Changed since version 1

• Source numbering changed. The Hacker News is now S1 and Unit 42 is now S2. Earlier [S1] references to Unit 42 now read [S2].
• Added PHP login page injection as a credential-harvesting method, with matching scope, verify and eradicate lines [S1].
• Added .bashrc replacement and cleartext password scanning in config and history files as explicit scope conditions [S1].
• Added SysGoRAT details: multi-platform, WebSocket C2 to a hard-coded IP, /bin/sh -c and cmd /C execution, file exfiltration [S1].
• Hunt 2 now also matches /var/qmail/mailnames/ enumeration and zip_mails.sh [S1].
• Contain now preserves logs off-host first, because the actors wipe system logs [S1].
• Added the open question on initial access, since today's source names no CVE or KEV [S1].

What happened

• Unit 42 tracked an espionage cluster, CL-UNK-1211, against Linux infrastructure tied to government entities between October 2025 and April 2026 [S1][S2].
• The actors kept access with open-source and bespoke PHP web shells and hijacked the global PHP auto_prepend_file setting for persistence [S1][S2].
• They harvested credentials three ways: a malicious .bashrc that steals sudo passwords, code injected into PHP login pages to capture admin credentials, and scans of config and history files for cleartext email, SMTP and database passwords [S1].
• SysGoRAT is a multi-platform Go RAT. It connects over WebSocket to a hard-coded IP, runs commands via /bin/sh -c on Linux or cmd /C on Windows, and exfiltrates files to its C2 [S1].
• The actors enumerated /var/qmail/mailnames/, tried to generate a zip_mails.sh script, and used search_social.php. They exfiltrated databases to file-hosting sites [S1][S2].
• They attempted to disable endpoint protections and wipe system logs, and used timestomping [S1][S2].

Timeline

Detect

Shell or interpreter spawned by PHP-FPM · EDR / Linux process events

index=* (parent_process_name="php-fpm*" OR parent_process_name="php*") (process_name IN ("sh","bash","dash","python","python3","nc","ncat","curl","wget")) | stats count min(_time) as first max(_time) as last values(process) as cmd by host parent_process_name process_name

FROM logs-* | WHERE process.parent.name LIKE "php*" AND process.name IN ("sh","bash","dash","python","python3","nc","ncat","curl","wget") | STATS count = COUNT(*), first = MIN(@timestamp), last = MAX(@timestamp), cmd = VALUES(process.command_line) BY host.name, process.parent.name, process.name

A hit means: A PHP worker launched a shell or network tool. This matches the web shell activity described for this campaign [S2].

Reverse shell, lateral sshpass, mailbox enumeration and exfil command lines · EDR / Linux process events, auditd, auth log

index=* (process="*mkfifo /tmp/f*" OR process="*/dev/tcp/*" OR (process="*python*" process="*socket*" process="*dup2*") OR process="*sshpass*StrictHostKeyChecking=no*" OR process="*.libpython-helper*" OR process="*touch -t*" OR (process="*pkill*" process="*cortex*") OR process="*/var/qmail/mailnames*" OR process="*zip_mails.sh*" OR process="*transfer.sh*" OR process="*bashupload.com*" OR process="*filebin.net*") | stats count values(process) as cmd values(user) as user by host

A hit means: A command line matched a reverse shell, lateral movement, timestomping, EDR-kill, qmail mailbox enumeration or file-hosting upload pattern published for this campaign [S1][S2].

Campaign persistence artifacts and file paths · File integrity monitoring, systemd/cron, EDR file events, web access logs

index=* ("plesk_sys_driver.php" OR "sys-update.service" OR "sys-control-client" OR "/dev/shm/.gs-" OR ".libpython-helper" OR "search_social.php" OR "zip_mails.sh" OR "Solarwinds.StatusLog.txt" OR ("auto_prepend_file" ("/etc/php/" OR "/opt/plesk/php/"))) | stats count values(source) as src by host

FROM logs-* | EVAL t = CONCAT(COALESCE(file.path, ""), " ", COALESCE(process.command_line, ""), " ", COALESCE(url.path, ""), " ", COALESCE(message, "")) | WHERE t LIKE "*plesk_sys_driver.php*" OR t LIKE "*sys-update.service*" OR t LIKE "*sys-control-client*" OR t LIKE "*/dev/shm/.gs-*" OR t LIKE "*.libpython-helper*" OR t LIKE "*search_social.php*" OR t LIKE "*zip_mails.sh*" OR t LIKE "*Solarwinds.StatusLog.txt*" OR (t LIKE "*auto_prepend_file*" AND (t LIKE "*/etc/php/*" OR t LIKE "*/opt/plesk/php/*")) | STATS count = COUNT(*), src = VALUES(event.dataset) BY host.name

A hit means: A file, request or config change matched a persistence or tooling artifact named for this campaign [S1][S2]. Treat the host as possibly compromised until verified.

Network contact with published IoCs · Firewall, proxy and DNS logs

index=* (dest_ip IN ("45.88.188.140","198.23.185.234","138.68.244.146","185.21.136.6","72.61.89.179","104.194.158.65","109.224.53.140","162.243.175.162","154.93.37.228","141.164.58.87","88.80.150.232","88.119.167.57","173.212.247.23","104.248.131.53","147.182.224.216","93.93.112.57","192.210.183.17") OR query IN ("magento.ink","*.magento.ink","solidmonpe.com","*.solidmonpe.com","wibu-bau-bawang.online","*.wibu-bau-bawang.online","beraskencur.site","*.beraskencur.site") OR url IN ("*magento.ink*","*solidmonpe.com*","*wibu-bau-bawang.online*","*beraskencur.site*")) | stats count min(_time) as first max(_time) as last by src_ip dest_ip query url

A hit means: An internal host contacted infrastructure attributed to this campaign [S2], possibly SysGoRAT WebSocket C2 to its hard-coded IP [S1].

