Hackers used AI-generated scripts to hijack Linux sudo commands, steal user passwords and maintain persistent access inside government and state-affiliated infrastructure, according to new research from Palo Alto Networks Unit 42.
The campaign, tracked as CL-UNK-1211, was observed between October 2025 and April 2026 and focused heavily on Linux systems.
Instead of exploiting a vulnerability in sudo, the attackers modified users’ .bashrc files and created a malicious alias that intercepted passwords while still allowing the real command to run normally.
Unit 42 also found web shells, credential-stealing PHP code, custom malware, mailbox searches and anti-forensics activity across the intrusion.
For broader coverage of AI-assisted cyber threats, see our AI-Era Threats and Agentic Security Guide.
Key Takeaway
The CL-UNK-1211 campaign shows how attackers are using AI to speed up traditional post-exploitation work rather than replacing established hacking techniques entirely.
Researchers found scripts containing conversational comments and step-by-step reasoning that appeared consistent with code generated by large language models or automated AI agents.
The attackers then used those scripts for credential theft, persistence, reconnaissance, data collection and cleanup.
The most notable technique involved replacing a Linux user’s .bashrc file with one containing a malicious sudo alias.
Hackers Hijacked Linux Sudo Without Exploiting Sudo
The attackers did not compromise the sudo binary itself.
Instead, they changed the shell environment.
Unit 42 observed attackers replacing a user’s .bashrc file with a modified version containing an alias for the sudo command.
When a victim typed:
sudo commandthe malicious alias displayed a password prompt that looked like the legitimate system prompt.
The entered password was captured and written into an attacker-controlled log file.
The same password was then passed to the legitimate sudo command, allowing the requested action to complete normally.
This made the credential theft much less obvious to the user.
Passwords Were Written to a Fake SolarWinds Log File
The attackers stored intercepted passwords inside a file named:
Solarwinds.StatusLog.txtThe filename appears designed to make the artifact look like legitimate system or monitoring activity.
Unit 42 explicitly said it found no evidence that SolarWinds systems or infrastructure were compromised in this operation.
The SolarWinds name was simply misused as part of the attackers’ evasion strategy.
AI-Generated Scripts Appeared Throughout the Campaign
Unit 42 found multiple malicious PHP and shell scripts containing structural patterns consistent with AI-assisted code generation.
Researchers highlighted several indicators:
- Conversational code comments
- Step-by-step reasoning notes
- Detailed explanations of script logic
- Section headers designed to organize command output
- Frequent Base64-encoded commands
- Rapid switching between PHP, JavaScript, Bash and Python
These characteristics suggested that some of the code may have been copied directly from AI-generated responses or produced through an automated AI agent.
AI Did Not Necessarily Run the Entire Attack
The presence of AI-generated code should not be interpreted as proof that an autonomous AI system independently planned and executed the campaign.
Unit 42’s evidence supports AI-assisted payload generation and adaptation.
Human operators still demonstrated strong Linux knowledge and used established post-exploitation techniques throughout the intrusion.
The practical lesson is that AI can reduce the time needed to create operational scripts even when the underlying attack methods are familiar.
Attackers Also Modified PHP Login Pages
The credential theft extended beyond shell commands.
Unit 42 found malicious code inserted into PHP login pages that captured administrator usernames and passwords.
When an administrator logged in, the modified PHP code forwarded the credentials to attacker-controlled storage.
The operators also searched files and command histories for:
- Email credentials
- SMTP passwords
- Database usernames and passwords
- Application configuration secrets
Attackers Deployed Multiple Web Shells
CL-UNK-1211 used both custom and publicly available web shells to maintain access to compromised Linux servers.
In one observed case, attackers modified PHP configuration values under:
/etc/php/
/opt/plesk/php/They changed the auto_prepend_file setting so a malicious PHP file would automatically execute before other PHP applications.
A web shell was placed at:
/usr/lib/php/plesk_sys_driver.phpThe filename was chosen to appear legitimate.
SysGoRAT Provided Long-Term Remote Access
Unit 42 also discovered a custom remote access Trojan called SysGoRAT.
The malware is written in Go and can run on both Linux and Windows systems.
Its capabilities include:
- Remote command execution
- Interactive shell access
- Directory listing
- File access
- TCP proxying
- Persistence
- Screenshot capture
- File download and exfiltration
The malware communicates with command-and-control infrastructure over WebSocket.
