EN PT-BR
← Voltar ao feed
high exploit público government

CL-UNK-1211 targets government Linux servers with apparently AI-generated scripts and the SysGoRAT Go RAT

3 fonte(s) · 3 atualização(ões) · publicado 15/10/2026 19:00 · coletado há 15 horas

Matéria consolidada. Reúne 4 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 3 fontes trouxeram em 03/11/2026 00:06; os links antigos trazem para cá.

Fontes: thehackernews.com ↗ gbhackers.com ↗ unit42.paloaltonetworks.com ↗

Unit 42 (unit42.paloaltonetworks.com) tracks a campaign, CL-UNK-1211, that compromised government entities and state-affiliated Linux infrastructure between October 2025 and April 2026. Unit 42 published the research on October 15, gbhackers.com covered it on October 22, and thehackernews.com followed on November 2, 2026, describing it as a cyber espionage campaign. The operators carried out reconnaissance, persistence and intelligence collection, including database dumping and attempted theft of government mailboxes, with a focus on social media-related emails, to reach linked social media accounts. Many PHP and shell scripts contained conversational, step-by-step reasoning comments, which suggests LLM-generated code or deployment through an AI agent. gbhackers.com stresses that the evidence indicates AI assistance but does not establish autonomous execution. The toolkit combined open-source tools, web shells and the custom Go RAT SysGoRAT. The attackers tried to disable Cortex XDR, wipe logs and pose as a red team, but Cortex XDR detected and blocked the activity (unit42.paloaltonetworks.com). Attribution is unresolved: the UNK designation means it is not known whether this is state-sponsored or financially motivated activity. thehackernews.com also places the case alongside reporting by GTIG, Mandiant and Microsoft on misuse of agentic pentest frameworks (see Technical Details).

2 exploits públicos

Há código de exploração publicado no Exploit-DB para CVE-2025-55182, CVE-2021-4034. O código não é reproduzido aqui: o link leva à fonte, e a explicação foi escrita pela IA a partir do arquivo publicado.

  1. exploit-db.com · EDB-52506 ↗ · aplicação web · multiple · pub. 09/04/2026 não verificado

    React Server 19.2.0 - Remote Code Execution

    The script targets CVE-2025-55182, a flaw in how React Server Components deserialize data sent to server function endpoints, as used by frameworks such as Next.js. An unauthenticated attacker with network access to an app running React 19.0.0 to 19.2.0 can trigger it with one crafted POST, no user interaction. It abuses object handling to run JavaScript on the server, giving command execution as the app user. It is a working-looking, blind PoC that scans a target list and leaks command output via DNS lookups; it only prints HTTP status.

    CVE-2025-55182 · autor: danieljavanrad · explicação gerada por IA
  2. exploit-db.com · EDB-50689 ↗ · local · linux · pub. 27/01/2022 não verificado

    PolicyKit-1 0.105-31 - Privilege Escalation

    This is a working local privilege escalation exploit for PwnKit (CVE-2021-4034), a flaw in the pkexec program of Polkit. The attacker needs only a normal local account with the ability to compile or run a binary on a vulnerable Linux host; no authentication to Polkit, network access or user interaction is required. It abuses pkexec's mishandling of an empty argument list so that attacker-controlled environment variables make it load a malicious shared library, which yields a root shell. It matches the listed CVE and is a reliable, well-known technique, though Exploit-DB has not verified this copy.

