CL-UNK-1211: an AI-assisted intrusion set against government Linux web and mail servers persists through PHP auto_prepend_file, steals sudo passwords with a fake prompt and reads mail stores, and tries to pass as a red-team exercise

Unit 42 reports a campaign it tracks as CL-UNK-1211 (UNK: affiliation undetermined) against government entities and state-affiliated infrastructure between October 2025 and April 2026, concentrating on Linux servers for persistent access and intelligence collection (Unit 42, 2026-10-15). It names no victim or country and does not say how the web shells were first placed; the recovered tools include a custom Go scanner for CVE-2025-55182 (React2Shell) (Unit 42, 2026-10-15). The scripts carry conversational, step-by-step comments in the style of an AI model, which Unit 42 reads as LLM-generated code or an AI agent's work, an inference rather than a confirmed finding (Unit 42, 2026-10-15).

On the hosts, the attackers ran PHP web shells under the php-fpm parent process and rewrote auto_prepend_file in every PHP configuration under /etc/php/ and /opt/plesk/php/, so a planted file runs first (Unit 42, 2026-10-15). They replaced a .bashrc with a copy that, in one instance, aliases sudo to a fake password prompt that logs the input, searched configuration and history files for credentials, escalated with LinPEAS and the public PwnKit exploit (CVE-2021-4034), left root-SUID shells under hidden names and injected an SSH key into authorized_keys (Unit 42, 2026-10-15). They moved laterally with sshpass and hard-coded credentials and through an MSSQL double hop using xp_cmdshell, and kept access with SysGoRAT, a Go trojan that takes commands over WebSocket, plus the revsocks and pysoxy proxies and GSocket's gs-netcat, which ran from /dev/shm under a fake kernel-thread process name (Unit 42, 2026-10-15). On government mail servers they enumerated /var/qmail/mailnames/, counted mails in Maildir folders to pick targets and searched mail headers for social-media messages; they tried to exfiltrate database dumps over netcat and to public file-hosting platforms, to delete authentication, history, mail and system logs and to kill endpoint security processes, timestomped scripts with touch -t, and planted a red-team marker string and a pentest-style password to pass as an authorised exercise (Unit 42, 2026-10-15).

Triage: Plesk or PHP hardening can legitimately set auto_prepend_file and administrators do define sudo aliases; the report supports these discriminators: a prepended file with a vendor-like name outside the application tree, an alias that prompts for and logs the password, a log file named after another product, and red-team marker strings that no change record explains.