Unit 42 observed a default C2 address of:
104.194.158[.]65:443although operators could change the destination at launch.
SysGoRAT Was Disguised as Legitimate Software
The attackers renamed SysGoRAT binaries to make them blend into compromised systems.
Observed names included:
sys-control-clientpip2.7ea_installsemanage
These names were designed to resemble normal administrative tools or software components.
Attackers Used In-Memory Reverse Shells
The campaign also used several reverse-shell techniques designed to minimize files written to disk.
Unit 42 observed:
- Netcat-based named-pipe shells
- Bash TCP redirection
- Python subprocess-based reverse shells
Operating mainly in memory can reduce the number of obvious forensic artifacts left behind.
Government Mailboxes Were Searched for Sensitive Data
The attackers examined government mail servers and searched for emails associated with social media accounts.
They inspected mailbox directories and looked for messages containing references to platforms such as:
- Twitter/X
- TikTok
The goal appeared to be identifying accounts that could potentially be accessed or targeted using information contained in government email systems.
Attackers Attempted to Archive Entire Mailboxes
Unit 42 also found a script designed to package mailbox contents into ZIP archives for exfiltration.
However, researchers found syntax errors in one observed version of the script.
That specific sample would not have worked correctly as written.
This is an important distinction because observed attacker tooling is not always fully functional.
Database Theft Was Also Attempted
The attackers searched compromised environments for databases and attempted to collect sensitive government information.
Unit 42 found evidence of commands designed to dump database contents and prepare the data for exfiltration.
The campaign therefore went beyond simple credential theft and appeared focused on long-term intelligence gathering.
Attackers Tried to Disable Endpoint Security
CL-UNK-1211 operators attempted to terminate endpoint-security processes using common Linux utilities such as:
pgrep
pkillUnit 42 said Cortex XDR detected and blocked the observed attempts to terminate its agent.
That finding applies to the systems observed during the investigation and should not be interpreted as proof that every malicious action in the campaign was prevented.
Attackers Deleted Scripts After Running Them
Many attack commands followed a simple cleanup pattern:
- Create a script
- Execute it
- Delete the script immediately
This reduced the amount of malicious code left behind for investigators.
Timestomping Helped Hide Persistent Files
For malware and scripts that needed to remain on disk, attackers changed file timestamps using the Linux touch command.
This technique, known as timestomping, makes recently created malicious files appear older than they really are.
That can mislead analysts reviewing a compromise timeline.
Fake Red-Team Markers Were Used as Deception
Unit 42 found strings such as:
RedTeamOps2025
pentest123inside attacker activity.
Researchers believe these markers were intended to make malicious actions look like authorized penetration-testing or red-team work.
Security teams should therefore verify suspicious activity rather than assuming that a “red team” label proves legitimate authorization.
Attackers Tried to Erase Logs and Shell History
The operators attempted extensive forensic cleanup after completing their activity.
They targeted logs associated with:
- Authentication
- Shell commands
- Email systems
- Operating system events
- Web servers
- PHP sessions
They also checked whether attacker IP addresses remained visible inside log files after cleanup.
Why the Linux Sudo Trick Is Effective
Linux users are trained to enter their password when sudo requests elevated privileges.
That normal behavior creates an opportunity for attackers who already have enough access to modify shell startup files.
If the fake prompt behaves correctly and still runs the requested command afterward, a victim may see no obvious sign that the password was intercepted.
This technique therefore targets user trust in a familiar administrative workflow rather than a software vulnerability.
This Is Not a Sudo Zero-Day
The reported campaign should not be described as a Linux sudo zero-day.
No flaw in sudo itself was required for the password-stealing technique.
The attackers modified .bashrc so the shell executed an attacker-controlled alias before the legitimate sudo command.
Updating the sudo package alone would not remove that malicious shell configuration.
How Defenders Can Detect Bashrc Tampering
Linux administrators should review user shell startup files for unexpected changes.
Important files can include:
~/.bashrc~/.bash_profile~/.profile/etc/bash.bashrc/etc/profile
Teams should specifically search for unusual aliases or functions replacing commands such as sudo, ssh or other administrative utilities.
Check Whether Sudo Has Been Aliased
Administrators can inspect how the shell resolves the sudo command using:
type sudo
alias sudoA normal environment should not unexpectedly redirect sudo through a custom password-capturing script.
