AI-Powered Espionage Campaign Targets Government Linux Infrastructure

Executive Summary

Unit 42 identified a campaign targeting government entities and state-affiliated infrastructure, with observed activity spanning from October 2025–April 2026. We track this activity as CL-UNK-1211.

In the operations we witnessed, the attackers relied on AI-generated payloads. Multiple artifacts deployed throughout the intrusion contained AI-made conversational annotations and developer reasoning comments, suggesting that the code was either generated using large language models (LLMs) or executed by an automated AI agent.

The attackers behind this cluster of activity focused on Linux environments to conduct extensive reconnaissance and maintain persistent network access to support intelligence-gathering. The attackers attempted to dump sensitive databases and exfiltrate government mailboxes to access social media accounts.

The campaign included a diverse toolkit that combined open-source tools, custom cross-platform backdoors and widespread web shell deployments. We observed various defense evasion techniques, including attempts to disable endpoint protections, erase system logs and plant deceptive red-team markers to disguise activity as a legitimate security assessment.

Our attribution of this activity to CL-UNK-1211 is in accordance with the Unit 42 attribution framework. We designate the term UNK to clusters of activity whose affiliation with either nation-state or cybercrime activity we have not yet determined.

This investigation uncovers the defining tools, techniques and attack patterns of this activity cluster.

Palo Alto Networks customers are better protected from the threats discussed above through the following products and services:

• Advanced WildFire
• Advanced URL Filtering, Advanced DNS Security and Advanced IP Defense
• Cortex XDR Analytics Engine
• Cortex XDR and XSIAM
• Cortex Cloud

The Unit 42 AI Security Assessment and Unit 42 Frontier AI Defense service can help identify and mitigate complex AI-enabled risks.

If you think you might have been compromised or have an urgent matter, contact the Unit 42 Incident Response team.

Technical Analysis Overview

Our analysis of the CL-UNK-1211 cluster of activity reveals a versatile operational playbook tailored to enterprise Linux and database environments. The attackers targeted government entities and state-affiliated infrastructure, maintaining persistent access by using a combination of custom cross-platform backdoors, open-source utilities and widespread web shell deployments.

The attackers enumerated mailboxes to identify and gain access to social media accounts tied to government email addresses. In addition, they dumped entire database contents before attempting to exfiltrate the data.

The attackers behind CL-UNK-1211 exhibited a methodical approach to defense evasion. This included attempting to disable endpoint protections on compromised systems, and to tamper with system logs that might contain evidence of the attack.

We provide a comprehensive analysis of the defining tools, techniques and procedures (TTPs) used throughout the operation, highlighting how the attackers leveraged AI to streamline payload creation across their execution workflow. Our analysis details key mechanisms across the attack chain. These include:

• Initial access via web shell deployment and credential harvesting
• Custom RAT execution
• Mailbox targeting
• Anti-forensics measures

Using AI to Streamline Payload Creation

Throughout the operation, the attackers relied on malicious PHP and shell scripts to maintain persistence, perform reconnaissance and exfiltrate data. These payloads revealed structural patterns and artifacts consistent with AI-assisted code generation.

Rather than standard developer documentation, multiple scripts contained conversational, step-by-step reasoning notes. These notes explained the code’s logic to the operator who provided the initial instructions. Their presence suggests that the code was either copied directly from an AI prompt output or deployed by an automated AI agent.

In addition, we identified several common characteristics that are consistent with AI-operated attacks, such as:

• Section headers in scripts and shell commands, which AI uses to analyze the output faster
• Extensive use of Base64-encoded commands
• Seamless switching between different technologies throughout the attack, including PHP, JavaScript, Bash and Python

Figure 1 shows snippets of code from scripts used by the attackers that contained AI-generated comments.

Dropping Multiple Web Shells for Initial Access

To gain access and maintain a persistent backdoor into the host networks, the attackers deployed a variety of web shells on the targeted Linux servers. These were a combination of custom and open-source web shells found on GitHub. Figure 2 shows interactive web shell activity from the php-fpm parent process.

To achieve persistence, the attackers modified the auto_prepend_file value across all PHP configurations under the directories /etc/php/ and /opt/plesk/php/. These directories store all default PHP configuration files and Plesk (web hosting control panel) configuration files. Any file that is specified in the modified auto_prepend_file value will automatically load and execute before any other PHP script runs.

