AI-Assisted Hackers Compromise Government Linux Servers to Deploy Backdoors and Steal Credentials

Hackers used AI-assisted scripts to compromise government Linux servers, harvest administrator credentials, and establish persistent backdoors during a campaign observed between October 2025 and April 2026.

The cluster remains unattributed. Under Unit 42’s attribution framework, “UNK” indicates that researchers have not determined whether the activity is state-sponsored or financially motivated.

Its intelligence-gathering behavior does not establish a nation-state connection.

Researchers found conversational annotations and step-by-step developer reasoning inside malicious PHP and shell scripts.

These artifacts suggest that operators copied large language model output directly into payloads or used an automated AI agent.

Base64-encoded commands, structured section headings and switching between PHP, JavaScript, Bash and Python supported the assessment, although they do not independently prove autonomous operation.

AI assistance did not guarantee functional code. A mailbox-collection script, zip_mails.sh, contained malformed variable assignment syntax and would have failed during execution.

This distinction limits claims about successful email theft or fully automated intrusion.

The attackers deployed custom and publicly available web shells, then modified PHP’s auto_prepend_file setting across configurations beneath /etc/php/ and /opt/plesk/php/.

This forced a designated malicious file to execute before other PHP scripts, extending persistence across hosted applications. One implant masqueraded as /usr/lib/php/plesk_sys_driver.php.

Palo Alto Networks’ Unit 42 tracks the activity as CL-UNK-1211, documenting reconnaissance, database dumping, and attempts to steal government emails associated with social media accounts.

Linux Servers Compromised

Credential theft included a modified .bashrc file that aliased sudo, displayed a convincing password prompt and recorded the supplied secret before forwarding it to legitimate sudo execution.

The credential log, Solarwinds.StatusLog.txt, impersonated routine software activity; researchers found no evidence that SolarWinds infrastructure was compromised.

Additional PHP login-page modifications captured administrator credentials.

Operators also searched configuration files and command histories for exposed SMTP, email and database passwords, expanding opportunities for lateral movement.

The toolkit included SysGoRAT, a custom Go-based remote access Trojan supporting Linux and Windows.

It communicated through WebSockets, defaulting to 104.194.158[.]65:443, and provided command execution, directory enumeration, interactive shells and TCP proxying.

Persistence options included Linux systemd services and cron, alongside Windows registry entries and scheduled tasks.

Operators disguised binaries as sys-control-client, pip2.7, ea_install and semanage. They also deployed predominantly memory-resident reverse shells using Netcat, Bash and Python across at least seven command-and-control servers, reducing disk artifacts.

Attackers enumerated /var/qmail/mailnames/ and used search_social.php to locate social-media-related messages.

They also dumped database contents into local archives before attempting exfiltration through attacker infrastructure and legitimate file-hosting services. The report distinguishes these attempts from confirmed successful transfers.

Cleanup activity targeted authentication, mail, operating-system and web-server logs. Operators deleted temporary scripts, backdated file access and modification times, and planted RedTeamOps2025 and pentest123 markers to resemble authorized testing.

Timestamp manipulation aligns with MITRE ATT&CK’s Timestomp technique, T1070.006. Unit 42. attack blocked attempts to terminate Cortex XDR processes.

For defenders, the findings prioritize monitoring PHP configuration changes, unexpected sudo aliases, suspicious service creation and outbound shell connections.

Unit 42 recommends strict outbound firewall controls and behavioral endpoint detection, particularly when standard Linux utilities spawn interactive shells.

Its published indicators and technical appendices provide additional infrastructure, persistence and lateral-movement details for investigation and threat hunting across affected environments.

IOCs

Type	Indicator
IP address	45.88.188[.]140
IP address	198.23.185[.]234
IP address	138.68.244[.]146
Domain	magento[.]ink
Domain	solidmonpe[.]com
Domain	wibu-bau-bawang[.]online

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.