Unit 42 says suspected AI-written scripts were used to spy on government Linux servers for months

TLDR

• Unit 42 tracks CL-UNK-1211, a campaign it says targeted government and state-affiliated Linux infrastructure from October 2025 to April 2026.¹
• Payloads contained conversational reasoning notes that suggest code generated by large language models or run by an AI agent.¹²
• Unit 42 has not determined whether the cluster is nation-state or cybercrime, so no country or group is named.¹

Unit 42 says the activity appeared aimed at intelligence gathering. The attackers deployed web shells, modified PHP settings for persistence and harvested credentials, including by hijacking the sudo command through .bashrc, alongside custom backdoors, one of which Unit 42 and IBTimes name SysGoRAT.¹²

Unit 42 says the attackers conducted extensive reconnaissance, dumped databases and tried to exfiltrate government mailboxes in order to reach social media accounts tied to government email addresses.¹ Its report also describes attempts to disable endpoint protections, erase logs, and plant deceptive red-team markers so the activity would look like a legitimate security assessment.¹

IBTimes Singapore, summarising the report, says one intrusion planted a PHP web shell and altered the auto_prepend_file setting so it would run before other PHP scripts, and that a .bashrc change captured a user's sudo password into a file named Solarwinds.StatusLog.txt, while Unit 42 stressed it found no evidence SolarWinds systems were compromised.² It also says one mailbox-exfiltration script contained syntax errors and would have failed.²

Unit 42's summary says the attackers relied on AI-generated payloads, but the supporting evidence is the style of the code, and its detailed wording is that the code "was either generated using large language models (LLMs) or executed by an automated AI agent".¹

Why it matters: this is a vendor's account of attackers apparently using AI to speed up payload creation against government Linux estates, and the inference rests on artefacts in the scripts, with no actor identified.¹