/
← Voltar ao feed
high exploit público government

CL-UNK-1211 targets government Linux servers with apparently AI-generated scripts and the SysGoRAT Go RAT

2 fonte(s) · 2 atualização(ões) · publicado 15/10/2026 19:00 · coletado há 1 dia

Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 23/10/2026 00:02; os links antigos trazem para cá.

Fontes: gbhackers.com ↗ unit42.paloaltonetworks.com ↗

Unit 42 (unit42.paloaltonetworks.com) tracks a campaign, CL-UNK-1211, that compromised government entities and state-affiliated Linux infrastructure between October 2025 and April 2026. Unit 42 published the research on October 15, and gbhackers.com covered it on October 22. The operators carried out reconnaissance, persistence and intelligence collection, including database dumping and attempted theft of government mailboxes to reach linked social media accounts. Many PHP and shell scripts contained conversational, step-by-step reasoning comments, which suggests LLM-generated code or deployment through an AI agent. gbhackers.com stresses that the evidence indicates AI assistance but does not establish autonomous execution. The toolkit combined open-source tools, web shells and the custom Go RAT SysGoRAT. The attackers tried to disable Cortex XDR, wipe logs and pose as a red team, but Cortex XDR detected and blocked the activity (unit42.paloaltonetworks.com). Attribution is unresolved: the UNK designation means it is not known whether this is state-sponsored or financially motivated activity.

2 exploits públicos

Há código de exploração publicado no Exploit-DB para CVE-2025-55182, CVE-2021-4034. O código não é reproduzido aqui: o link leva à fonte, e a explicação foi escrita pela IA a partir do arquivo publicado.

  1. exploit-db.com · EDB-52506 ↗ · aplicação web · multiple · pub. 09/04/2026 não verificado

    React Server 19.2.0 - Remote Code Execution

    The script targets CVE-2025-55182, a flaw in how React Server Components deserialize data sent to server function endpoints, as used by frameworks such as Next.js. An unauthenticated attacker with network access to an app running React 19.0.0 to 19.2.0 can trigger it with one crafted POST, no user interaction. It abuses object handling to run JavaScript on the server, giving command execution as the app user. It is a working-looking, blind PoC that scans a target list and leaks command output via DNS lookups; it only prints HTTP status.

    CVE-2025-55182 · autor: danieljavanrad · explicação gerada por IA
  2. exploit-db.com · EDB-50689 ↗ · local · linux · pub. 27/01/2022 não verificado

    PolicyKit-1 0.105-31 - Privilege Escalation

    This is a working local privilege escalation exploit for PwnKit (CVE-2021-4034), a flaw in the pkexec program of Polkit. The attacker needs only a normal local account with the ability to compile or run a binary on a vulnerable Linux host; no authentication to Polkit, network access or user interaction is required. It abuses pkexec's mishandling of an empty argument list so that attacker-controlled environment variables make it load a malicious shared library, which yields a root shell. It matches the listed CVE and is a reliable, well-known technique, though Exploit-DB has not verified this copy.