In one instance, the attackers deployed a malicious PHP web shell as a file named /usr/lib/php/plesk_sys_driver.php to appear legitimate. They also modified the auto_prepend_file to load the malicious web shell to ensure persistence. Figure 3 shows the attacker-deployed PHP script, including the original inline comments.

Credential Harvesting Techniques

The attackers used multiple methods to gather credentials in the targeted environments, including:

• Editing the .bashrc file
• Inserting malicious lines of code into PHP scripts
• Scanning the network for cleartext passwords

Hijacked .bashrc File

The attackers replaced the .bashrc file with a copy containing a malicious command that steals victims’ passwords. In one instance, they created an alias for the sudo command that was designed to execute each time a user attempted to run it. The malicious command:

• Displays a prompt for the user to insert their password (mimicking the standard system authentication prompt)
• Captures the inserted password
• Writes it to the attackers’ log file

The harvested password is then passed to the legitimate sudo command for execution, leaving the victim unaware of the underlying interception. The attackers named the log file Solarwinds.StatusLog.txt, to mimic legitimate SolarWinds activity in the environment. We have no evidence of SolarWinds systems and infrastructure being compromised during this operation; the attackers misused the organization’s name as an evasion method.

Figure 4 shows the command hijacking technique inside the .bashrc file.

PHP Credential Logger

The attackers inserted a line of code into a PHP login page — most likely targeting a database authentication routine — to harvest admin credentials. If an administrator logs in, the code forwards the username and password to the attackers’ log file. Figure 5 shows a snippet of a PHP script including the code added by the attackers.

Scanning for Cleartext Passwords

The attackers searched for email, SMTP and database passwords inside configuration files and command history files. Figure 6 shows an example of commands that the attackers used to search for cleartext passwords.

SysGoRAT Malware

The attackers deployed a custom-developed, multi-platform remote access Trojan (RAT) written in Go, first observed under the benign file name sys-control-client. We named this malware SysGoRAT. This malware supports cross-platform execution on Windows and Linux and employs multiple persistence methods to maintain long-term access.

The malware established a command and control (C2) connection over WebSocket to wss://<addr>/ws. This WebSocket address defaults to a hardcoded IP address 104.194.158[.]65:443, which the malware operator can modify via a command-line parameter at execution. SysGoRAT supports a fixed set of seven command types, described in Table 1.

Action	Behavior
command	Executes arbitrary commands via /bin/sh -c (Linux) or cmd /C (Windows)
control	Dispatches one of four sub-actions (see Control Sub-Actions in Appendix A)
list_dir	Lists directory content
shell_input	Creates an interactive shell session
proxy_connect	Establishes a TCP connection to an arbitrary target
proxy_data	Relays data bidirectionally to an established proxy connection
proxy_close	Terminates and removes a proxy session

Table 1. SysGoRAT command types.

The malware’s sub-actions provide additional capabilities and persistence methods, detailed in Appendix A.

The attackers renamed the binary on disk to blend in, using different benign names on targeted endpoints, including:

• sys-control-client
• pip2.7
• ea_install
• ./semanage

In-Memory Reverse Shells

The attackers employed multiple reverse shell techniques across at least seven distinct C2 servers. To avoid leaving forensic artifacts on the disk, these shells operated almost entirely in memory using built-in system utilities:

• Named pipe via Netcat: The primary method, deployed across three separate C2 servers, used a named pipe pattern to execute bash commands directly over a network socket.

• Bash TCP redirects: The attackers redirected the output of bash commands to an attacker-controlled external IP address.

• Python subprocesses: The attackers ran a Python script to spawn a remote interactive shell. They achieved this by opening an outbound network socket and binding it to a /bin/bash process, giving them an accessible command-line interface.

Organizations can defend against reverse shell techniques by enforcing strict outbound firewall rules and using endpoint detection to spot standard utilities that spawn interactive shells. Figure 7 shows the reverse shell command that Cortex XDR detected and prevented.

Targeting Mailboxes for Social Media Account Access

The attackers targeted official government mail servers to steal emails and facilitate access to external social media accounts.

In this operation, the attackers enumerated the /var/qmail/mailnames/ directories for several domains and counted the number of emails stored in specific users’ Maildir/cur/ directories to identify targets.

