The malware explained every step to its operator. Is an AI agent behind it?

The scripts did more than run commands. They explained their logic to whoever had requested them. Unit 42 found those conversational notes inside tools used against government Linux infrastructure, a clue that an LLM helped produce the code. Whether an AI agent also ran the operation remains unresolved.

The underlying attack used familiar methods: web shells, stolen credentials, remote access tools and attempts to erase logs. For defenders, the useful question is where those actions become visible and which permissions let an attacker move from a web server to databases and official mailboxes.

What Unit 42 found

On October 15, 2026, Roey Porat and Tom Fakterman published Unit 42’s analysis of CL-UNK-1211. The observed activity ran from October 2025 to April 2026 and targeted government entities and state affiliated infrastructure. The attackers sought persistent access, sensitive databases and government email that could help them reach associated social media accounts.

The cluster has not been attributed to a known group. Unit 42 uses UNK when it has not determined whether the activity belongs to a nation state or cybercrime operation. An espionage objective does not, by itself, settle that attribution.

CL-UNK-1211 · EVIDENCE AND LIMITS

AI in the tooling. Autonomy still unproven.

REPORTED OBSERVATION

Scripts with conversational notes

Comments explain the code to an operator. Unit 42 assesses these artifacts as evidence of AI assisted development.

• Step by step explanations
• Structured sections
• Scripts in several languages

WHAT THIS DOES NOT ESTABLISH

Who selected and ran each step

The same artifact could be copied by a person or deployed by an agent. The public report does not resolve that distinction.

• No identified model
• No confirmed autonomous loop
• No measured speed increase

The attack, in six stages

The diagram groups the reported techniques by purpose. It is a reading guide, not a claim that every affected host followed one identical sequence.

REPORTED TECHNIQUES → DEFENSIVE EVIDENCE

From a web server to the records behind it

1. 01

   Keep a foothold

   Web shells and PHP configuration changes load attacker code repeatedly.

2. 02

   Collect credentials

   A modified shell profile, login hooks and stored passwords expose more accounts.

3. 03

   Maintain remote control

   SysGoRAT and reverse shells provide commands, proxying and file access.

4. 04

   Reach another system

   Database command execution, SSH access and tunnels connect internal segments.

5. 05

   Collect mail and databases

   Mailbox searches and database exports prepare sensitive records for transfer.

6. 06

   Hide the activity

   Log deletion, timestamp changes and security-agent termination attempts reduce visibility.

1. Persistence through PHP configuration

The attackers deployed custom and open source web shells, then modified auto_prepend_file across PHP configurations under /etc/php/ and /opt/plesk/php/. PHP loads the designated file before the requested script. One implant used the name /usr/lib/php/plesk_sys_driver.php to resemble a system component.

Deleting the visible web shell is not enough if another configuration still loads attacker code. An investigation needs both the configuration change and the referenced file, including its provenance, owner and content.

2. Credential theft during ordinary administration

A malicious sudo alias in .bashrc imitated the password prompt, recorded the password and passed it to the legitimate command. The administrator could complete the expected action while losing the credential. A file named Solarwinds.StatusLog.txt disguised the captured data. Unit 42 found no evidence of a SolarWinds compromise in this operation.

The attackers also inserted credential logging into a PHP login page and searched configuration and history files for email, SMTP and database passwords. Changing a password while the capture mechanism remains active can expose the replacement immediately.

3. SysGoRAT and reverse shells

Unit 42 named the custom Go remote access Trojan SysGoRAT. It supports Linux and Windows and communicates over WebSocket. Its default command and control address is 104.194.158[.]65, but the operator can change that destination at launch. The binary appeared under names such as sys-control-client, pip2.7 and semanage.

Its seven command types cover execution, shell input, directory listing and proxy operations. Additional control actions include screenshots, file retrieval and persistence through mechanisms such as systemd, cron, registry entries or scheduled tasks. A filename is therefore a weak identifier. Match it to the executable path, package inventory, process tree and network activity.