    CVE-2021-4034 · autor: Lance Biggerstaff · explicação gerada por IA

Detalhes técnicos

  • AI indicators: conversational annotations, sectioned scripts, Base64-encoded commands, and switching between PHP, JavaScript, Bash and Python (gbhackers.com).
  • Persistence: custom and open-source web shells. The auto_prepend_file value was modified across PHP configurations under /etc/php/ and /opt/plesk/php/ so malicious code runs first. One web shell was /usr/lib/php/plesk_sys_driver.php. authorized_keys injection was also used (unit42.paloaltonetworks.com).
  • Credential theft: .bashrc was replaced so that a sudo alias showed a fake password prompt and logged the password to Solarwinds.StatusLog.txt before passing it to the real command. Code was injected into a PHP login page to forward admin credentials. Config and history files were searched for cleartext email, SMTP and database passwords. There is no evidence that SolarWinds itself was compromised.
  • SysGoRAT: a cross-platform (Windows/Linux) Go RAT, first seen as sys-control-client. It uses a WebSocket C2 (wss://<addr>/ws) that defaults to 104.194.158[.]65:443. It supports seven command types, including command execution, interactive shells, directory enumeration, file theft and TCP proxying. It has six persistence methods: systemd and cron on Linux, and the registry and scheduled tasks on Windows. Binaries were renamed to look legitimate, such as pip2.7 and semanage.
  • Reverse shells: in-memory shells (Netcat named pipe, bash TCP redirects, Python subprocess) reached at least seven C2 servers.
  • Collection: the attackers enumerated /var/qmail/mailnames/, used search_social.php to find social-media-related emails, and attempted zip_mails.sh to archive mailboxes. The script contained syntax errors and would have failed, so successful mailbox theft should not be inferred. Database collection grew from samples to full dumps, which were compressed for attempted exfiltration through legitimate file-hosting services (gbhackers.com).
  • Defense evasion: pgrep/pkill against Cortex XDR processes, single-use script deletion, touch -t timestomping, mass deletion of authentication, email, OS and web-server logs, and checks that attacker IPs were gone from logs. Red-team markers (RedTeamOps2025, pentest123) were planted to pass the activity off as authorized testing.
  • Privilege escalation: LinPEAS and PwnKit (CVE-2021-4034). Root backdoors included a renamed Python 3 interpreter (.libpython-helper), a custom SUID shell (.libsystemd-helper) and a SUID copy of bash (.tourch).
  • Lateral movement and reconnaissance: PHP scripts scanned for SQL servers and enumerated databases and domain artifacts. XP_CMDSHELL on MSSQL was used for double-hop command execution, and sshpass with hard-coded credentials for SSH pivoting. A custom Go scanner targeted CVE-2025-55182 (React2Shell).

Remediação

  • Enforce strict outbound firewall rules and restrict outbound connections (the unit42.paloaltonetworks.com text is truncated at this point).
  • Monitor utilities that spawn interactive shells.
  • Investigate unauthorized PHP configuration changes, especially auto_prepend_file.
  • Investigate suspicious history clearing and log deletion on Linux servers and databases.
  • Hunt for the indicators above, including the C2 address, the SUID backdoors and the .bashrc sudo alias.

Linha do tempo

  1. gbhackers.com ↗ · pub. 22/10/2026 07:58 · coletado 22/10 08:00

    CL-UNK-1211 uses apparently AI-generated scripts and SysGoRAT to compromise government Linux servers

    ler a análise desta fonte

    Unit 42 (Palo Alto Networks) tracks a campaign, CL-UNK-1211, in which operators compromised government Linux infrastructure between October 2025 and April 2026. The operators used PHP and shell scripts that appear to be AI-generated, with conversational comments and step-by-step reasoning. They harvested credentials and went after databases and official mailboxes. Attribution is unresolved: the UNK designation means Unit 42 has not determined whether the activity is state-sponsored or financially motivated. The evidence points to AI assistance but does not establish autonomous execution. The research was published October 15.

    Technical Details

    • AI indicators: conversational annotations, sectioned scripts, Base64-encoded commands, and switching between PHP, JavaScript, Bash and Python. Unit 42 assessed the artifacts as consistent with LLM output copied in or deployed through an AI agent.
    • Persistence: custom and public web shells. The operators edited PHP configuration under /etc/php/ and /opt/plesk/php/, setting auto_prepend_file so malicious code runs first. One implant is /usr/lib/php/plesk_sys_driver.php.
    • Credential theft: .bashrc was replaced with a version that aliases sudo to capture passwords before passing them to the real command. Credentials were logged to Solarwinds.StatusLog.txt; there is no evidence that SolarWinds was compromised. Credential logging was also injected into a PHP authentication page, and configuration files and command histories were searched for database, SMTP and email passwords.
    • SysGoRAT: a custom Go RAT for Linux and Windows. It uses a WebSocket C2 that defaults to 104.194.158[.]65:443. It supports command execution, interactive shells, directory enumeration, file theft and TCP proxying. Persistence uses systemd and cron on Linux, and the registry and scheduled tasks on Windows. Binaries were renamed to look legitimate, such as pip2.7 and semanage.
    • C2: reverse shells via Netcat, Bash and Python reached at least seven distinct C2 servers.
    • Collection: the operators enumerated /var/qmail/mailnames/ and deployed search_social.php. A zip_mails.sh archiving script contained syntax errors, so successful mailbox theft should not be inferred. Database collection grew from samples to full dumps, which were compressed for attempted exfiltration through legitimate file-hosting services.
    • Defense evasion: scripts cleaned authentication, email, OS and web-server logs. File timestamps were altered (timestomping), and red-team labels were planted to pass the activity off as authorized testing.

