Unit 42's AI-Assisted Linux Espionage Campaign Leaves Fingerprints You Can Check Today: a PHP Setting, a Sudo Alias and a Disguised Systemd Unit
If you run Linux servers that host websites, especially ones managed with Plesk, spend ten minutes on the checks below. Unit 42 at Palo Alto Networks published a report on October 15 about a campaign it tracks as CL-UNK-1211, which compromised government and state-affiliated Linux servers and databases from October 2025 to April 2026. The Hacker News covered it again on November 2, which is why it looks new. The report says attribution is unknown, and its "UNK" label means Unit 42 cannot yet say whether the actor is a government or a criminal group.
The headline detail is that the attackers' scripts read as if an AI wrote them, with conversational, step-by-step reasoning comments, section headers and heavy Base64. Unit 42 says that suggests either pasted model output or an automated agent, and it does not say which. For a defender the more useful detail is that the intruders left ordinary, checkable traces on the machine.
What Unit 42 found
Unit 42's report says initial access came through web shell deployment and credential harvesting. It does not say how the first shell landed. The attackers ran a custom Go scanner for React2Shell, CVE-2025-55182, during reconnaissance, but the report does not link that flaw to initial access.
After that the report describes a long toolbox:
- SysGoRAT, a custom remote-access tool written in Go for Windows and Linux, first seen under the name sys-control-client. It talks to its controller over a WebSocket and supports shell sessions, screenshots, file download and persistence.
- PHP web shells, including one at /usr/lib/php/plesk_sys_driver.php, kept alive by changing PHP configuration files under /etc/php/ and /opt/plesk/php/ so a malicious file loads before every script, using the auto_prepend_file setting.
- Password theft in two places. A hijacked .bashrc aliased sudo so that it captured the password and wrote it to a file named Solarwinds.StatusLog.txt. Unit 42 says SolarWinds was not compromised and the name was camouflage. Separately, code inserted into a PHP login page logged administrator credentials.
- Privilege escalation and movement, using LinPEAS, PwnKit (CVE-2021-4034), a renamed Python interpreter, a custom SUID shell, SSH key backdoors, sshpass with hardcoded credentials, SQL Server command execution and GSocket tunnels.
- Mailbox theft with a script that searched for social media account emails and another that archived mailboxes. The paths in the report point to Plesk-managed servers.
- Exfiltration of database dumps through four public file-sharing services. Those are legitimate platforms, not attacker infrastructure.
- Anti-forensics: log deletion, timestamp tampering with touch, self-deleting scripts, attempts to kill the endpoint agent, and planted decoy strings that look like a red team's, RedTeamOps2025 and pentest123.
What to check
- PHP configuration. Search every php.ini and conf.d file under /etc/php/ and /opt/plesk/php/ for an auto_prepend_file line, and look at what it points to. Many sites legitimately set it, so you are looking for a file you do not recognize.
- Sudo. Look in every user's .bashrc for an alias sudo line. Search the filesystem for a file named Solarwinds.StatusLog.txt.
- Services and binaries. Look for /etc/systemd/system/sys-update.service, an unfamiliar binary in /usr/local/bin/, and a program named sys-control-client. On Windows, look for %APPDATA%\Onedrive Update\Updater.exe.
- Hidden files. Look for /usr/lib/php/plesk_sys_driver.php, .libpython-helper under /usr/lib/x86_64-linux-gnu/, .libsystemd-helper, and .tourch.
- GSocket. Look for a directory under /dev/shm/ named like .gs-10085, and for processes disguised as [kcached] or gs-dbus.
- Egress. Servers rarely need to reach public file-sharing sites. Unit 42 recommends strict outbound firewall rules and detection for standard utilities spawning interactive shells.
- Keys and logs. Audit authorized_keys files, and treat missing or truncated authentication, shell and web server logs as a finding.
The decoy strings are not indicators to hunt for. They were planted to mislead.
What we do about it, and what we cannot
We are not a news site, so here is where we stand, as of this writing.
- The indicators are in the feed. We ingested Unit 42's whole indicator list on October 19, four days after it published: 10 file hashes, 17 IP addresses and 4 domains, 31 records at confidence 80 to 85. These are cited from Unit 42's report, not our own detections, and they are not a lead. We were four days behind.
- A correction. We first tagged all 31 records with the malware family SysGoRAT, including the React2Shell scanner, the PwnKit binary, the GSocket binary and the web shells, which are other tools. Today we relabeled them from Unit 42's own descriptions. The original ingest dates stay on the records. Only the SysGoRAT command address [104.194.158.65](https://analytics.dugganusa.com/stix/register?ref=ioc-click&q=104.194.158.65) keeps that label, because it is the one the report ties to SysGoRAT. Blocking was never affected by the label.
- Our edge. None of the 17 addresses appears in our edge block log. We checked the lookup against a known blocked address first. That covers blocks only, and the addresses sit at our edge shield's blocking floor, so they have been blocked on our own sites since the October 19 ingest. The scan does not cover the checks above, because those happen on your servers, not ours.
- The limits of a list. Cloud addresses get reassigned, so an IP from a report that is months old can belong to someone else now. The campaign ran from October 2025 to April 2026.
Free API keys for our blocklist feed are open to anyone. Take the hashes and domains as well as the addresses, since the filesystem checks above are what find a compromise that is already inside.
Limits
Everything about the campaign comes from Unit 42's report as read through a summarizing tool, not line by line. We did not test any of it, we hold no sample, and we cannot confirm the AI-authorship inference. The report's file-sharing sites and decoy strings are quoted as Unit 42 gave them.
Five percent of this is wrong somewhere. It always is.
Was this useful? Rate this post. The widget is at the bottom of the page, and we read every response.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.