Next, the attackers searched for social media-related emails. They deployed a PHP script, named search_social.php, that searched for specific keywords in email headers and displayed the results in a user-friendly format. Figure 8 shows the first part of the script.

The script then parsed the response and displayed the exact file path, social media account email sender, recipient and subject.

Figure 9 demonstrates the expected output.

After identifying the specific emails they wanted to exfiltrate, the attackers attempted to generate a bash script named zip_mails.sh that would iterate through users’ directories and compress their emails into ZIP archives. Figure 10 shows this command.

This bash script is intended to exfiltrate an entire mailbox rather than a specific social-media-related file identified by the previously analyzed script. In this particular instance, we found that the script contained syntax errors, such as a broken variable assignment user=\;) and would fail upon execution.

We found indications that the attackers also intended to exfiltrate multiple databases and steal highly sensitive government data. The data exfiltration techniques the attackers used are detailed in Appendix B.

Defense Evasion and Anti-Forensics Attempts

A core component of the attackers’ playbook involved anti-forensics techniques, specifically:

• Attempting to disable endpoint protections
• Tampering with logs
• Timestomping
• Disguising malicious activity
• Deleting residual artifacts to hinder post-incident analysis

This section details the specific evasion techniques and cleanup commands the attackers used to cover their tracks.

Disabling Endpoint Protection

One of the techniques the attackers used for defense evasion was an attempt to disable security protection devices on the compromised hosts. As Figure 11 shows, the attackers executed bash scripts that use the Linux commands pgrep and pkill to attempt to terminate Cortex XDR-related processes on infected systems.

These attempts were successfully detected and mitigated by Cortex XDR, with telemetry confirming that endpoint protections were not suppressed.

Removing Scripts After Execution

Throughout the campaign, the attackers ensured that single-use scripts were removed after execution by formulating a single command that:

• Wrote the script to disk
• Executed the script
• Removed the script using rm

Figure 12 shows an example of this procedure as executed by the attackers.

Timestomping

For scripts that were meant for long-term use, the attackers used timestomping.

They used the command touch -t to change the access and modification time of malicious files, to make them appear as if they were created long before the attack started. The goal of this technique is to evade analysis by misleading analysts into believing the file is unrelated to malicious activity, due to its creation time predating the attack timeline.

Disguising Activity as Red Team Operations

In several instances, we observed the attackers employing planted deception techniques to mislead post-incident analysis. They attempted to disguise their activity as a red team operation, by using operational indicators such as the key RedTeamOps2025 in one of the malicious scripts, and pentest123 as a password for a user the attackers created.

Cleaning Up Logs and Residual Files

Following the exfiltration attempts, the attackers initiated a full cleanup of log files and malicious residual files on the systems. This cleanup included attempts to delete logs related to:

• Authentication
• Command history
• Email activity
• Operating system (OS)
• Web server
• Active PHP user sessions

Figure 13 shows the execution of shell commands to delete various log files from the system.

Following the mass log deletion, the attackers executed several automated cleanup commands and scripts, and verified that any evidence of the exfiltration was deleted.

Figure 14 shows one of the attackers’ cleanup scripts, including the original inline comments. The script attempts to delete various logs across the system for a second time and to remove any files from /tmp/, where the attackers stored malicious scripts.

After the cleanup phase, the attackers attempted to verify the removal of evidence, checking whether IP addresses they used were removed from system log files, as Figure 15 shows.

Additional commonly used TTPs that the attackers leveraged throughout the campaign are detailed in Appendix B.

Conclusion

This campaign demonstrates how attackers are combining traditional post-exploitation techniques with AI-accelerated workflows to target governmental Linux server infrastructure. By leveraging AI to rapidly generate, adapt and deploy operational scripts, the attackers behind CL-UNK-1211 maintained a fast pace of operation while minimizing manual developer overhead.

The attackers behind this activity exhibited a deep understanding of the Linux OS, employing techniques such as:

• Global PHP configuration hijacking for persistent access
• Command-line credential harvesting and privilege escalation using different shells

Alongside open-source utilities, their toolkit featured custom tools, including a multi-platform Go RAT and custom vulnerability scanners.

The attackers also maintained a thorough cleanup strategy to thwart forensic analysis, by erasing system logs and attempting to disable endpoint protections. Despite these evasion efforts, endpoint security controls effectively neutralized their activity. Cortex XDR detected and prevented the process termination attempts targeting the agent.