    Remediation

    • Restrict outbound connections.
    • Monitor utilities that spawn interactive shells.
    • Investigate unauthorized PHP configuration changes, especially auto_prepend_file.
    • Investigate suspicious history clearing on Linux servers and databases.
  2. unit42.paloaltonetworks.com ↗ · pub. 15/10/2026 19:00 · coletado 19/10 17:56 primeiro registro

    CL-UNK-1211 uses AI-generated payloads and SysGoRAT RAT to spy on government Linux servers

    ler a análise desta fonte

    Unit 42 reports a campaign, tracked as CL-UNK-1211, that targeted government entities and state-affiliated infrastructure between October 2025 and April 2026. The cluster has not been attributed to a nation-state or to cybercrime. The attackers focused on Linux servers for reconnaissance, persistence and intelligence collection, including database dumping and attempted theft of government mailboxes to reach linked social media accounts. Many scripts contained conversational, AI-style reasoning comments, which suggests LLM-generated code or an automated AI agent. The toolkit combined open-source tools, web shells and the custom Go RAT SysGoRAT. The attackers also tried to disable Cortex XDR, wipe logs and pose as a red team, but Cortex XDR detected and blocked the activity.

    Technical Details

    • Persistence: web shells (custom and open-source) were deployed on Linux servers. The auto_prepend_file value was modified across PHP configurations under /etc/php/ and /opt/plesk/php/. One web shell was /usr/lib/php/plesk_sys_driver.php.
    • Credential theft: .bashrc was replaced so that a sudo alias showed a fake password prompt and wrote the password to Solarwinds.StatusLog.txt. Code was injected into a PHP login page to forward admin credentials. The attackers searched config and history files for cleartext email, SMTP and database passwords. Unit 42 found no evidence that SolarWinds itself was compromised.
    • SysGoRAT: a Go cross-platform (Windows/Linux) RAT, first seen as sys-control-client. It uses WebSocket C2 (wss://<addr>/ws) with a default of 104.194.158[.]65:443. It supports seven command types and six persistence methods.
    • Reverse shells: in-memory reverse shells (Netcat named pipe, bash TCP redirects, Python subprocess) were used across at least seven C2 servers.
    • Mail collection: the attackers enumerated /var/qmail/mailnames/, used search_social.php to find social-media-related emails, and attempted zip_mails.sh to archive mailboxes. The script contained syntax errors and would have failed.
    • Defense evasion: pgrep/pkill against Cortex XDR processes, single-use script deletion, touch -t timestomping, mass log deletion and checks that attacker IPs were gone from logs. The attackers planted red-team markers (RedTeamOps2025, pentest123).
    • Privilege escalation: LinPEAS and PwnKit (CVE-2021-4034). Root backdoors included a renamed Python 3 interpreter (.libpython-helper), a custom SUID shell (.libsystemd-helper) and a SUID copy of bash (.tourch).
    • Lateral movement and reconnaissance: PHP scripts scanned for SQL servers and enumerated databases and domain artifacts. XP_CMDSHELL on MSSQL was used for double-hop command execution, sshpass with hard-coded credentials for SSH pivoting, and authorized_keys injection for persistence. A custom Go scanner targeted CVE-2025-55182 (React2Shell).

    Remediation

    • Enforce strict outbound firewall rules and use EDR to flag standard utilities spawning interactive shells.
    • Monitor changes to PHP auto_prepend_file, .bashrc, authorized_keys and SUID binaries.
    • Patch CVE-2021-4034 and CVE-2025-55182.
    • Use the published hashes and C2 address for hunting.
    • Palo Alto customers are covered by Cortex XDR, Advanced WildFire, Advanced URL Filtering, Advanced DNS Security and Advanced IP Defense.