Unit 42: AI-generated scripts drove an espionage campaign against government Linux servers
Unit 42 says the group behind CL-UNK-1211 used LLM-written scripts to plant web shells and backdoors on government Linux servers. Here is what admins should check.
Palo Alto Networks' Unit 42 published details on October 15, 2026 of an espionage campaign, tracked as CL-UNK-1211, that broke into Linux web and database servers belonging to government and state-affiliated organizations, using scripts that Unit 42 says were generated by large language models or run by an AI agent. Organizations running Linux web hosting (including Plesk), PHP sites and MSSQL databases should check for the persistence tricks described below and block the published indicators; the techniques are old, but the pace AI gives the attackers is the new part.
What happened, in plain English
Unit 42, the threat-intelligence team of Palo Alto Networks, investigated intrusions it observed between October 2025 and April 2026. The victims were government bodies and state-linked infrastructure; the report does not name countries or organizations, and does not say how many were hit.
The attackers planted web shells — small scripts hidden on a web server that let an outsider run commands through a web page — on Linux servers. From there they stole passwords, installed a remote-control program written in Go (Unit 42 calls it SysGoRAT), moved to internal database servers, searched government mailboxes and tried to copy data out to public file-sharing sites.
What makes this report notable is how the attack tools were written. Several scripts contained chatty, step-by-step comments explaining the logic "to the operator", the kind of annotations AI coding assistants typically produce. Unit 42 concludes the code was "either generated using large language models (LLMs) or executed by an automated AI agent". An LLM is the technology behind chatbots such as ChatGPT or Claude.
Think of it as a burglar who brings a fast assistant that writes a fresh set of lock-picking notes for every door. The locks are ordinary and the methods are well known, but the burglar gets through more houses in less time.
Unit 42 has not determined whether the group is state-backed or criminal — that is what "UNK" (unknown) in the name means — and it does not say which AI model was used.
Are you affected? What to do now
Most organizations were not targeted by this specific group. But the toolkit — web shells, password capture and hidden backdoors on Linux servers — works against any organization, so the checks below are worth doing if you run Linux web, mail or database servers, especially shared hosting with Plesk.
Who should care most
- Government, public-sector and state-affiliated organizations, and the hosting or IT providers that serve them.
- Anyone running internet-facing PHP sites (including WordPress), Plesk, qmail mail servers or MSSQL databases reachable from web servers.
Check for these signs (all described by Unit 42)
- PHP configuration changes: an
auto_prepend_filesetting you did not add in PHP configuration files under/etc/php/or/opt/plesk/php/. Attackers used it to make their web shell run before every PHP page. - Look-alike files: unexpected PHP files with system-sounding names in library folders (Unit 42 cites
/usr/lib/php/plesk_sys_driver.php), and hidden files such as.libpython-helper,.libsystemd-helperor.tourch. - New services and jobs: an unfamiliar
sys-update.servicein systemd, a binary copied into/usr/local/bin/, or cron jobs that run every five minutes. - SSH keys: public keys in
authorized_keysfiles that nobody on your team can account for. - Shell profile tampering: a
sudoalias in.bashrcfiles (it was used to capture administrator passwords to a log file disguised as a SolarWinds file — Unit 42 says SolarWinds itself was not compromised). - Login page changes: extra code in admin or database login pages that writes credentials to a file.
- Databases:
xp_cmdshellenabled on MSSQL servers where it is not needed. - Missing logs: gaps or truncation in authentication, web server, mail, PHP session or shell history logs.
What to do, in order
- Block the published indicators. Unit 42 lists 17 IP addresses, about 10 file hashes and four domains:
magento[.]ink,solidmonpe[.]com,wibu-bau-bawang[.]onlineandberaskencur[.]site. Search firewall, DNS and proxy logs for past connections, not only future ones. Use the full list in the report. - Patch known flaws the group used or scanned for. It used the old PwnKit bug (CVE-2021-4034, a Linux privilege-escalation flaw in polkit) and ran a scanner for React2Shell (CVE-2025-55182), a critical React Server Components flaw fixed in React 19.0.1, 19.1.2 and 19.2.1 according to CERT-EU. Unit 42 does not say how the attackers first got in.
- Restrict outbound traffic. Web and database servers rarely need to reach public file-sharing sites or arbitrary internet hosts. Unit 42's top recommendation is strict outbound (egress) firewall rules.
- Watch for interactive shells from ordinary tools. Alert when
nc,bashorpythonprocesses open interactive shells or network connections from a web server. - Rebuild, don't clean. If you find these signs, treat the server as compromised: rebuild it, rotate every password and key it held, and check the servers it could reach.
- Review stored secrets. The attackers searched configuration and history files for cleartext passwords (database, SMTP, WordPress). Move secrets out of plain-text files where you can.
If none of this applies to your environment, there is nothing urgent to do — but the checklist is a reasonable quarterly hygiene review for any Linux web estate.
The expert view
Strip away the AI angle and CL-UNK-1211 is a familiar Linux intrusion: web shell, credential harvesting, PwnKit for root, SUID shells, auto_prepend_file persistence, SOCKS proxies and GSocket relays for tunnelling, xp_cmdshell and sshpass for lateral movement, and log wiping plus timestomping to cover tracks. None of those techniques is new, and defenders who already monitor for them would have had a fair chance.
What is new is the evidence trail. Unit 42's attribution of AI use rests on artifacts in the code itself: conversational comments addressed to an operator, section headers that look designed for a machine to parse output, heavy Base64 wrapping of commands and frequent switching between PHP, JavaScript, Bash and Python. That is consistent with an operator — or an agent loop — asking a model for a new script at each step rather than carrying a fixed toolkit. It is an inference, not a confession: the report names no model, and similar comments can come from human copy-paste. Readers should treat "AI-powered" here as "AI-assisted, with good circumstantial evidence".
The practical consequence is that the attacker's tooling becomes disposable. When scripts are regenerated per target, file hashes and string signatures age quickly, which shifts the burden to behaviour-based detection: a configuration directive that suddenly prepends code to every PHP request, a utility spawning an interactive shell, an outbound upload to a paste or file-drop service, a log file that shrinks. Notably, Unit 42 says the actors' attempts to kill endpoint-protection processes were blocked, and one mailbox-archiving script contained syntax errors and would have failed — a reminder that AI speeds attackers up without making them flawless.
The campaign fits a pattern this site has followed for weeks: CrowdStrike linked Korean bank breaches to an open-source AI pentesting agent, and reports of agent-driven intrusions keep arriving. The common thread is not new exploitation capability but lower cost per intrusion — more targets attempted with the same handful of operators.
Several things remain unknown: how the attackers got their first foothold, how many organizations were compromised, which countries were affected, what data actually left the networks (Unit 42 describes exfiltration as attempted), and whether the group is a state service or a criminal outfit. Unit 42 also describes red-team-style decoys in the tooling — a key named RedTeamOps2025 and an account password pentest123 — which could make the activity look like an authorized test if discovered. Incident responders who find those strings should not assume a sanctioned red team without checking.