AI-Assisted Linux Intrusions Pair SysGoRAT With Mailbox and Database Theft

AI-generated code appears to have helped an intrusion group move quickly across Linux environments, but the operation’s most consequential features were familiar: web shells, credential theft, remote access tools and deliberate efforts to erase evidence. The researchers have not determined whether the cluster is linked to a nation-state or cybercrime activity.

The investigation describes an operation built around persistent access and intelligence gathering. Attackers targeted Linux servers, searched for credentials and mapped internal networks. They also attempted to collect mailboxes, social media account details and database contents. Their toolkit combined open-source utilities, custom malware, PHP and shell scripts, and numerous web shells.

What stands out is the evidence of AI-assisted development. Several scripts contained conversational annotations and step-by-step reasoning comments, rather than ordinary documentation. Unit 42 says the material suggests the scripts were copied from large language model output or created and deployed by an automated AI agent. That evidence points to a change in how parts of the operation may have been produced; it does not establish that AI independently directed the intrusion.

Scripts that explain themselves

The malicious PHP and shell scripts supported reconnaissance, persistence and data theft. Their inline comments reportedly explained the purpose and logic of code in a conversational style, as if the notes were intended to guide an operator who had given the initial instructions. Unit 42 also describes other characteristics consistent with AI-assisted code generation, though the source does not enumerate them.

That distinction matters for defenders. Comments can offer clues about how a payload was assembled, but they do not prove which model or workflow produced it. The practical concern is that an operator can use generated code to produce or adapt scripts without manually writing every component. The observed activity still depended on access to target systems, working credentials or vulnerabilities, and tools capable of running commands there.

Unit 42 assigned the activity the identifier CL-UNK-1211 under its attribution framework. “UNK” marks a cluster whose affiliation remains undetermined. The designation describes the researchers’ current confidence about the group, not a conclusion about who was responsible.

Persistence through PHP and a Go backdoor

Web shells were a central access mechanism. The attackers deployed custom and open-source shells on Linux servers, including tools available on GitHub. One persistence method changed the PHP auto_prepend_file setting across configuration directories under /etc/php/ and /opt/plesk/php/. PHP loads a file specified by this setting before running another PHP script, so an attacker can use it to execute malicious code repeatedly as web requests arrive. The latter directory also holds configuration for Plesk.

In one instance, a malicious shell was placed at /usr/lib/php/plesk_sys_driver.php, a name chosen to resemble a legitimate system component. The attackers then configured PHP to load it automatically. This approach ties persistence to application configuration: removing the visible web shell alone may not be enough if the altered setting remains in place.

The cluster also used a custom remote access Trojan written in Go. Unit 42 named it SysGoRAT after first observing the binary under the benign-looking filename sys-control-client. The malware can run on both Windows and Linux and supports several persistence methods. Its command-and-control connection uses WebSocket at wss://<addr>/ws. The default address is the hardcoded IP 104.194.158[.]65:443, which an operator can change with a command-line parameter.

SysGoRAT accepts seven command types, with additional control actions described in the researchers’ Appendix A. Its persistence options use filenames intended to blend in with legitimate software. The source does not list the seven command types or all of the filenames in its main text, so their precise scope cannot be assessed here.

In addition to the Go backdoor, the attackers used reverse shells across at least seven distinct command-and-control servers. These shells operated mostly in memory, using built-in system utilities to reduce files left on disk. Unit 42 recommends strict controls on outbound connections and monitoring for ordinary system tools spawning interactive shells. Its report says Cortex XDR detected and stopped a reverse-shell command in one observed instance.

Credential collection across shells, logins and config files

Credential theft reached into several parts of the Linux environment. In one technique, attackers replaced a user’s .bashrc file with a modified copy. The change created an alias for sudo that intercepted a user’s password, then passed the harvested password to the legitimate command so the request could appear to work normally. The captured value was written to a file named Solarwinds.StatusLog.txt, chosen to suggest routine activity tied to the SolarWinds name. Unit 42 says it found no evidence that SolarWinds systems or infrastructure were compromised.

The attackers also inserted code into a PHP login page, apparently targeting a database authentication flow. When an administrator signed in, the added code sent the username and password to an attacker-controlled log file. Elsewhere, scripts searched configuration files and command histories for email, SMTP and database passwords stored in clear text.

These methods show why reviewing only executable files can miss an intrusion. A shell startup file, a web login page or an application configuration file can become a credential collection point. Changes to those files can also outlast the process that first introduced them.

Mapping networks and reaching internal servers

After gaining access to Linux systems, the attackers sought higher privileges and broader reach. They ran LinPEAS, an open-source tool for identifying possible local privilege escalation paths, then attempted to use PwnKit, a self-contained exploit associated with CVE-2021-4034, to gain root access. The source says that, after obtaining root privileges, they installed binaries intended to retain that access, but does not name those binaries in the available text.

Multiple PHP scripts scanned for SQL servers, enumerated databases and collected domain information such as users, computers and open shares. A custom Go scanner also searched for servers vulnerable to CVE-2025-55182, known as React2Shell. The report describes the scanner’s existence but provides no results showing how many systems it found or whether those systems were exploited.