Attackers continue to adopt AI to streamline payload development and scale their campaigns.

Comprehensive visibility into Linux servers, databases and environments remains critical to countering attackers’ efforts and strengthening enterprise security.

Palo Alto Networks Protection and Mitigation

We used the Cortex Agentic Assistant, powered by Cortex AgentiX, to streamline this investigation. The Assistant enabled the team to query the data using natural language, providing deeper context and insights, and suggesting clear recommendations for what researchers should do next. Figures 16 and 17 show examples of output from Cortex AgentiX.

Palo Alto Networks customers are better protected from the threats discussed above through the following products and services:

Advanced WildFire

The Advanced WildFire machine-learning models, analysis techniques and detection rules have been reviewed and updated in light of the indicators shared in this research.

Advanced URL Filtering and Advanced DNS Security

Advanced URL Filtering, Advanced DNS Security and Advanced IP Defense are designed to identify known domains and URLs associated with this activity as malicious.

Cortex

Cortex XDR Analytics Engine enhances behavioral detection for Linux through specialized mechanisms:

• Uncommon attempt to clear shell history: This detector identifies attempts to manipulate or erase shell history files, highlighting defense evasion activity as part of the EDR Linux Evasion suite to reveal uncommon attempts to evade defenses, impair security controls, and erase traces of malicious activity. Figure 18 displays an “Uncommon attempt to clear shell history” alert that CL-UNK-1211 activity triggered.

Cortex XDR and XSIAM are designed to prevent the threats described in this article, by employing the Malware Prevention Engine. This approach combines several layers of protection, including Advanced WildFire, Behavioral Threat Protection and the Local Analysis module, to prevent both known and unknown malware from causing harm to endpoints.

Cortex Cloud is designed to help protect cloud posture and runtime operations against identity-driven threats by pairing static permission baselines with deep behavioral context. By embedding the functional identity baselines discussed in this research into our detection engine for both cloud VM compute and serverless agents, Cortex Cloud adds a vital layer of operational context, enabling security teams to filter out noisy false positives and decisively catch threat actors attempting to masquerade, alter configurations, or execute anomalous operations in the environment.

The Unit 42 AI Security Assessment and Unit 42 Frontier AI Defense service can help identify and mitigate complex AI-enabled risks.

If you think you may have been compromised or have an urgent matter, get in touch with the Unit 42 Incident Response team or call:

• North America: Toll Free: +1 (866) 486-4842 (866.4.UNIT42)
• UK: +44.20.3743.3660
• Europe and Middle East: +31.20.299.3130
• Asia: +65.6983.8730
• Japan: +81.50.1790.0200
• Australia: +61.2.4062.7950
• India: 000 800 050 45107
• South Korea: +82.080.467.8774

Palo Alto Networks has shared these findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the Cyber Threat Alliance.

Indicators of Compromise

SHA-256 Hashes

CVE-2025-55182 (React2Shell) vulnerability scanner

• 2bf7992e6260c1a98c709fa98ec766fb9f27692f338b30b43ac821b824fd849e
• 27d799ceadb570bfca890d4c2572314afe57eecf14083d30409da15afdfc4704
• d73186cea6cf2cf3d48c09139a9d15521365aab675787b4e7a6f81767331c9fd
• 9e45830171eb607cf2c0fc80f5cc9cc3db39bb937032136990383a595f6f151e

Custom shell backdoor for privilege escalation

• c527b94e3d21824a674face4cd9d862e536b60ccbf54573839e3360f99188343

GSocket reverse shell

• d94f75a70b5cabaf786ac57177ed841732e62bdcc9a29e06e5b41d9be567bcfa

CVE-2021-4034 (PwnKit binary)

• 44e83f84a5d5219e2f7c3cf1e4f02489cae81361227f46946abe4b8d8245b879

PHP web shells

• 1505a3a727f8899b2ad343519f7bf9c438b8b802f8d6b854f5db3b52f857c76a
• 76c58fad4f70cf277a15a499b9a2151ac60e7a6b5c7a9ab684843dcc19f0d0a5
• b1e82c6b0caea177e8bb71ad826867f509c65f0a43a651b50253e7c726566eac

