Search — “CVE-2021-4034”

Unit 42 tracked CL-UNK-1211 (Oct 2025 inApr 2026), a campaign against government Linux servers using AI-generated PHP/shell payloads, web shells, a custom Go RAT (SysGoRAT), credential harvesting, and extensive anti-forensics. Attackers hijacked global PHP auto_prepend_file config for persistence, hijacked .bashrc sudo to steal passwords, enumerated qmail mailboxes, and exfiltrated databases via netcat/curl to file-hosting sites. Hunt for PHP-FPM spawning shells, in-memory reverse shells, timestomping, log deletion, and SysGoRAT C2 over WebSocket.