    CVE-2021-4034 · autor: Lance Biggerstaff · explicação gerada por IA

Detalhes técnicos

  • AI indicators: conversational annotations, sectioned scripts, Base64-encoded commands, and switching between PHP, JavaScript, Bash and Python (gbhackers.com).
  • Persistence: custom and open-source web shells. The auto_prepend_file value was modified across PHP configurations under /etc/php/ and /opt/plesk/php/ so malicious code runs first. One web shell was /usr/lib/php/plesk_sys_driver.php. authorized_keys injection was also used (unit42.paloaltonetworks.com).
  • Credential theft: .bashrc was replaced so that a sudo alias showed a fake password prompt and logged the password to Solarwinds.StatusLog.txt before passing it to the real command. Code was injected into a PHP login page to forward admin credentials. Config and history files were searched for cleartext email, SMTP and database passwords. There is no evidence that SolarWinds itself was compromised.
  • SysGoRAT: a cross-platform (Windows/Linux) Go RAT, first seen as sys-control-client. It uses a WebSocket C2 (wss://<addr>/ws) that defaults to 104.194.158[.]65:443. It supports seven command types: command, control (with shell_start, screenshot, download, persist), list_dir, shell_input, proxy_connect, proxy_data and proxy_close (thehackernews.com). These cover command execution, interactive shells, directory enumeration, file theft and TCP proxying. It has six persistence methods: systemd and cron on Linux, and the registry and scheduled tasks on Windows. Binaries were renamed to look legitimate, such as pip2.7 and semanage.
  • Reverse shells: in-memory shells (Netcat named pipe, bash TCP redirects, Python subprocess) reached at least seven C2 servers, and were used to avoid disk artifacts (thehackernews.com).
  • Collection: the attackers enumerated /var/qmail/mailnames/, used search_social.php to search email headers for social-media-related keywords, and attempted zip_mails.sh to archive mailboxes. The script contained syntax errors and would have failed (gbhackers.com, thehackernews.com), so successful mailbox theft should not be inferred. Database collection grew from samples to full dumps, which were compressed for attempted exfiltration through legitimate file-hosting services (gbhackers.com).
  • Defense evasion: pgrep/pkill against Cortex XDR processes, single-use script deletion, touch -t timestomping, mass deletion of authentication, email, OS and web-server logs, and checks that attacker IPs were gone from logs. Red-team markers (RedTeamOps2025, pentest123) were planted to pass the activity off as authorized testing.
  • Privilege escalation: LinPEAS and PwnKit (CVE-2021-4034). Root backdoors included a renamed Python 3 interpreter (.libpython-helper), a custom SUID shell (.libsystemd-helper) and a SUID copy of bash (.tourch).
  • Lateral movement and reconnaissance: PHP scripts scanned for SQL servers and enumerated databases and domain artifacts. XP_CMDSHELL on MSSQL was used for double-hop command execution, and sshpass with hard-coded credentials for SSH pivoting. A custom Go scanner targeted CVE-2025-55182 (React2Shell).
  • Related agentic framework abuse (context, thehackernews.com): GTIG, Mandiant and Microsoft have reported misuse of agentic pentest frameworks such as ARTEX, PentAGI, Hexstrike and CAIRN by multiple threat actors. ARTEX was used by Storm-0940 (UNC7228), financially motivated actors, and the North Korean groups Onyx Sleet (Andariel) and Pearl Sleet (Lawrencium). PentAGI was used for reconnaissance and scanning against organizations in Asia. The article presents this as context and does not tie CL-UNK-1211 to these actors or frameworks.

Remediação

  • Enforce strict outbound firewall rules and restrict outbound connections (the unit42.paloaltonetworks.com text is truncated at this point).
  • Monitor utilities that spawn interactive shells.
  • Investigate unauthorized PHP configuration changes, especially auto_prepend_file.
  • Investigate suspicious history clearing and log deletion on Linux servers and databases.
  • Hunt for the indicators above, including the C2 address, the SUID backdoors and the .bashrc sudo alias.
  • Also hunt for unexpected modifications to PHP login pages, unknown web shells and the named scripts (search_social.php, zip_mails.sh), and monitor for security tool tampering (thehackernews.com).
  • Agentic frameworks reportedly trade stealth for speed, leaving forensic traffic and code-level traces that defenders can detect (thehackernews.com).

Relatos divergentes

  • Mailbox theft: thehackernews.com says the operators used the tooling to steal government mailboxes, while the same article and gbhackers.com note that zip_mails.sh failed because of syntax errors. The record treats mailbox theft as attempted, not confirmed.
  • Nature of the activity: thehackernews.com calls it a cyber espionage campaign, but Unit 42 (unit42.paloaltonetworks.com), the original and more authoritative source, keeps the UNK designation, meaning state-sponsored versus financially motivated motivation is unresolved.

