AI-Assisted Cyber Campaign Targets Government and State-Linked Linux Infrastructure
A sophisticated cyber campaign, tracked as CL-UNK-1211, targeted government organizations and state-affiliated infrastructure from October 2025 to April 2026, leveraging AI-generated scripts to steal credentials, maintain persistence, and exfiltrate sensitive data. Researchers at Unit 42 uncovered the operation, which employed a mix of custom malware, web shells, and credential-harvesting techniques without exploiting software vulnerabilities in the traditional sense.
How the Attack Worked
The threat actors manipulated Linux shell startup files, specifically .bashrc, to intercept the sudo command. By planting a malicious alias, they captured passwords in real time while allowing the legitimate sudo process to execute, masking the theft. The stolen credentials were logged in a file named Solarwinds.StatusLog.txt, a deceptive tactic mimicking a routine system artifact though no SolarWinds systems were compromised.
Beyond shell-based credential theft, the attackers:
- Modified PHP login pages to harvest admin credentials.
- Searched configuration files and command histories for email, SMTP, and database credentials.
- Deployed web shells and altered PHP configurations to load malicious scripts before legitimate ones.
- Used AI-generated code in scripts, identified by conversational comments and step-by-step reasoning notes, though AI did not independently plan the campaign.
Malware and Persistence Mechanisms
The campaign featured SysGoRAT, a Go-based remote access Trojan (RAT) capable of running on Linux and Windows, communicating via WebSocket to a command-and-control (C2) server (default address: 104.194.158[.]65:443). The malware, disguised under names like sys-control-client and pip2.7, enabled remote command execution, file manipulation, and persistence.
Attackers also:
- Planted web shells and modified PHP settings for covert access.
- Searched government mailboxes for social media-related messages and attempted to exfiltrate database data.
- Attempted to erase evidence by stopping security processes, deleting logs, and altering file timestamps.
- Used red-team-like markers (e.g., RedTeamOps2025, pentest123) to mimic authorized activity.
Defensive Insights
While the campaign demonstrated AI-assisted tool development, it relied on familiar Linux tools and social engineering rather than zero-day exploits. Defenders are advised to:
- Review unexpected changes to
.bashrc, PHP configurations, and login pages. - Monitor for unusual aliases, credential log files, and outbound connections.
- Preserve logs and system evidence during investigations.
Unit 42 classified the threat as CL-UNK-1211, indicating an unattributed cluster neither definitively linked to state-backed actors nor cybercriminals. The campaign underscores the growing use of AI in offensive cyber operations, though its role remained limited to script adaptation rather than autonomous execution.
Indicators of Compromise (IoCs) include multiple SHA-256 hashes for malware samples, IP addresses (e.g., 45.88.188[.]140, 104.194.158[.]65), and domains (e.g., magento[.]ink, solidmonpe[.]com). Defenders should cross-reference these with local telemetry.
Source: https://cybersecuritynews.com/hackers-use-ai-generated-scripts/
Cybersecurity and Infrastructure Security Agency cybersecurity rating report: https://www.rankiteo.com/company/cisagov
"id": "CIS1792160740",
"linkid": "cisagov",
"type": "Cyber Attack",
"date": "10/2025",
"severity": "100",
"impact": "6",
"explanation": "Attack threatening the economy of geographical region"{'affected_entities': [{'industry': 'Government, Public Sector',
'type': 'Government organizations and state-affiliated '
'infrastructure'}],
'attack_vector': ['Malicious aliases in shell startup files',
'PHP login page manipulation',
'Web shells',
'Credential harvesting'],
'data_breach': {'data_exfiltration': True,
'file_types_exposed': ['Configuration files',
'Command histories',
'PHP files'],
'personally_identifiable_information': True,
'sensitivity_of_data': 'High (government and state-affiliated '
'data)',
'type_of_data_compromised': ['Credentials',
'Database records',
'Email communications',
'Personally Identifiable '
'Information (PII)']},
'date_detected': '2026-04',
'description': 'A sophisticated cyber campaign, tracked as CL-UNK-1211, '
'targeted government organizations and state-affiliated '
'infrastructure from October 2025 to April 2026, leveraging '
'AI-generated scripts to steal credentials, maintain '
'persistence, and exfiltrate sensitive data. The threat actors '
'manipulated Linux shell startup files (.bashrc) to intercept '
'the sudo command, captured passwords in real time, and used '
'custom malware (SysGoRAT), web shells, and '
'credential-harvesting techniques. The campaign employed '
'AI-generated code in scripts but did not involve autonomous '
'AI planning.',
'impact': {'data_compromised': 'Credentials, sensitive government data, '
'database records, email communications',
'identity_theft_risk': 'High (stolen credentials and PII)',
'operational_impact': 'Potential unauthorized access to government '
'systems, data exfiltration, and system '
'manipulation',
'systems_affected': ['Linux infrastructure',
'Windows systems (via SysGoRAT)',
'Web servers (PHP-based)']},
'initial_access_broker': {'backdoors_established': ['Web shells', 'SysGoRAT'],
'entry_point': ['Malicious aliases in .bashrc',
'PHP login page manipulation'],
'high_value_targets': ['Government mailboxes',
'Database records']},
'investigation_status': 'Ongoing',
'lessons_learned': 'The campaign demonstrated AI-assisted tool development '
'but relied on familiar Linux tools and social '
'engineering. Defenders should monitor for unusual system '
'modifications, preserve logs, and cross-reference IoCs '
'with local telemetry.',
'motivation': ['Data exfiltration', 'Credential theft', 'Persistence'],
'post_incident_analysis': {'corrective_actions': ['Monitor and audit shell '
'startup files (.bashrc)',
'Review PHP configurations '
'and login pages for '
'unauthorized changes',
'Enhance credential '
'security and logging',
'Deploy endpoint detection '
'and response (EDR) '
'solutions for '
'Linux/Windows systems'],
'root_causes': ['Manipulation of Linux shell '
'startup files',
'Credential harvesting via sudo '
'command interception',
'Deployment of web shells and '
'custom malware (SysGoRAT)']},
'recommendations': ['Review unexpected changes to .bashrc, PHP '
'configurations, and login pages',
'Monitor for unusual aliases, credential log files, and '
'outbound connections',
'Preserve logs and system evidence during investigations',
'Cross-reference IoCs (SHA-256 hashes, IPs, domains) with '
'local telemetry'],
'references': [{'source': 'Unit 42 (Palo Alto Networks)'}],
'response': {'enhanced_monitoring': ['Review unexpected changes to .bashrc, '
'PHP configurations, and login pages',
'Monitor for unusual aliases, credential '
'log files, and outbound connections'],
'third_party_assistance': 'Unit 42 (Palo Alto Networks)'},
'threat_actor': 'CL-UNK-1211 (Unattributed cluster)',
'title': 'AI-Assisted Cyber Campaign Targets Government and State-Linked '
'Linux Infrastructure (CL-UNK-1211)',
'type': 'Cyber Espionage'}