To move beyond the first compromised web server, the attackers combined database functionality, malware and proxy tools. They used a web shell to deploy Base64-encoded PHP scripts and enabled command execution on an internal Microsoft SQL Server through XP_CMDSHELL. From there, a double-hop chain routed commands through one SQL server to another on a separate network segment. The operators tested the route and ran operating-system commands on the second system.

They also used sshpass with hardcoded administrative credentials to connect to internal Secure Shell targets. After a successful connection, they ran follow-up commands and added an SSH public key to a compromised user’s authorized_keys file. That change enables passwordless remote access for whoever holds the corresponding private key. Tunneling and proxy tools provided additional ways to route traffic through the network.

Mailbox discovery and attempted data theft

Email was a route to both messages and external accounts. The attackers enumerated /var/qmail/mailnames/ across several domains, then counted messages in users’ Maildir/cur/ directories to identify potential targets. A PHP script named search_social.php looked for selected terms in email headers and displayed matching messages with their file paths, sender, recipient and subject. The stated aim was to find social media related messages and accounts connected to government email addresses.

After locating candidate messages, the operators attempted to create zip_mails.sh, a script intended to traverse user directories and compress mailbox contents into ZIP archives. That design would collect entire mailboxes, rather than only the messages identified by the search script. In the observed version, a malformed variable assignment, user=\;), would cause the script to fail. The attempt is evidence of intent and preparation, not proof that the mailbox archive was successfully created or transferred.

The database collection followed a staged pattern. The attackers first printed small samples of data to the terminal, using SQL TOP clauses to limit output. They then attempted to write four tables, with up to 100 rows from each, into a local SQLite file named dump.sqlite. After reviewing sample data, they moved toward full exports of those tables as CSV files.

The operators compressed database dumps and attempted to send them to a command-and-control server with netcat. They also tried to pass data through legitimate file-hosting services using curl, which can make outgoing transfers resemble ordinary web traffic. Another script searched for WordPress configuration files named wp-config.php, extracted embedded database credentials and attempted to upload output to the catbox[.]moe API. Unit 42 describes attempts to steal sensitive database contents; the source does not establish that every attempted transfer succeeded.

Anti-forensics and deceptive traces

The attackers tried to weaken endpoint protection by running shell scripts that used pgrep and pkill against Cortex XDR related processes. According to Unit 42, Cortex XDR detected and mitigated those actions, and its telemetry showed that protection was not disabled.

They also removed short-lived scripts after use, changed timestamps on files meant to persist, and deleted logs. The timestamp changes used touch -t to make malicious files appear older than the intrusion. That can complicate timeline analysis, especially if investigators treat file dates as reliable evidence of when a file first appeared.

Several artifacts appeared designed to steer an investigation toward a benign explanation. A malicious script used the key RedTeamOps2025, and an account created by the attackers used pentest123 as its password. Unit 42 interpreted these as planted cues intended to make the activity look like a legitimate security assessment. The SolarWinds-themed log filename served a similar camouflage purpose, according to the researchers.

After data collection attempts, the attackers removed system logs and malicious residual files, including files stored under /tmp/. They ran cleanup scripts more than once and checked whether their IP addresses had disappeared from logs. This layered cleanup makes retained telemetry outside the affected host particularly useful when investigating the sequence of activity.

What defenders can take from the operation

CL-UNK-1211 combines well-known post-compromise techniques with evidence of AI-assisted scripting. The AI clues are useful for understanding how payloads may have been produced, but the operational risks arise from what those payloads did: alter PHP configuration, harvest credentials, establish remote access, map servers, pivot through databases and attempt bulk collection.

For Linux teams, the report points to several places that warrant attention during an investigation: PHP configuration changes, unfamiliar files in web and system directories, modified shell startup files, unexpected SSH keys, command-line tools launching interactive shells, and outbound connections from servers that ordinarily have little need to initiate them. Database audit data and network records can help determine whether sampling progressed to full export or transfer.

The report also illustrates the limits of relying on a single control. Cortex XDR stopped observed attempts to terminate its processes, but the cluster used multiple access and persistence methods. Teams need visibility across Linux hosts, web applications, identity credentials, databases and outbound traffic to connect those pieces. Unit 42 says it used the Cortex Agentic Assistant, powered by Cortex AgentiX, to query investigation data in natural language and surface context and suggested next steps; that describes the researchers’ workflow, not a capability demonstrated by the attackers.

Unit 42 says its findings informed updates to Advanced WildFire analysis and detection rules. The company also describes detection and prevention capabilities in Cortex XDR, XSIAM, Cortex Cloud, Advanced URL Filtering, Advanced DNS Security and Advanced IP Defense. Those are vendor descriptions of its products, so organizations should assess coverage against their own systems and telemetry.

The practical takeaway is to treat AI-marked code as one clue within a broader intrusion picture. Script comments can reveal an assisted development workflow, while configuration changes, mailbox searches, database dumps and cleanup commands show the operator’s aims. Whether AI produced every payload or only some of them, the next release of these tools is less important than whether defenders can spot their behavior across the full Linux environment.

For more detail, Unit 42 provides additional command and persistence analysis in Appendix A and further techniques in Appendix B. Its account of activity and attribution is based on the cluster it observed between October 2025 and April 2026.