CL-UNK-1211 Targets Government Linux Servers with SysGoRAT, Web Shells and Suspected AI-Generated Scripts
Palo Alto Networks Unit 42 disclosed a cyber espionage campaign, tracked as CL-UNK-1211, aimed at Linux infrastructure of government and state-affiliated entities between October 2025 and April 2026. The operators used web shells, open-source tools and a custom Go backdoor, SysGoRAT, to keep long-term access, harvest credentials and steal government mailboxes, with a focus on social media-related emails. Several PHP and shell scripts contained conversational reasoning notes, suggesting they were generated by an LLM or deployed by an AI agent. The article also notes GTIG, Mandiant and Microsoft reporting on misuse of agentic pentest frameworks such as ARTEX, PentAGI, Hexstrike and CAIRN by multiple threat actors.
Detalhes técnicos
- Persistence through a mix of open-source and custom PHP web shells.
- Credential theft by replacing
.bashrcwith a malicious version, injecting code into PHP login pages, and scanning configuration and history files for cleartext email, SMTP and database passwords. - SysGoRAT: cross-platform (Windows/Linux) Go RAT using WebSocket C2 to
104.194.158[.]65:443. It supports the commands command, control (shell_start, screenshot, download, persist), list_dir, shell_input, proxy_connect, proxy_data and proxy_close. - In-memory reverse shells to avoid disk artifacts; enumeration of
/var/qmail/mailnames/. search_social.phpsearched email headers for social media keywords.zip_mails.shwas meant to archive emails for exfiltration but failed because of syntax errors.- Attempts to disable endpoint protections, wipe logs and plant fake red-team markers to pass the activity off as a legitimate security assessment.
- Related agentic framework abuse: ARTEX used by Storm-0940 (UNC7228), financially motivated actors, and North Korean groups Onyx Sleet (Andariel) and Pearl Sleet (Lawrencium); PentAGI used for reconnaissance and scanning against organizations in Asia.
Remediação
Hunt for the C2 IP, unexpected modifications to .bashrc and PHP login pages, unknown web shells, and the named scripts. Monitor for log wiping and security tool tampering. Agentic frameworks reportedly trade stealth for speed, leaving forensic traffic and code-level traces that defenders can detect.
Linha do tempo
-
CL-UNK-1211 Targets Government Linux Servers with SysGoRAT, Web Shells and Suspected AI-Generated Scripts
ler a análise desta fonte ocultar
Palo Alto Networks Unit 42 disclosed a cyber espionage campaign, tracked as CL-UNK-1211, aimed at Linux infrastructure of government and state-affiliated entities between October 2025 and April 2026. The operators used web shells, open-source tools and a custom Go backdoor, SysGoRAT, to keep long-term access, harvest credentials and steal government mailboxes, with a focus on social media-related emails. Several PHP and shell scripts contained conversational reasoning notes, suggesting they were generated by an LLM or deployed by an AI agent. The article also notes GTIG, Mandiant and Microsoft reporting on misuse of agentic pentest frameworks such as ARTEX, PentAGI, Hexstrike and CAIRN by multiple threat actors.
Technical Details
- Persistence through a mix of open-source and custom PHP web shells.
- Credential theft by replacing
.bashrcwith a malicious version, injecting code into PHP login pages, and scanning configuration and history files for cleartext email, SMTP and database passwords. - SysGoRAT: cross-platform (Windows/Linux) Go RAT using WebSocket C2 to
104.194.158[.]65:443. It supports the commands command, control (shell_start, screenshot, download, persist), list_dir, shell_input, proxy_connect, proxy_data and proxy_close. - In-memory reverse shells to avoid disk artifacts; enumeration of
/var/qmail/mailnames/. search_social.phpsearched email headers for social media keywords.zip_mails.shwas meant to archive emails for exfiltration but failed because of syntax errors.- Attempts to disable endpoint protections, wipe logs and plant fake red-team markers to pass the activity off as a legitimate security assessment.
- Related agentic framework abuse: ARTEX used by Storm-0940 (UNC7228), financially motivated actors, and North Korean groups Onyx Sleet (Andariel) and Pearl Sleet (Lawrencium); PentAGI used for reconnaissance and scanning against organizations in Asia.
Remediation
Hunt for the C2 IP, unexpected modifications to
.bashrcand PHP login pages, unknown web shells, and the named scripts. Monitor for log wiping and security tool tampering. Agentic frameworks reportedly trade stealth for speed, leaving forensic traffic and code-level traces that defenders can detect.