CL-UNK-1211 Deploys SysGoRAT Malware and AI Scripts Against Government Linux Servers
Do Son 
Interactive web shell activity, as shown in Cortex XDR
At a Glance
| Malware Family | SysGoRAT malware (cross-platform Go remote access trojan), PHP web shells, and AI-generated bash and PHP scripts |
| Threat Actor | Confirmed as cluster CL-UNK-1211; nation-state versus cybercrime affiliation remains undetermined |
| Target / Victims | Government entities and state-affiliated Linux, mail, and database infrastructure (active from October 2025 to April 2026) |
| Delivery Vector | Custom and open-source PHP web shells deployed on enterprise Linux and Plesk web servers |
| Key Capabilities | WebSocket C2 control, TCP network proxying, PHP auto_prepend_file hijacking, sudo password interception, mailbox and database theft |
| Sources | Palo Alto Networks Unit 42 |
TL;DR
Between October 2025 and April 2026, threat cluster CL-UNK-1211 attacked government Linux servers using AI-generated scripts and a custom Go backdoor. Specifically, the attackers deployed SysGoRAT malware alongside persistent PHP web shells to steal administrative passwords, databases, and government mailboxes. Furthermore, the CL-UNK-1211 SysGoRAT malware campaign searched stolen emails to hijack official government social media accounts.
Delivery and Attribution
The campaign began in October 2025 and ran through April 2026 against government and state-affiliated Linux servers. Attackers established initial access by dropping custom and open-source PHP web shells onto targeted web servers. Thereafter, the operators used the web server process to fetch additional scripts from public file-hosting platforms into shared memory directories. In addition, the intruders renamed system binaries such as the Python 3 interpreter and the Bash shell to read local password and shadow files.
Confirmed Versus Suspected Attribution
Analysts track this operation under the confirmed cluster designation CL-UNK-1211. According to the Unit 42 research report, “We designate the term UNK to clusters of activity whose affiliation with either nation-state or cybercrime activity we have not yet determined.” While the focus on government mailboxes and intelligence collection resembles state espionage, suspected attribution to a specific country remains unconfirmed.
Notably, multiple PHP and shell scripts recovered during the investigation contained conversational reasoning comments written by large language models. As the researchers explained, “Rather than standard developer documentation, multiple scripts contained conversational, step-by-step reasoning notes.” Moreover, the scripts used structured section headers, heavy Base64 encoding, and rapid switching between PHP, JavaScript, Bash, and Python. These traits indicate that the operators copied outputs directly from an AI assistant or ran an automated AI agent.
Infection Chain
To keep long-term access on compromised servers, the attackers disguised a PHP web shell as a legitimate Plesk system driver file. Next, they modified every PHP configuration file under the default system and Plesk directories. By setting the global auto-prepend directive to point to their rogue file, the web shell ran automatically before any legitimate PHP page loaded.
Credential Harvesting Methods
Once inside, CL-UNK-1211 harvested credentials using three distinct techniques. First, the attackers modified the user shell profile file to create a fake alias for the sudo command. Whenever an administrator ran sudo, the script displayed a fake password prompt and saved the typed password into a Base64-encoded text file inside shared memory. To avoid suspicion, the attackers named the log file after SolarWinds, although no SolarWinds software was compromised. Second, the actors injected a single line of code into a PHP administrator login page to write valid usernames and passwords to a local file. Third, they scanned command history files and WordPress configuration files for cleartext database and SMTP passwords.
Command-and-Control and Data-Exfiltration Behavior
Following credential theft, the operators deployed the CL-UNK-1211 SysGoRAT malware on targeted hosts. Written in Go, this cross-platform trojan runs on both Windows and Linux systems. To blend in with normal system files, the attackers renamed the binary on disk to look like package managers or system control utilities. The SysGoRAT malware connects to its command server over an encrypted WebSocket channel on port 443. Although the binary includes a hardcoded fallback IP address, operators can pass a custom server address via command-line flags. Once connected, the backdoor supports seven core commands for running shell scripts, listing directories, spawning interactive shells, and relaying TCP proxy traffic.
In-Memory Shells and Mailbox Theft
Alongside the Go backdoor, the attackers opened in-memory reverse shells across at least seven distinct command servers. Using Netcat named pipes, Bash TCP redirects, and Python network sockets, they ran interactive commands without writing extra files to disk.
With persistent access secured, the intruders targeted official government Qmail servers. After counting messages in user mail directories, they ran an AI-assisted PHP script to scan the first four kilobytes of email headers for references to Facebook, Instagram, Twitter, TikTok, and LinkedIn. Specifically, the actors hunted for password reset emails to take over government social media profiles. They also attempted to compress entire user mailboxes into ZIP archives and dump backend databases, although one AI-generated compression script failed due to a broken variable assignment.
Defense and Detection Guidance
Throughout the intrusion, the group used aggressive anti-forensic methods to hide their presence. They ran process-termination commands to kill Cortex XDR security agents, modified file timestamps using the touch utility, and planted fake red-team strings such as pentest123 to mimic an authorized security audit. After stealing data, the operators ran cleanup scripts to truncate web, mail, and authentication logs to zero bytes before checking if their IP addresses remained in the logs.
Because the SysGoRAT malware and in-memory shells hide behind standard system names, defenders must enforce strict outbound firewall rules on Linux servers. Security teams should monitor PHP configuration files for unauthorized auto-prepend changes and audit shell profile files for rogue sudo aliases. Finally, administrators should deploy behavioral endpoint protection on Linux hosts to block unauthorized process termination and catch interactive shells spawned by web server processes.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
