Search — “/var/qmail/mailnames/”
1 story · 0 IoCs
Stories
P2
Unit 42 tracks CL-UNK-1211 espionage cluster targeting government-linked Linux servers with PHP web shells and SysGoRAT
brief 2026-11-02CISO cardIoC card (1)AI verdict cardquick readMediumactor: CL-UNK-1211malware: SysGoRAT
Palo Alto Networks Unit 42 reports a cyber espionage cluster tracked as CL-UNK-1211 that targeted Linux infrastructure tied to government entities between October 2025 and April 2026. The actors used PHP web shells, three credential-harvesting methods (.bashrc replacement, PHP login page injection, and scanning config and history files for cleartext passwords), and a Go-based multi-platform RAT called SysGoRAT that connects over WebSocket to a hard-coded IP. Hunters should look for PHP web shells, unexpected .bashrc modifications, injected PHP login code, the search_social.php and zip_mails.sh scripts, and enumeration of /var/qmail/mailnames/.