Unexpected aliases should be investigated alongside file-modification timestamps, process history and endpoint telemetry.
Monitor Unexpected Credential Log Files
Organizations should also search for suspicious files that may contain harvested passwords.
In this campaign, the attackers used:
Solarwinds.StatusLog.txtThe presence of this filename alone is not proof of compromise, but it should be investigated together with other indicators from the Unit 42 report.
Review PHP Configuration for Persistence
Linux web servers should be checked for unauthorized changes to auto_prepend_file settings.
Administrators should also investigate unexpected PHP files placed in system directories or Plesk-related paths.
Any file automatically loaded before legitimate PHP applications can become a powerful persistence mechanism.
Monitor East-West and Outbound Connections
SysGoRAT and the reverse shells observed in the campaign relied on outbound communication toward attacker infrastructure.
Defenders should monitor unusual WebSocket sessions, unexplained outbound TCP connections and server processes establishing interactive shell traffic.
Strict outbound firewall rules can reduce the ability of compromised systems to reach arbitrary command-and-control servers.
Preserve Evidence Before Cleanup
If CL-UNK-1211-style activity is suspected, administrators should avoid immediately deleting every suspicious artifact without preserving forensic evidence.
Collect:
- Modified shell startup files
- PHP configuration
- Web server logs
- Authentication logs
- Process telemetry
- Network connection records
- Suspicious binaries
- Command history where available
This evidence can help determine how long attackers were present and what credentials or data may have been accessed.
AI Is Accelerating Traditional Cyber Operations
The CL-UNK-1211 campaign is notable because the attackers did not rely on a futuristic autonomous malware system.
Instead, AI appears to have helped them generate and adapt ordinary operational scripts more quickly.
That mirrors a broader shift toward threat actors using generative AI as a development assistant for malware, reconnaissance and attack automation.
CyberUpdates365 previously examined this trend in our coverage of PROMPTFLUX malware using Google’s Gemini API to generate and modify malicious code.
The two cases are different: PROMPTFLUX was described by Google as experimental malware, while CL-UNK-1211 represents an observed intrusion campaign where Unit 42 found AI-assisted scripting artifacts.
What Security Teams Should Do Now
Organizations operating Linux servers should:
- Audit
.bashrcand other shell startup files - Search for unexpected command aliases
- Review PHP
auto_prepend_filesettings - Investigate unfamiliar PHP web shells
- Monitor cleartext credential searches
- Review server-to-internet WebSocket connections
- Detect attempts to erase shell history or system logs
- Monitor unusual use of
pgrepandpkillagainst security processes - Apply least-privilege controls
- Segment sensitive government and enterprise servers
- Rotate credentials if password interception is suspected
Frequently Asked Questions
What is CL-UNK-1211?
CL-UNK-1211 is the name Unit 42 uses for a cluster of cyber activity targeting government organizations and state-affiliated infrastructure.
Did attackers exploit a sudo vulnerability?
No. The attackers modified Linux .bashrc files to create a malicious sudo alias that captured passwords before passing them to the legitimate command.
Were AI-generated scripts used?
Unit 42 found conversational comments, reasoning notes and other patterns consistent with AI-assisted code generation or automated AI-agent use.
Did AI autonomously execute the entire attack?
There is no evidence establishing that AI independently planned and executed the entire campaign. The research supports AI-assisted payload creation and adaptation.
What malware did the attackers use?
Unit 42 identified a custom Go-based remote access Trojan called SysGoRAT, along with web shells, reverse shells and other tools.
Who was targeted?
The observed campaign targeted government entities and state-affiliated infrastructure.
Who is behind CL-UNK-1211?
Unit 42 has not attributed the cluster to a known nation-state or cybercriminal group. The UNK designation means its affiliation remains undetermined.
Final Takeaway
The CL-UNK-1211 campaign demonstrates how attackers can combine AI-assisted development with well-established Linux intrusion techniques.
By modifying .bashrc, the attackers were able to intercept sudo passwords without exploiting a vulnerability in sudo itself.
The same operation used web shells, custom malware, credential harvesting, mailbox searches and anti-forensics techniques to maintain long-term access and collect sensitive information.
The AI component matters because it can reduce the effort required to generate and adapt operational scripts, but the campaign remains fundamentally a human-directed intrusion using familiar post-exploitation methods.
