Unit 42 Finds AI-Written Malware Inside Government Linux Servers

Palo Alto Networks' Unit 42 has published details of a campaign against government entities and state-affiliated infrastructure that ran from October 2025 to April 2026. The attackers' code explained itself, in the chatty, step-by-step way a large language model writes.

Unit 42 tracks the activity as CL-UNK-1211. "UNK" means it has not yet tied the cluster to either a nation-state or a cybercrime group.

The AI fingerprints

Multiple scripts recovered from the intrusions carried conversational reasoning notes that walked the operator through the code's logic, rather than normal developer comments. Unit 42's read is that the code was either pasted straight from an AI prompt's output or deployed by an automated AI agent.

Other patterns pointed the same way:

• Section headers inside scripts and shell commands, which make output easier for an AI to parse
• Heavy use of Base64-encoded commands
• Smooth switching between PHP, JavaScript, Bash and Python during the attack

Unit 42 says AI helped the attackers generate, adapt and deploy operational scripts quickly.

What they actually did

The campaign focused on Linux servers:

• Web shells for persistence, a mix of custom ones and open-source ones from GitHub. The attackers changed the PHP auto_prepend_file setting across configurations under /etc/php/ and /opt/plesk/php/, so their code ran before every other PHP script.
• Credential theft. They hijacked .bashrc, including a sudo wrapper that captured a user's password and wrote it to a file named Solarwinds.StatusLog.txt. Unit 42 stresses it found no evidence that SolarWinds systems were compromised. They also planted code in PHP login pages and searched config and command-history files for cleartext passwords.
• Mailbox targeting. They searched government mail servers for messages linked to social media accounts and wrote scripts to compress and exfiltrate whole mailboxes. One of those scripts had syntax errors and would have failed.
• A custom backdoor, SysGoRAT, a Go-based remote-access trojan that runs on both Windows and Linux, alongside reverse shells and privilege-escalation tools.
• Database theft. They dumped database contents into local files and tried to move them out through command-and-control servers and legitimate file-hosting services.
• Covering tracks. They tried to disable endpoint protection, altered timestamps, deleted authentication and history logs, and planted markers to make the activity look like a red-team exercise.

What security teams should take from it

Two points I'd take from this.

First, AI is lowering the cost of a capable intrusion. Writing working PHP, Bash and Python payloads across a long campaign used to take skill and time. Here it looks like a model did a lot of that work. The broken exfiltration script shows AI-written code isn't always good code. Attackers only need some of it to work.

Second, the same habit gives defenders something to look for. A script on a production server full of conversational, over-explained comments is not normal, and it is worth a threat-hunting rule of its own next to the usual indicators.

The basics still matter most: visibility into Linux servers and databases, monitoring PHP configuration changes, watching for edits to shell startup files, and alerting when someone tries to switch off endpoint protection.

Source: AI-Powered Espionage Campaign Targets Government Linux Infrastructure, Unit 42, Palo Alto Networks, via International Business Times Singapore