Linha do tempo

  1. thehackernews.com ↗ · pub. 02/11/2026 07:49 · coletado 02/11 10:00

    CL-UNK-1211 Targets Government Linux Servers with SysGoRAT, Web Shells and Suspected AI-Generated Scripts

    ler a análise desta fonte

    Palo Alto Networks Unit 42 disclosed a cyber espionage campaign, tracked as CL-UNK-1211, aimed at Linux infrastructure of government and state-affiliated entities between October 2025 and April 2026. The operators used web shells, open-source tools and a custom Go backdoor, SysGoRAT, to keep long-term access, harvest credentials and steal government mailboxes, with a focus on social media-related emails. Several PHP and shell scripts contained conversational reasoning notes, suggesting they were generated by an LLM or deployed by an AI agent. The article also notes GTIG, Mandiant and Microsoft reporting on misuse of agentic pentest frameworks such as ARTEX, PentAGI, Hexstrike and CAIRN by multiple threat actors.

    Technical Details

    • Persistence through a mix of open-source and custom PHP web shells.
    • Credential theft by replacing .bashrc with a malicious version, injecting code into PHP login pages, and scanning configuration and history files for cleartext email, SMTP and database passwords.
    • SysGoRAT: cross-platform (Windows/Linux) Go RAT using WebSocket C2 to 104.194.158[.]65:443. It supports the commands command, control (shell_start, screenshot, download, persist), list_dir, shell_input, proxy_connect, proxy_data and proxy_close.
    • In-memory reverse shells to avoid disk artifacts; enumeration of /var/qmail/mailnames/.
    • search_social.php searched email headers for social media keywords. zip_mails.sh was meant to archive emails for exfiltration but failed because of syntax errors.
    • Attempts to disable endpoint protections, wipe logs and plant fake red-team markers to pass the activity off as a legitimate security assessment.
    • Related agentic framework abuse: ARTEX used by Storm-0940 (UNC7228), financially motivated actors, and North Korean groups Onyx Sleet (Andariel) and Pearl Sleet (Lawrencium); PentAGI used for reconnaissance and scanning against organizations in Asia.

    Remediation

    Hunt for the C2 IP, unexpected modifications to .bashrc and PHP login pages, unknown web shells, and the named scripts. Monitor for log wiping and security tool tampering. Agentic frameworks reportedly trade stealth for speed, leaving forensic traffic and code-level traces that defenders can detect.

  2. gbhackers.com ↗ · pub. 22/10/2026 07:58 · coletado 22/10 08:00

    CL-UNK-1211 uses apparently AI-generated scripts and SysGoRAT to compromise government Linux servers

    ler a análise desta fonte

    Unit 42 (Palo Alto Networks) tracks a campaign, CL-UNK-1211, in which operators compromised government Linux infrastructure between October 2025 and April 2026. The operators used PHP and shell scripts that appear to be AI-generated, with conversational comments and step-by-step reasoning. They harvested credentials and went after databases and official mailboxes. Attribution is unresolved: the UNK designation means Unit 42 has not determined whether the activity is state-sponsored or financially motivated. The evidence points to AI assistance but does not establish autonomous execution. The research was published October 15.

    Technical Details

    • AI indicators: conversational annotations, sectioned scripts, Base64-encoded commands, and switching between PHP, JavaScript, Bash and Python. Unit 42 assessed the artifacts as consistent with LLM output copied in or deployed through an AI agent.
    • Persistence: custom and public web shells. The operators edited PHP configuration under /etc/php/ and /opt/plesk/php/, setting auto_prepend_file so malicious code runs first. One implant is /usr/lib/php/plesk_sys_driver.php.
    • Credential theft: .bashrc was replaced with a version that aliases sudo to capture passwords before passing them to the real command. Credentials were logged to Solarwinds.StatusLog.txt; there is no evidence that SolarWinds was compromised. Credential logging was also injected into a PHP authentication page, and configuration files and command histories were searched for database, SMTP and email passwords.
    • SysGoRAT: a custom Go RAT for Linux and Windows. It uses a WebSocket C2 that defaults to 104.194.158[.]65:443. It supports command execution, interactive shells, directory enumeration, file theft and TCP proxying. Persistence uses systemd and cron on Linux, and the registry and scheduled tasks on Windows. Binaries were renamed to look legitimate, such as pip2.7 and semanage.
    • C2: reverse shells via Netcat, Bash and Python reached at least seven distinct C2 servers.
    • Collection: the operators enumerated /var/qmail/mailnames/ and deployed search_social.php. A zip_mails.sh archiving script contained syntax errors, so successful mailbox theft should not be inferred. Database collection grew from samples to full dumps, which were compressed for attempted exfiltration through legitimate file-hosting services.
    • Defense evasion: scripts cleaned authentication, email, OS and web-server logs. File timestamps were altered (timestomping), and red-team labels were planted to pass the activity off as authorized testing.

