Unit 42 Tracks AI-Linked Espionage Cluster CL-UNK-1211

Unit 42 says CL-UNK-1211 spied on government Linux systems from October 2025 to April 2026 with web shells, backdoors, and AI-style scripts.

Palo Alto Networks Unit 42 tracks espionage cluster CL-UNK-1211 against government entities and state-affiliated infrastructure from October 2025 through April 2026. Operators deployed custom and open-source web shells, changed PHP auto_prepend_file on Plesk and system PHP configurations, and used custom cross-platform backdoors, including Go malware SysGoRAT with WebSocket command-and-control on Linux and Windows. They harvested credentials, dumped databases, and searched government mailboxes, including attempts to reach linked social media accounts, while also trying to disable endpoint protections, clear logs, and plant deceptive red-team markers. A follow-up report adds that a .bashrc sudo alias captured passwords into Solarwinds.StatusLog.txt while still calling legitimate sudo, and that Unit 42 found no SolarWinds compromise; indicators also included scanners labeled for CVE-2025-55182. The sources disagree on the AI angle: Unit 42 described conversational comments consistent with LLM-generated or AI-agent code, while the later account framed them as assisted scripting rather than an autonomously run campaign. Nation-state or criminal affiliation remains undetermined.

• Palo Alto Networks Unit 42 tracks espionage cluster CL-UNK-1211 against government entities and state-affiliated Linux infrastructure from October 2025 through April 2026.
• Operators used custom and open-source web shells, including GitHub shells, and persisted by changing PHP auto_prepend_file on Plesk and system PHP configurations.
• A custom Go remote-access tool, SysGoRAT, provided WebSocket command-and-control on Linux and Windows.
• Attackers replaced .bashrc with a sudo alias that logged passwords to Solarwinds.StatusLog.txt while still invoking legitimate sudo; Unit 42 found no SolarWinds compromise.
• They harvested credentials, dumped databases, searched government mailboxes and linked social accounts, and tried to disable endpoint protections, erase logs, and plant deceptive red-team markers.
• Indicators included scanners labeled for CVE-2025-55182.
• Unit 42 said PHP and shell payloads contained comments consistent with LLM-generated or AI-agent code; a later report called this AI-assisted scripting, not an autonomous campaign.
• Nation-state or criminal affiliation remains undetermined.