The campaign also used reverse shells built from standard utilities. Hunting should connect an unexpected interactive shell to its parent process and outbound socket, rather than assume that all malicious execution comes from a recognizable malware binary.

4. Movement through databases and SSH

The reported movement included a two-hop MSSQL xp_cmdshell chain, sshpass with hardcoded administrator credentials and additions to authorized_keys. Tunneling tools included revsocks, pysoxy and GSocket. A GSocket process was disguised as [kcached].

Network segmentation needs to account for the services allowed through it. A database server that can execute operating-system commands and reach another segment can become a bridge. Review the service account’s privileges along with the firewall rule.

5. Mailboxes as a route to other accounts

The attackers enumerated /var/qmail/mailnames/, counted messages and used search_social.php to locate social media notifications in email headers. Unit 42 shows a Facebook password-reset message as an example. The objective extended beyond reading mail to accessing accounts associated with government addresses.

WHY THE MAILBOX MATTERS

Account recovery can extend the breach

1. 01 · ACCESSOfficial mailbox

   Read messages and identify the account owner.

2. 02 · DISCOVERRecovery notifications

   Find linked services and password-reset messages.

3. 03 · ATTEMPTExternal account access

   Use the recovery path to pursue a linked account.

Review beyond the mail server

Check recovery methods, active sessions and administrator roles on linked services. Mail access alone does not establish that every external account was taken over.

The attackers also prepared database exports and attempted transfers through public file-hosting services. One mailbox-archiving script, zip_mails.sh, contained a broken variable assignment and would fail. That limits what can be inferred about that attempt. It neither disproves the broader intrusion nor establishes that AI caused the error.

6. Log wiping and misleading labels

Cleanup attempts targeted authentication, shell history, mail and web logs. The attackers changed file timestamps and tried to stop Cortex XDR processes. Unit 42 reports that the endpoint-protection termination attempts were detected and mitigated.

They also planted red-team-looking markers, including RedTeamOps2025 and pentest123. Verify an assessment against the actual authorization, named operators and agreed scope. A label inside an attacker-controlled file cannot establish permission.

What the AI evidence supports

The conversational explanations are the most distinctive artifacts in Unit 42’s account. Section headers, Base64 encoding and movement between PHP, JavaScript, Bash and Python are supporting observations. People and conventional automation use those patterns too. None is a reliable AI detector on its own.

AI assistance can reduce the work needed to produce or adapt a script. The public report does not quantify the time saved in this campaign or demonstrate that every component, including SysGoRAT, was generated by a model. It also does not establish that the operator lacked programming skills.

A separate September 3 Unit 42 investigation covered CL-CRI-1131 in Mexico and Ecuador and CL-CRI-1163 in Brazil. Exposed NextChat and staging infrastructure gave researchers visibility into AI tooling and iterative scripts. Those are distinct clusters, not evidence that the same actor conducted the Linux campaign.

For a security team, the practical change is planning for repeated variations of an attack rather than one fixed script. Test whether detection survives a renamed executable, a different scripting language or an alternate transfer destination. Attribution to a model is less urgent than establishing what ran and which account authorized it.

Indicators and durable signals

These are selected indicators from Unit 42’s October 15 report, not a complete blocklist. The values are defanged. Search historical telemetry with timestamps and host context; do not visit them. An address match warrants investigation, while an absent match does not clear a host.

Use the original report for the full indicator and hash lists.

Unexpected configuration writes

Changes to PHP startup configuration, shell profiles, SSH authorized keys and service definitions. Compare them with approved deployments.

System-looking executables

Investigate .libpython-helper, .libsystemd-helper, .tourch and suspicious bracketed process names. Check the executable and privileges, not just the displayed name.

Shells with network connections

Correlate named pipes, Netcat, Bash TCP redirection or Python socket activity with unexpected interactive shells and web-service parents.

Bulk reads followed by uploads

Mailbox or database reads, compressed archives and connections to services such as transfer.sh, bashupload.com, filebin.net or catbox.moe. These services can have legitimate uses; an unapproved upload from a production server is the signal.