IP Addresses

• 45.88.188[.]140
• 198.23.185[.]234
• 138.68.244[.]146
• 185.21.136[.]6
• 72.61.89[.]179
• 104.194.158[.]65
• 109.224.53[.]140
• 162.243.175[.]162
• 154.93.37[.]228
• 141.164.58[.]87
• 88.80.150[.]232
• 88.119.167[.]57
• 173.212.247[.]23
• 104.248.131[.]53
• 147.182.224[.]216
• 93.93.112[.]57
• 192.210.183[.]17

Domains

• magento[.]ink
• solidmonpe[.]com
• wibu-bau-bawang[.]online
• beraskencur[.]site

Appendix A: SysGoRAT Sub-Actions

First observed as sys-control-client, SysGoRAT is a custom RAT developed by the attackers. The SysGoRAT malware had seven available command types, each with additional control sub-actions.

Control Sub-Actions

When the C2 server sends a control message, SysGoRAT triggers one of four specific operational actions.

Action	Behavior
shell_start	Spawns an interactive /bin/bash process
screenshot	Captures the current display as an image and returns it to the C2
download	Reads a specified file, optionally compresses it with gzip, and exfiltrates it to the C2
persist	Installs persistence using one of six supported methods (see next table)

Table 2. SysGoRAT control sub-actions.

Persist Sub-Actions

The persist action, triggered by the malware’s control message, supports six different installation methods for cross-platform environments. All methods use artifact names designed to masquerade as legitimate software.

Method	Operating System	Behavior
systemd	Linux	The malware copies itself to /usr/local/bin/; writes a unit (service) file to /etc/systemd/system/sys-update.service; reloads and enables the service
cron	Linux	Creates a crontab entry with a five-minute execution interval
registry	Windows	The malware copies itself to %APPDATA%\Onedrive Update\Updater.exe and adds a Run key to HKCU
schtasks	Windows	Creates a daily scheduled task named Onedrive
complex	Linux/Windows	Automatically selects the optimal method based on the detected OS without checking user permissions
auto	Linux/Windows	Automatically selects the optimal method based on the detected OS and user permissions

Table 3. SysGoRAT persist sub-actions.

Appendix B: Analysis of Additional CL-UNK-1211 TTPs

The following section provides an analysis of additional TTPs associated with the CL-UNK-1211 activity cluster. The TTPs described in this appendix are more common in the broader threat landscape than those discussed previously.

​​Privilege Escalation Using Open Source Tools

After gaining access to Linux servers, the attackers escalated their privileges. They started by deploying and executing an open-source tool called LinPEAS to check for local privilege escalation paths. Next, they used another open-source tool — PwnKit, a self-contained exploit for CVE-2021-4034 — in an attempt to gain root privileges on the system.

Once the attackers obtained root privileges, they deployed various binaries with the goal of maintaining root access:

• A renamed legitimate Python 3 interpreter:
  The attackers used the Python 3 interpreter and renamed it to .libpython-helper to execute shell commands with high privileges. They achieved this by using the Python commands os.setuid(0) and os.setgid(0), which set root privileges for the shell.Following is an example of a command used:
  

  1 2	/usr/lib/x86_64-linux-gnu/.libpython-helper-cimport os; os.setuid(0);os.setgid(0);os.system("<command>")

• Custom SUID root shell: This backdoor is dropped with the name .libsystemd-helper, and elevates itself to root privileges. It executes arbitrary shell commands via /bin/sh by running setuid with an argument of zero, followed by setgid with an argument of zero.
• A renamed legitimate /bin/bash binary: The attackers wrote to disk a file named .tourch and modified its permissions using the command chmod u+s, allowing any user to execute commands as the file owner — which in this case was root. Because .tourch is actually the /bin/bash binary, this allowed the attackers to execute bash commands as root.

Reconnaissance

The attackers leveraged a variety of reconnaissance techniques to identify and map high-value servers across compromised networks.

Network Scanning and Database Enumeration Using PHP Scripts

The attackers used multiple PHP scripts to conduct reconnaissance of the target networks. The scripts were used to scan the network for SQL servers, enumerate databases, and enumerate various domain artifacts. These artifacts included users, computers and open shares. Figure 19 shows one of the scripts the attackers used to scan for SQL servers.

CVE-2025-55182 (React2Shell) Vulnerability Scanner

The attackers deployed a custom vulnerability scanner written in Go that scans for servers vulnerable to CVE-2025-55182 (React2Shell). Figure 20 shows the “Help” output of the scanner.

