Unit 42 published its findings on CL-UNK-1211 on Oct. 15, describing Linux-focused activity against government entities and state-affiliated infrastructure from October 2025 through April 2026. The threat-intelligence team says script clues suggest possible AI assistance; it leaves the cluster’s affiliation undetermined. Unit 42’s report tracks the activity under the label CL-UNK-1211.
Why Unit 42 suspects possible AI assistance
Several scripts contained conversational, step-by-step comments, alongside other coding patterns Unit 42 associates with AI-assisted development. The team says the code may have been copied from an LLM output or deployed by an automated AI agent. Those clues underpin its inference of possible AI assistance.
Linux persistence, credentials and SysGoRAT
Unit 42 describes a toolkit combining web shells, open-source utilities, custom scripts and SysGoRAT, a custom Go remote access Trojan (RAT) for Linux and Windows. SysGoRAT used WebSocket command-and-control and supported seven command types, four control sub-actions—shell_start, screenshot, download and persist—and six persistence methods across the two operating systems.
Reported Linux techniques included cron-based persistence that ran every five minutes, changes to PHP’s auto_prepend_file setting, disguised PHP web shells and modifications to SSH authorized_keys. The report also describes credential collection through a PHP logger and a modified .bashrc sudo alias, as well as searches through files and command histories.
Unit 42 counted at least seven command-and-control servers used for reverse shells. A named-pipe-over-Netcat method appeared across three of them; other reported approaches used Bash TCP redirects and Python subprocesses.
Mailbox and database collection attempts
A PHP script searched government mail directories for email related to social media. One observed script intended to compress mailboxes contained syntax errors and would fail if executed. Separately, Unit 42 describes a database-sampling script that wrote up to 100 rows from each of four tables to a local SQLite database, followed by attempts to dump full table contents and exfiltrate data.
Evasion attempts and reported detections
The activity included attempts to terminate Cortex XDR-related processes, delete logs, alter file timestamps, remove one-use scripts and plant red-team indicators. Unit 42 says Cortex XDR detected and mitigated the process-termination attempts, and its telemetry showed endpoint protections remained active.
A file named Solarwinds.StatusLog.txt served as a disguise. Unit 42 says it found no evidence that SolarWinds systems or infrastructure were compromised in this operation.
