What happened

• Unit 42 tracked CL-UNK-1211 against government Linux servers from Oct 2025 to Apr 2026, using AI-generated PHP and shell payloads, web shells and a custom Go RAT called SysGoRAT. [S1]
• For persistence, the attackers changed auto_prepend_file in every PHP configuration under /etc/php/ and /opt/plesk/php/. They also aliased sudo in .bashrc to capture passwords and injected SSH keys into authorized_keys. [S1]
• SysGoRAT (sys-control-client) runs C2 over WebSocket (wss://<addr>/ws, defaulting to 104.194.158[.]65:443). It persists through /etc/systemd/system/sys-update.service and a five-minute crontab entry. [S1]
• The attackers used PwnKit (CVE-2021-4034) and LinPEAS for privilege escalation. They moved laterally with sshpass and hard-coded admin credentials, and enabled xp_cmdshell on an internal MSSQL server. [S1]
• They dumped databases and attempted exfiltration with netcat to C2 and with curl to transfer[.]sh, bashupload[.]com and filebin[.]net. [S1]
• Anti-forensics included timestomping with touch -t, deleting logs and shell history, and trying to kill Cortex XDR processes with pgrep/pkill. [S1]

Timeline

Detect

Shell or interpreter spawned by PHP-FPM · EDR / Linux process events

index=* (parent_process_name="php-fpm*" OR parent_process_name="php*") (process_name IN ("sh","bash","dash","python","python3","nc","ncat","curl","wget")) | stats count min(_time) as first max(_time) as last values(process) as cmd by host parent_process_name process_name

A hit means: A PHP worker launched a shell or network tool. This matches the web shell activity Unit 42 shows from the php-fpm parent process.

Reverse shell, lateral sshpass and exfil command lines · EDR / Linux process events, auth log

index=* (process="*mkfifo /tmp/f*" OR process="*/dev/tcp/*" OR (process="*python*" process="*socket*" process="*dup2*") OR process="*sshpass*StrictHostKeyChecking=no*" OR process="*.libpython-helper*" OR process="*touch -t*" OR (process="*pkill*" process="*cortex*") OR process="*transfer.sh*" OR process="*bashupload.com*" OR process="*filebin.net*") | stats count values(process) as cmd values(user) as user by host

A hit means: A command line matched a reverse shell, lateral movement, timestomping, EDR-kill or file-hosting upload pattern published for this campaign.

Campaign persistence artifacts and file paths · File integrity monitoring, systemd/cron, EDR file events

index=* ("plesk_sys_driver.php" OR "sys-update.service" OR "sys-control-client" OR "/dev/shm/.gs-" OR ".libpython-helper" OR "search_social.php" OR "zip_mails.sh" OR "Solarwinds.StatusLog.txt" OR ("auto_prepend_file" ("/etc/php/" OR "/opt/plesk/php/"))) | stats count values(source) as src by host

A hit means: A file or configuration change matched a persistence or tooling artifact named by Unit 42. Treat the host as possibly compromised until verified.

Network contact with published IoCs · Firewall, proxy and DNS logs

index=* (dest_ip IN ("45.88.188.140","198.23.185.234","138.68.244.146","185.21.136.6","72.61.89.179","104.194.158.65","109.224.53.140","162.243.175.162","154.93.37.228","141.164.58.87","88.80.150.232","88.119.167.57","173.212.247.23","104.248.131.53","147.182.224.216","93.93.112.57","192.210.183.17") OR query IN ("magento.ink","*.magento.ink","solidmonpe.com","*.solidmonpe.com","wibu-bau-bawang.online","*.wibu-bau-bawang.online","beraskencur.site","*.beraskencur.site") OR url IN ("*magento.ink*","*solidmonpe.com*","*wibu-bau-bawang.online*","*beraskencur.site*")) | stats count min(_time) as first max(_time) as last by src_ip dest_ip query url

A hit means: An internal host contacted infrastructure Unit 42 attributes to this campaign, including the SysGoRAT default C2.

Verify

• For a PHP-FPM child process, look at the web request at the same timestamp and at any recently written .php files under the web root. A web shell is likely when the child process does not match known application behaviour.
• Check every php.ini and conf.d file under /etc/php/ and /opt/plesk/php/ for an auto_prepend_file value. A path such as /usr/lib/php/plesk_sys_driver.php that the team did not configure is a true positive.
• Inspect .bashrc and .bash_aliases for every user for a sudo alias. Diff authorized_keys against approved keys.
• Hash suspect binaries and compare them with the SHA-256 IoCs in S1. File mtimes may be timestomped, so use ctime and inode change records rather than mtime.
• Benign look-alikes: PHP applications that legitimately shell out (image converters, mailers, Plesk tooling). Admin use of sshpass in automation scripts. Legitimate auto_prepend_file use by APM or security agents. Admin uploads to file-sharing sites.

Scope

Affected

• Linux web servers running PHP / PHP-FPM, including Plesk-managed PHP under /opt/plesk/php/ [S1]
• Linux hosts reachable with shared or hard-coded admin SSH credentials [S1]
• qmail mail servers (mailbox enumeration) [S1]
• Internal MSSQL servers where xp_cmdshell can be enabled [S1]
• Hosts unpatched for CVE-2021-4034 (PwnKit privilege escalation) [S1]

Only if

None stated by the sources.

Not affected if

None stated by the sources.