Loss of visibility

Attempts to stop security processes, mass log deletion and timestamp changes. Correlate local events with telemetry retained outside the host.

What to check in your environment

Start with internet-facing PHP or Plesk hosts, mail servers and the database accounts reachable from them. These checks are useful whether the attacker wrote the scripts manually or used an AI tool.

1. Verify the relevant patches. PwnKit, CVE-2021-4034, affects polkit’s pkexec. Check the distribution’s fixed package, including backported fixes. Unit 42 also found a Go scanner for CVE-2025-55182. That is evidence of scanning capability, not proof that React2Shell provided entry. Inventory affected React Server Components packages and frameworks, then follow React’s current update guidance. Client-only React applications are outside that vulnerability’s scope.
2. Baseline executable configuration. Track PHP startup settings, shell profiles, SSH keys, cron and systemd units. For each change, retain the old value, new value, writer and approval record. An alert that names only the modified file leaves the analyst to reconstruct the important part.
3. Test Linux telemetry. Confirm that process ancestry, outbound connections and sensor tamper events reach the monitoring platform. Validate a benign test under an agreed scope. An installed security agent is not evidence that an alert reaches an on-call owner.
4. Restrict outbound access by workload. Document the destinations each server needs. Route approved transfers through a controlled path and alert on exceptions. Domain blocks alone will not stop a custom C2 endpoint or an already permitted service.
5. Review credentials and trust relationships. Remove embedded administrator passwords. Use scoped service identities and managed credentials where possible. Investigate added SSH keys and restrict database command execution. After a confirmed compromise, contain the credential capture path and rotate affected secrets from a trusted environment.
6. Keep evidence outside the host. Forward logs promptly to storage with separate administrative control. Monitor collection gaps and retention failures. Local records can still be useful, but a compromised administrator account may alter them.
7. Inventory agents with infrastructure access. Record their owners, execution accounts, tools, destinations and approval requirements. Test whether direct shell access or alternate credentials can bypass the intended permission check. This is a defensive design question, not evidence that a victim’s own agents were involved in CL-UNK-1211.

For a small team, choose one exposed service and verify that a configuration change and an unapproved outbound connection would both be noticed. For a larger estate, assign owners by service and operating-system family, then measure coverage rather than count deployed agents.

If these checks reveal active compromise, preserve available evidence and coordinate isolation, credential revocation and recovery. Patching a vulnerability does not remove an existing web shell, SSH key or stolen session.

Where Oktsec fits

In a scoped Oktsec Assessment, we can examine exposed services, credentials, permissions and persistence paths, then provide reproducible evidence for the findings. The systems, permitted tests and operating constraints are agreed before testing.

Organizations running AI agents have a related problem: deciding which actions those agents may execute against infrastructure. Oktsec Control applies configured policy to actions routed through its enforcement point. With node signing configured, it records signed evidence of those decisions. Cloud supports inventory and policy oversight; Signal reviews agent dependencies. These controls complement host monitoring, identity management and network restrictions. They do not intercept arbitrary malware or an agent’s unmediated shell access.

A useful assessment follows one action from the request to the execution account and destination. It checks both the approved route and any alternate path the agent can still reach. See our analysis of deployment-account authorization for that distinction.

Sources and scope

Reviewed October 18, 2026. The campaign facts and indicators are attributed to Unit 42. Oktsec did not investigate the affected organizations. The diagrams, detection guidance and assessment suggestions are our analysis of the cited reports.

1. Unit 42: AI-Powered Espionage Campaign Targets Government Linux Infrastructure. Roey Porat and Tom Fakterman, October 15, 2026.
2. Unit 42: Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America. September 3, 2026.
3. NVD: CVE-2021-4034, polkit privilege escalation.
4. NVD: CVE-2025-55182, React Server Components.
5. React: Critical Security Vulnerability in React Server Components. Affected packages, scope and updated patch instructions.