Search — “CL-UNK-1211”

Palo Alto Networks Unit 42 reports a cyber espionage cluster tracked as CL-UNK-1211 that targeted Linux infrastructure tied to government entities between October 2025 and April 2026. The actors used PHP web shells, three credential-harvesting methods (.bashrc replacement, PHP login page injection, and scanning config and history files for cleartext passwords), and a Go-based multi-platform RAT called SysGoRAT that connects over WebSocket to a hard-coded IP. Hunters should look for PHP web shells, unexpected .bashrc modifications, injected PHP login code, the search_social.php and zip_mails.sh scripts, and enumeration of /var/qmail/mailnames/.

Unit 42 tracked CL-UNK-1211 (Oct 2025 inApr 2026), a campaign against government Linux servers using AI-generated PHP/shell payloads, web shells, a custom Go RAT (SysGoRAT), credential harvesting, and extensive anti-forensics. Attackers hijacked global PHP auto_prepend_file config for persistence, hijacked .bashrc sudo to steal passwords, enumerated qmail mailboxes, and exfiltrated databases via netcat/curl to file-hosting sites. Hunt for PHP-FPM spawning shells, in-memory reverse shells, timestomping, log deletion, and SysGoRAT C2 over WebSocket.