Attackers who spent months inside government Linux servers left an unusual clue behind: their scripts explained themselves. Researchers Roey Porat and Tom Fakterman of Palo Alto Networks Unit 42 found PHP and shell payloads full of conversational, step-by-step reasoning notes addressed to whoever had asked for the code, a pattern Unit 42 says suggests the code was generated with a large language model or run by an automated AI agent.
Unit 42 tracks the activity as CL-UNK-1211 and observed it from October 2025 to April 2026 against government entities and state-affiliated infrastructure. The "UNK" label means Unit 42 has not yet determined whether the operators are a nation-state or a criminal group. What they were after is clearer: the attackers tried to dump entire databases and to search government mailboxes for messages that would help them take over social media accounts tied to official email addresses.
What gives the AI away
According to the original report, the tell was not one comment but a set of habits: section headers inside scripts and shell commands, heavy use of Base64-encoded commands, and seamless switching between PHP, JavaScript, Bash and Python. AI help did not make the operators flawless. One script meant to zip up whole mailboxes for exfiltration contained a broken variable assignment and would have failed on execution.
It is the latest sign that attackers are using AI to speed up the routine plumbing of an intrusion, a theme that also ran through the ARTEX AI pentest agent linked to South Korean bank breaches.
A backdoor that loads before every PHP page
The intrusions leaned on web shells, some custom and some lifted from GitHub. To make them stick, the attackers rewrote the auto_prepend_file setting across every PHP configuration under /etc/php/ and /opt/plesk/php/, so that a malicious file such as /usr/lib/php/plesk_sys_driver.php loaded before any other PHP script on the server.
Credential theft came three ways. A doctored .bashrc aliased sudo to a fake password prompt that logged whatever users typed to a file named Solarwinds.StatusLog.txt; Unit 42 stresses there is no evidence SolarWinds systems were compromised and the name was only a disguise. A line inserted into a PHP login page forwarded administrator usernames and passwords. And the operators searched configuration and command history files for cleartext email, SMTP and database passwords.
They also deployed a custom remote access trojan written in Go, which Unit 42 named SysGoRAT. It runs on Windows and Linux, talks to its controller over WebSocket, and supports command execution, interactive shells and TCP proxying. On disk it hid under names such as sys-control-client, pip2.7 and ea_install. Reverse shells ran largely in memory across at least seven command-and-control servers.
Covering tracks by posing as a red team
The operators tried to kill Cortex XDR processes (Unit 42 says those attempts were detected and blocked), deleted single-use scripts immediately after running them, and timestomped long-lived files to make them look older than the attack. They wiped authentication, shell history, mail, web server and PHP session logs, then ran a script to confirm their IP addresses were gone. They also planted false flags, including the key RedTeamOps2025 and the password pentest123 for an account they created, to make the intrusion look like an authorised security test.
Audit PHP prepend settings and outbound shells
- Check auto_prepend_file across all PHP and Plesk configurations for entries you did not set.
- Review .bashrc files for aliases that wrap sudo or other privileged commands.
- Enforce strict outbound firewall rules and alert when standard utilities such as nc, bash or python spawn interactive network shells, as Unit 42 recommends.
- Do not accept "red team" strings in scripts as proof of an authorised test without confirming it with whoever owns the engagement.
- Block and hunt for SysGoRAT's default controller address, 104[.]194[.]158[.]65 on port 443.
None of these techniques is new on its own. What has changed is how quickly a small crew can produce, adapt and throw away the scripts that tie them together, which leaves defenders watching behaviour rather than file names.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.