185.21.136[.]6 Domain magento[.]ink Domain sol |
| ipv4 | 185.21.136.6 | ess 198.23.185[.]234 IP address 138.68.244[.]146 IP address 185.21.136[.]6 Domain magento[.]ink Domain solidmonpe[.]com Domain wibu- |
| ipv4 | 198.23.185.234 | romise Type Indicator IP address 45.88.188[.]140 IP address 198.23.185[.]234 IP address 138.68.244[.]146 IP address 185.21.136[.]6 Dom |
| ipv4 | 45.88.188.140 | tabases. Indicators of Compromise Type Indicator IP address 45.88.188[.]140 IP address 198.23.185[.]234 IP address 138.68.244[.]146 I |
From the original article
3 min read at gbhackers.com
Hackers used apparently AI-generated scripts to compromise government Linux infrastructure, harvest credentials and pursue sensitive databases and official mailboxes in a campaign tracked as CL-UNK-1211. The investigation, published October 15, linked the operation to government entities and state-affiliated infrastructure.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.