AI-Driven Attackers Target Government Linux Systems with Custom Malware

Attackers Used AI to Breach Government Linux Systems

A new report from Unit 42 describes a targeted espionage campaign against government Linux infrastructure. The attackers, tracked as the CL-UNK-1211 group, used a mix of custom malware, web shells, and advanced credential theft techniques. Their main targets were government entities and state-linked systems running Linux and database software. The attackers aimed to steal sensitive data and maintain long-term access to compromised systems. Unit 42↗ (opens in a new tab)

How the Attackers Got In and Stayed Hidden

The group gained initial access by deploying web shells, malicious scripts that let them control servers remotely, on Linux systems. They used both custom-built and open-source web shells, sometimes disguising them as legitimate files. To make sure their code ran every time the server started, they changed PHP configuration files to automatically load their web shells.

To avoid detection, the attackers tried to disable security software and tampered with system logs. This made it harder for defenders to spot the attack or trace what happened after the fact.

Credential Theft and Data Exfiltration

Once inside, the attackers focused on stealing credentials. They inserted malicious code into login scripts and configuration files to capture admin usernames and passwords. In some cases, they replaced the .bashrc file (a script that runs when a user opens a terminal) with a version that stole passwords when users entered them. They also created fake prompts that looked like normal system requests for passwords, tricking users into handing over their credentials.

The attackers searched for email, database, and other passwords stored in plain text on the system. They then dumped entire databases and tried to exfiltrate (steal) the data.

AI’s Role in the Attack

Unit 42 found strong evidence that the attackers used artificial intelligence (AI) to generate parts of their attack tools. Scripts included step-by-step reasoning notes and section headers typical of AI-generated code. This suggests the attackers either copied code directly from an AI tool or used an automated AI agent to create and deploy their malware.

AI helped the attackers quickly create and adapt their tools, making their operations more efficient. The use of AI also left unique traces, such as conversational comments and structured code sections, which researchers used to identify the campaign.

Custom Malware and Advanced Techniques

The attackers deployed a custom remote access Trojan (RAT) called SysGoRAT, written in Go. This malware works on both Windows and Linux, supports multiple ways to stay persistent, and communicates with attacker-controlled servers over encrypted WebSocket connections. The group also used in-memory reverse shells, which run commands and send data back to the attackers without leaving files on disk, making them harder to detect.

What Happens Next

So far, only Unit 42 has reported on this campaign, and it is not yet clear how many organisations or individuals were affected. There is no evidence that SolarWinds systems were compromised, despite the attackers using the SolarWinds name to hide their activity. Defenders should look for signs of unusual PHP configuration changes, unexpected web shells, and suspicious entries in login scripts or configuration files.

Practical Steps for Defenders

Security teams running Linux infrastructure should review PHP and shell configuration files for unauthorised changes. Monitoring for new or modified web shells, especially those disguised with legitimate names, is critical. Regularly checking for unusual admin activity and reviewing logs for signs of tampering can help spot similar attacks. Updating endpoint protection and using strong credential management practices can reduce the risk of compromise.

What We Don’t Know

At this stage, the campaign has only been reported by one source, and details about the scale of the attack or specific victims remain unclear. The story will likely develop as more organisations investigate and report their findings.