AI-Written Scripts Helped Hackers Backdoor Government Linux Servers for Months, Unit 42 Says

Security researchers at Palo Alto Networks' Unit 42 have published a detailed look at a hacking campaign that spent months inside Linux servers run by government entities and state-affiliated organizations. The activity ran from October 2025 to April 2026, and what makes it stand out is how much of the attackers' tooling appears to have been written with help from AI.

Unit 42 tracks the group as CL-UNK-1211, according to its report published October 15 by researchers Roey Porat and Tom Fakterman. The "UNK" in the name is deliberate: under Unit 42's attribution framework it means the researchers have not determined whether the activity belongs to a nation-state or to cybercriminals. Unit 42 has not tied the cluster to any country, and the report does not name which AI tool or model the attackers used.

What Unit 42 did find were fingerprints. Several of the attackers' PHP and shell scripts contained conversational, step-by-step reasoning comments explaining the code to whoever asked for it, which the researchers say suggests the code was either copied straight from an AI model's output or run by an automated AI agent. Section headers inside scripts, heavy use of Base64-encoded commands, and smooth switching between PHP, JavaScript, Bash and Python fit the same pattern. AI help did not make the code flawless, though. A mailbox-collection script called zip_mails.sh contained a broken variable assignment and would have failed when run.

The attackers got their foothold with a mix of custom and open-source web shells on Linux web servers. To keep it, they changed the auto_prepend_file setting in every PHP configuration under /etc/php/ and /opt/plesk/php/, so a file of their choosing ran before any other PHP script on the server. In one case that file was a web shell disguised as /usr/lib/php/plesk_sys_driver.php.

Stealing passwords was a big part of the playbook. The attackers swapped in a modified .bashrc that aliased sudo to a fake password prompt, saved whatever the user typed to a log file named Solarwinds.StatusLog.txt, and then passed the password on to the real sudo so nothing looked wrong. Unit 42 says it found no evidence that SolarWinds systems were compromised; the name was just camouflage. The attackers also added a credential logger to a PHP login page and searched configuration files and shell history for email, SMTP and database passwords.

Their custom implant is a Go-based remote access trojan that Unit 42 named SysGoRAT. It runs on both Linux and Windows, talks to its operators over WebSocket, and by default connects to 104.194.158[.]65:443. It can run commands, open interactive shells, list directories, take screenshots, pull files and proxy TCP connections. On disk it went by names such as sys-control-client, pip2.7, ea_install and semanage. On Linux it can persist through a systemd service at /etc/systemd/system/sys-update.service or a cron entry that runs every five minutes.

The attackers went after government mail servers too. They enumerated /var/qmail/mailnames/, used a script called search_social.php to find messages tied to social media accounts, and dumped databases into local archives before trying to send them out over netcat or to file-hosting sites such as transfer[.]sh, bashupload[.]com, filebin[.]net and catbox[.]moe. Unit 42 describes these as exfiltration attempts and does not say how much data actually left.

They also worked hard to cover their tracks. Unit 42 describes attempts to kill endpoint security processes, which it says its own product blocked, deletion of authentication, mail, system and web server logs, backdated file timestamps with touch -t, and planted markers such as RedTeamOps2025 and the password pentest123 to make the intrusion look like an authorized penetration test. To get root, they ran LinPEAS and the public PwnKit exploit for CVE-2021-4034, then left hidden root shells behind, including a SUID copy of bash named .tourch, a SUID shell named .libsystemd-helper, and a renamed Python interpreter, /usr/lib/x86_64-linux-gnu/.libpython-helper. For tunneling they used revsocks, pysoxy and GSocket's gs-netcat, which ran from /dev/shm/.gs-10085/ under the fake kernel-thread name [kcached]. They also added their own SSH public key to a user's authorized_keys file for passwordless access, and the toolkit included a custom Go scanner for CVE-2025-55182 (React2Shell). Independent coverage from The Injection and GBHackers matches Unit 42's account.

Are you affected? Every check below comes from indicators in the Unit 42 report. Run them as root on Linux web, mail and database servers, especially Plesk hosts. A hit is a reason to investigate, not proof of compromise, and a clean result does not rule out activity the report did not cover.

• Look for an unexpected PHP prepend file, and for the known disguised web shell:

grep -rn 'auto_prepend_file' /etc/php/ /opt/plesk/php/ \
  2>/dev/null | grep -v '= *$'
ls -la /usr/lib/php/plesk_sys_driver.php

• Check every user's shell profile for a sudo alias and look for the password log:

grep -n 'alias sudo' /root/.bashrc /home/*/.bashrc
find / -xdev -name 'Solarwinds.StatusLog.txt' 2>/dev/null

• Hunt for the hidden root shells and the renamed Python interpreter:

find / -xdev \( -name '.tourch' -o -name '.libsystemd-helper' \
  -o -name '.libpython-helper' \) 2>/dev/null
find / -xdev -type f -perm -4000 -name '.*' 2>/dev/null

• Check for SysGoRAT persistence and binaries:

systemctl status sys-update.service
ls -la /etc/systemd/system/sys-update.service /usr/local/bin/
crontab -l
ls -la /var/spool/cron/ /var/spool/cron/crontabs/ 2>/dev/null
pgrep -af 'sys-control-client|pip2.7|ea_install|semanage'

• Look for GSocket running from shared memory under its fake name:

ps -eo pid,args | grep -E '\[kcached\]|gs-dbus|gs-netcat' \
  | grep -v grep
ls -la /dev/shm/ /dev/shm/.gs-10085/ 2>/dev/null
for p in /proc/[0-9]*; do
  grep -qa GSOCKET_ARGS $p/environ 2>/dev/null && echo $p
done

• Review SSH keys you did not add:

cat /root/.ssh/authorized_keys /home/*/.ssh/authorized_keys \
  2>/dev/null

• Search for the deception markers and the mail-search script:

grep -rlE 'RedTeamOps2025|pentest123' /tmp /var/www /home /root \
  2>/dev/null
find / -xdev \( -name 'search_social.php' -o -name 'zip_mails.sh' \) \
  2>/dev/null

• Search firewall, proxy and DNS logs for the network indicators in the table below, plus traffic to gsocket[.]io. Unit 42's report also lists SHA-256 hashes for the web shells, SysGoRAT tooling and the PwnKit binary.

Unit 42's own advice for defenders is to watch for changes to PHP configuration, unexpected sudo aliases, new services and outbound shell connections, to enforce strict outbound firewall rules, and to use behavioral endpoint detection that flags standard Linux utilities spawning interactive shells. If anything above turns up, treat the host as compromised: preserve evidence before cleaning, rotate every password typed on that machine, and check the servers it can reach over SSH and SQL.