Propagating in the Environment

To bypass internal firewalls and extend their access beyond the initially compromised web servers, the attackers employed a combination of database features, custom malware and open-source proxy tools. These methods enabled the attackers to bypass firewalls, route traffic into the network and execute commands across multiple servers.

Throughout the operation, the attackers used a web shell to deploy Base64-encoded PHP scripts. They started by enabling command execution on an internal MSSQL server using XP_CMDSHELL:

The attackers identified the network segment they wanted to reach, and then created a double-hop execution chain to reach another segment within the network. This involved routing commands from the compromised web server through an initial MSSQL server to reach a secondary SQL server on a different subnet. They verified the routing and started executing OS-level commands on the second host. Following is an observed instance of a whoami command execution through a double-hop execution chain:

SSH for Lateral Movement

The attackers also used the sshpass command with hard-coded administrative credentials to enable lateral movement across the internal network. The following command structure was used to pivot across internal Secure Shell (SSH) targets:

After establishing a successful SSH session on a target, the attackers executed follow-up commands to further compromise the environment. Observed post-pivot commands included:

• Running the id command to verify user context and access levels
• Reading the /etc/shadow file to steal password hashes
• Using find to search for wp-config.php files containing database passwords
• Listing home directories and .git repositories to map the server’s contents
• Executing custom PHP scripts over SSH

SSH-Based Persistency

The attackers achieved SSH-based persistence by injecting an SSH public key into the compromised user’s authorized_keys file. This establishes passwordless remote shell access. Following is the command sequence the attackers executed to install the SSH backdoor:

1. Ensure the hidden .ssh directory exists
2. Restrict directory access only to the owner (using chmod 700)
3. Append the malicious public key to the authorized_keys file
4. Set strict permissions on the authorized_keys file

Figure 21 shows the observed command.

Additional Proxy Tools

The attackers deployed a variety of tunneling and proxy tools, while employing multiple techniques to maintain persistence and evade detection:

• revsocks: The attackers deployed the open-source tool revsocks, a reverse SOCKS5 tunneling tool with SSL/TLS and proxy support.
• pysoxy: The tool set also included pysoxy, an open-source Python SOCKS proxy script used to route traffic.
• GSocket and gs-netcat: The attackers misused Global Socket, a framework designed to solve NAT and firewall traversal problems. They deployed the framework’s binary, gs-netcat, which forces the internal host to establish an outbound connection to the public relay server (gsocket[.]io).
  This binary was stored in /dev/shm/.gs-10085/ and executed under the disguised process name [kcached] (mimicking a kernel cache thread), alongside the binary gs-dbus (mimicking the D-Bus system). Execution parameters were passed via the environment variable (GSOCKET_ARGS) to hide them from process monitoring, and the spawned sessions were configured with HISTFILE=/dev/null to prevent shell command history from being logged to disk.

Additional Data Exfiltration Attempts

The attackers used a combination of methods to extract sensitive data. We observed how they dumped entire database contents into compressed local archives before attempting to exfiltrate them to their C2 infrastructure. They also misused legitimate file-hosting platforms to blend the outgoing data with standard web traffic.

Exfiltration attempts began with attackers using the echo command to print small data samples directly to the terminal, using TOP clauses to limit the output. They subsequently attempted a structured dump, writing four tables, each capped at 100 rows, to a local SQLite database named dump.sqlite. Figure 22 shows the command sampling 100 results from four tables into /tmp/dump.sqlite.

After examining a small sample of archived data, the attackers proceeded to full database dumps. They targeted large databases and wrote the output to local CSV files. Figure 23 shows the next phase, dumping all data from the four tables into a local file.

Following that, the attackers compressed the dumps and attempted to exfiltrate them to a C2 server using the netcat command:

The attackers tried to disguise their exfiltration activity as standard HTTPS web traffic by misusing legitimate file-hosting platforms. They used the curl command-line utility without establishing a dedicated C2 connection, and tried to upload the data to legitimate file-hosting platforms, such as:

• transfer[.]sh
• bashupload[.]com
• filebin[.]net

Another script shows that the attackers searched a server for WordPress configuration files (wp-config.php) and extracted hard-coded database credentials in order to upload the output to the catbox[.]moe API. Figure 24 shows the search and exfiltration script.