Enumerate

• All internet-facing Linux hosts running PHP-FPM or Plesk, and their PHP configuration directories
• Linux hosts with vulnerable polkit/pkexec (CVE-2021-4034)
• Accounts whose credentials sit in config files or shell history (email, SMTP, database) on PHP hosts
• Admin accounts used with sshpass or shared across hosts
• MSSQL instances with xp_cmdshell enabled or enableable by reachable accounts
• Database dumps or tarballs in /tmp on servers

Contain

• Capture memory and volatile state (process list, network connections, /dev/shm) on suspect hosts before any reboot. The source describes in-memory reverse shells, so a reboot destroys that evidence and cannot be undone.
• Network-isolate confirmed hosts and keep the disk images.
• Block the S1 IP and domain IoCs and file-hosting upload sites (transfer.sh, bashupload.com, filebin.net) at egress for server segments.
• Disable xp_cmdshell on MSSQL servers that do not need it.
• Rotate credentials exposed on affected hosts: sudo passwords, SSH keys, DB/SMTP/email secrets in configs, and admin credentials used with sshpass. Rotation cannot be undone and will break dependent automation, so stage it.

Eradicate

• Remove the injected auto_prepend_file settings across /etc/php/ and /opt/plesk/php/, and delete the prepended file (e.g. /usr/lib/php/plesk_sys_driver.php). [S1]
• Remove web shells from web roots. [S1]
• Remove SysGoRAT (sys-control-client), /etc/systemd/system/sys-update.service and its crontab entry. [S1]
• Remove the sudo alias from .bashrc files and attacker keys from authorized_keys. [S1]
• Remove gs-netcat (/dev/shm/.gs-*), revsocks, pysoxy, .libpython-helper and PwnKit/LinPEAS remnants. [S1]
• Patch CVE-2021-4034 to close the privilege escalation path. [S1]

Recover

• Rebuild hosts where timestomping and log deletion prevent establishing a trusted baseline, instead of cleaning in place.
• Before restoring service, validate PHP configs, systemd units, crontabs, shell rc files and authorized_keys against a known-good baseline.
• Afterwards, monitor for PHP-FPM child shells, outbound WebSocket from servers, and uploads to file-hosting sites.
• Afterwards, monitor for new sshpass use, xp_cmdshell re-enablement and attempts to stop EDR processes.

Re-enter the loop when

• Unit 42 or another source publishes new IoCs, SysGoRAT variants or C2 infrastructure.
• A source confirms how initial access was gained (e.g. the role of CVE-2025-55182) or names a newly exploited product.
• Reporting shows CL-UNK-1211 targeting the financial sector or regions outside government.
• A hit on one host shows shared credentials, which widens lateral scope.
• Evidence emerges of exfiltration of database dumps or mailboxes.

Debrief

• Record which hosts had PHP-FPM shells, auto_prepend_file changes or SysGoRAT, with first-seen times based on ctime and logs rather than timestomped mtimes.
• Record which credentials were exposed and when they were rotated.
• Record whether egress controls blocked any upload or C2 attempts.
• Gap: the provided input does not state the initial access vector or how CVE-2025-55182 was used.
• Gap: there is no attribution beyond the CL-UNK cluster label, and no victim count or sector breadth.

Detection coverage — checked automatically

Checked automatically 2026-11-01 17:08Z from public sources: 22 published, 14 nothing found, 0 not machine-checkable, 0 failed. "Nothing found" means the public source answered and had nothing, as of that moment; a feed covers only its newest posts. Re-checked daily.

Exposure queries — generated automatically

vuln:CVE-2025-55182

vuln:CVE-2021-4034

cpe:"cpe:/a:facebook:react"

product:"React"

host.services: (software.product = "React")

cpe:"cpe:/a:vercel:next.js"

product:"Next.js"

host.services: (software.product = "Next.js")

cpe:"cpe:/a:polkit_project:polkit"

product:"Polkit"

host.services: (software.product = "Polkit")

cpe:"cpe:/a:redhat:enterprise_linux_server_update_services_for_sap_solutions"

product:"Enterprise Linux Server Update Services For Sap Solutions"

host.services: (software.product = "Enterprise Linux Server Update Services For Sap Solutions")

http.component:"Next.js"

http.html:"react-dom"

Internet-wide count, trend

Shodan's count of matching services on the whole internet, one point a day; the scope (your ranges) is never part of it. A count moves with Shodan's crawl as much as with patching, so read the direction, not the digit.

NVD names 9 more affected products (libraries and embedders); the CVE query covers them where Shodan has fingerprinted the version.

Banner spellings: a model read 3 from the NVD names and this card's text (former and marketing names, console titles); 2 matched something on Shodan and are shown above, the rest was dropped.

Scope every query in your own tool, never in a shared document: Shodan `net:<your_ranges>`, `org:"<your_org>"` or `hostname:<your_domain>` (or a Shodan Monitor network alert, which applies the scope for you); Censys `host.ip: <your_ranges>` or `host.dns.names: <your_domain>`. Then compare the banner version with the affected range. Generated automatically 2026-11-01 17:08Z from the CVE ids and NVD's CPE configurations, each Shodan query counted against Shodan itself; re-built daily with the coverage check.

Open questions

• How was CVE-2025-55182 used (initial access or otherwise)? The input lists it without context.
• Did any exfiltration succeed? S1 describes 'attempted' and 'tried to upload'.
• What was the initial access vector into the PHP servers?
• Is the CL-UNK-1211 cluster related to any named actor?
• Some input text has encoding artifacts (e.g. 'inApr', 'user izs'). These look like parsing noise, not instructions, but quoted strings should be re-checked against S1.

Sources

• [S1] https://unit42.paloaltonetworks.com/ai-campaign-targets-linux-infrastructure/ · Unit 42 (Palo Alto Networks)

Public OSINT only. AI-generated by the pipeline; structure follows the DAIR model from Dynamic Incident Response (Joshua Wright). Published automatically once it crosses the publish bar.