    Remediation

    • Restrict outbound connections.
    • Monitor utilities that spawn interactive shells.
    • Investigate unauthorized PHP configuration changes, especially auto_prepend_file.
    • Investigate suspicious history clearing on Linux servers and databases.
  3. unit42.paloaltonetworks.com ↗ · pub. 15/10/2026 19:00 · coletado 19/10 17:56 primeiro registro

    CL-UNK-1211 uses AI-generated payloads and SysGoRAT RAT to spy on government Linux servers

    ler a análise desta fonte

    Unit 42 reports a campaign, tracked as CL-UNK-1211, that targeted government entities and state-affiliated infrastructure between October 2025 and April 2026. The cluster has not been attributed to a nation-state or to cybercrime. The attackers focused on Linux servers for reconnaissance, persistence and intelligence collection, including database dumping and attempted theft of government mailboxes to reach linked social media accounts. Many scripts contained conversational, AI-style reasoning comments, which suggests LLM-generated code or an automated AI agent. The toolkit combined open-source tools, web shells and the custom Go RAT SysGoRAT. The attackers also tried to disable Cortex XDR, wipe logs and pose as a red team, but Cortex XDR detected and blocked the activity.

    Technical Details

    • Persistence: web shells (custom and open-source) were deployed on Linux servers. The auto_prepend_file value was modified across PHP configurations under /etc/php/ and /opt/plesk/php/. One web shell was /usr/lib/php/plesk_sys_driver.php.
    • Credential theft: .bashrc was replaced so that a sudo alias showed a fake password prompt and wrote the password to Solarwinds.StatusLog.txt. Code was injected into a PHP login page to forward admin credentials. The attackers searched config and history files for cleartext email, SMTP and database passwords. Unit 42 found no evidence that SolarWinds itself was compromised.
    • SysGoRAT: a Go cross-platform (Windows/Linux) RAT, first seen as sys-control-client. It uses WebSocket C2 (wss://<addr>/ws) with a default of 104.194.158[.]65:443. It supports seven command types and six persistence methods.
    • Reverse shells: in-memory reverse shells (Netcat named pipe, bash TCP redirects, Python subprocess) were used across at least seven C2 servers.
    • Mail collection: the attackers enumerated /var/qmail/mailnames/, used search_social.php to find social-media-related emails, and attempted zip_mails.sh to archive mailboxes. The script contained syntax errors and would have failed.
    • Defense evasion: pgrep/pkill against Cortex XDR processes, single-use script deletion, touch -t timestomping, mass log deletion and checks that attacker IPs were gone from logs. The attackers planted red-team markers (RedTeamOps2025, pentest123).
    • Privilege escalation: LinPEAS and PwnKit (CVE-2021-4034). Root backdoors included a renamed Python 3 interpreter (.libpython-helper), a custom SUID shell (.libsystemd-helper) and a SUID copy of bash (.tourch).
    • Lateral movement and reconnaissance: PHP scripts scanned for SQL servers and enumerated databases and domain artifacts. XP_CMDSHELL on MSSQL was used for double-hop command execution, sshpass with hard-coded credentials for SSH pivoting, and authorized_keys injection for persistence. A custom Go scanner targeted CVE-2025-55182 (React2Shell).

    Remediation

    • Enforce strict outbound firewall rules and use EDR to flag standard utilities spawning interactive shells.
    • Monitor changes to PHP auto_prepend_file, .bashrc, authorized_keys and SUID binaries.
    • Patch CVE-2021-4034 and CVE-2025-55182.
    • Use the published hashes and C2 address for hunting.
    • Palo Alto customers are covered by Cortex XDR, Advanced WildFire, Advanced URL Filtering, Advanced DNS Security and Advanced IP Defense.