AI-Assisted Scripts Compromise Linux Servers to Steal Admin Credentials and Deploy Backdoors
Hackers used AI-generated code to hijack government Linux systems, modify PHP settings for persistence, and capture administrator passwords via spoofed prompts.
Key points
- Attackers deployed AI-assisted scripts between October 2025 and April 2026 to target government Linux infrastructure.
- The campaign involved modifying PHP auto_prepend_file settings to force execution of malicious code across web applications.
- Unit 42 tracks the activity as CL-UNK-1211, noting that the group remains unattributed and motivation is unclear.
Cyber threat actors utilized artificial intelligence tools to compromise government Linux servers, harvest administrator credentials, and install persistent backdoors during a campaign observed from October 2025 through April 2026, according to a report by GBHackers. Palo Alto Networks Unit 42 tracks this specific activity cluster as CL-UNK-1211, documenting reconnaissance efforts, database extraction attempts, and procedures aimed at stealing government email data linked to social media accounts.
The attackers employed a mix of custom and publicly available web shells to maintain access. They modified the PHP auto_prepend_file configuration within directories such as /etc/php/ and /opt/plesk/php/, ensuring that a designated malicious file executed before any other PHP scripts. One of these implants disguised itself as a legitimate system file, specifically /usr/lib/php/plesk_sys_driver.php, to avoid detection while extending persistence across hosted applications.
Technical Indicators and AI Usage
Researchers identified conversational annotations and step-by-step developer reasoning embedded within malicious PHP and shell scripts. These artifacts suggest that operators copied output from large language models directly into their payloads or utilized an automated AI agent to generate code. The presence of Base64-encoded commands, structured section headings, and code switching between PHP, JavaScript, Bash, and Python supported this assessment, although these indicators do not independently prove fully autonomous operation.
Despite the use of AI assistance, the resulting code was not always functional. A script named zip_mails.sh, designed to collect mailbox data, contained malformed variable assignment syntax that would have caused execution failure. This distinction limits claims about successful email theft or the effectiveness of fully automated intrusion techniques, indicating that human oversight or flawed AI output played a role in the campaign's technical execution.
Credential Theft Methods
The group employed sophisticated social engineering techniques within the command line to capture secrets. Attackers modified the .bashrc file to create an alias for the sudo command, which displayed a convincing password prompt to the user. The script recorded the entered secret before forwarding the request to the legitimate sudo execution, allowing the attacker to log the credentials in a file named Solarwinds.StatusLog.txt. Researchers found no evidence that SolarWinds infrastructure was actually compromised; the filename was used merely to impersonate routine software activity.
Additional methods included modifying PHP login pages to capture administrator credentials and searching configuration files and command histories for exposed SMTP, email, and database passwords. The toolkit also featured SysGoRAT, a custom remote access Trojan written in Go that supports both Linux and Windows environments, providing operators with remote control capabilities over compromised systems.
What should you do?
Security teams should monitor for unusual modifications to PHP configuration files, particularly auto_prepend_file settings, and review logs for unexpected execution of web shells. Administrators should audit .bashrc files for suspicious aliases that intercept standard commands like sudo. Organizations should also scan for unknown files masquerading as legitimate system drivers or libraries within standard PHP directories.
Background: Large language models
Large language models are a specific type of neural network trained on text. Generative AI is the broader umbrella term for any system that creates new content, including images and code. Not all generative AI uses large language models, but most modern text generators do.
What to do and how to stay safe: Linux
- Audit PHP configuration files for unauthorized changes to auto_prepend_file directives that could force execution of malicious scripts.
- Review shell initialization files such as .bashrc for aliases that intercept and log credentials from standard commands like sudo.
- Monitor web server directories for unknown files disguised as legitimate system components, such as plesk_sys_driver.php.
- Scan for the presence of the SysGoRAT remote access Trojan, which supports both Linux and Windows platforms.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Is this attack group attributed to a specific nation-state or criminal organization?
No, the cluster remains unattributed. Under Unit 42’s framework, it is labeled "UNK," indicating that researchers have not determined whether the activity is state-sponsored or financially motivated.
Did the attackers successfully steal emails using the AI-generated scripts?
Evidence is limited. A key script for collecting mailboxes contained syntax errors that would have caused execution failure, suggesting that fully automated email theft may not have succeeded.
Was SolarWinds software compromised in this campaign?
No. Researchers found no evidence that SolarWinds infrastructure was compromised. The attackers merely used a log file named Solarwinds.StatusLog.txt to impersonate routine software activity.