Verify

• For a PHP-FPM child process, look at the web request at the same timestamp and at any recently written .php files under the web root. A web shell is likely when the child process does not match known application behaviour [S2].
• Check every php.ini and conf.d file under /etc/php/ and /opt/plesk/php/ for an auto_prepend_file value. A path the team did not configure, such as /usr/lib/php/plesk_sys_driver.php, is a true positive [S2].
• Diff PHP admin login pages against vendor or repository copies. Code that writes or sends submitted credentials is a true positive [S1].
• Inspect .bashrc and .bash_aliases for every user for a sudo alias or a replaced file. Diff authorized_keys against approved keys [S1][S2].
• Hash suspect binaries and compare them with the SHA-256 IoCs in S2. File mtimes may be timestomped, so use ctime and inode change records rather than mtime [S2].
• Benign look-alikes: PHP applications that legitimately shell out (image converters, mailers, Plesk tooling). Mail admin scripts that walk /var/qmail/mailnames/. Admin use of sshpass in automation. Legitimate auto_prepend_file use by APM or security agents. Admin uploads to file-sharing sites.

Scope

Affected

• Linux web servers running PHP / PHP-FPM, including Plesk-managed PHP under /opt/plesk/php/ [S2]
• PHP applications with admin login pages that can be modified on disk [S1]
• Linux hosts where a user's .bashrc can be replaced, exposing sudo passwords [S1]
• Hosts with cleartext email, SMTP or database passwords in config or history files [S1]
• Linux hosts reachable with shared or hard-coded admin SSH credentials [S2]
• qmail mail servers (mailbox enumeration under /var/qmail/mailnames/) [S1][S2]
• Internal MSSQL servers where xp_cmdshell can be enabled [S2]
• Hosts unpatched for CVE-2021-4034 (PwnKit privilege escalation) [S2]

Only if

None stated by the sources.

Not affected if

None stated by the sources.

Enumerate

• All internet-facing Linux hosts running PHP-FPM or Plesk, and their PHP configuration directories
• PHP admin login pages and their integrity against known-good copies
• Linux hosts with vulnerable polkit/pkexec (CVE-2021-4034)
• Accounts whose credentials sit in config files or shell history (email, SMTP, database) on PHP hosts
• Admin accounts used with sshpass or shared across hosts
• qmail servers and mailboxes under /var/qmail/mailnames/

Contain

• Capture memory and volatile state (process list, network connections, /dev/shm) on suspect hosts before any reboot. The sources describe in-memory reverse shells, so a reboot destroys that evidence and cannot be undone [S2].
• Preserve logs off-host now. The actors attempt to wipe system logs [S1].
• Network-isolate confirmed hosts and keep the disk images.
• Block the S2 IP and domain IoCs, including 104.194.158.65, and file-hosting upload sites (transfer.sh, bashupload.com, filebin.net) at egress for server segments [S1][S2].
• Disable xp_cmdshell on MSSQL servers that do not need it [S2].
• Rotate credentials exposed on affected hosts: sudo passwords, PHP admin logins, SSH keys, DB/SMTP/email secrets in configs and history, and admin credentials used with sshpass [S1][S2]. Rotation cannot be undone and will break dependent automation, so stage it.

Eradicate

• Remove PHP web shells and any auto_prepend_file entries the team did not set [S1][S2].
• Restore PHP login pages from known-good copies to remove injected credential-harvesting code [S1].
• Replace malicious .bashrc and .bash_aliases files and remove unapproved authorized_keys [S1][S2].
• Remove SysGoRAT binaries and persistence such as sys-update.service, and the search_social.php and zip_mails.sh scripts [S1][S2].
• Remove cleartext passwords from config and history files [S1].
• Patch CVE-2021-4034 on Linux hosts [S2].

Recover

• Rebuild hosts where timestomping and log deletion prevent establishing a trusted baseline, instead of cleaning in place [S1][S2].
• Before restoring service, validate PHP configs, login pages, systemd units, crontabs, shell rc files and authorized_keys against a known-good baseline.
• Afterwards, monitor for PHP-FPM child shells, outbound WebSocket from servers, and uploads to file-hosting sites.
• Afterwards, monitor for new sshpass use, xp_cmdshell re-enablement, access to /var/qmail/mailnames/, and attempts to stop EDR processes or clear logs.

Re-enter the loop when

• Unit 42 or another vendor publishes new IoCs or SysGoRAT samples, including Windows variants.
• A source names the initial access vector or confirms how CVE-2025-55182 was used.
• A source reports this cluster against non-government or financial-sector targets.
• Any hunt hit appears on a host outside the first enumerated set.

Debrief

• Record which hosts had PHP web shells, auto_prepend_file changes, injected login code, a modified .bashrc or SysGoRAT. Base first-seen times on ctime and logs rather than timestomped mtimes.
• Record which credentials were exposed and when they were rotated.
• Record whether egress controls blocked any upload or C2 attempts.
• Gap: the sources do not state the initial access vector. Today's report names no CVE, and the role of CVE-2025-55182 remains unclear.
• Gap: there is no attribution beyond the CL-UNK cluster label, and no victim count or sector breadth.

Detection coverage — checked automatically

Checked automatically 2026-11-10 04:09Z from public sources: 22 published, 14 nothing found, 0 not machine-checkable, 0 failed. "Nothing found" means the public source answered and had nothing, as of that moment; a feed covers only its newest posts. Re-checked daily.

Exposure queries — generated automatically

Where each CVE comes from: CVE-2021-4034 — CL-UNK-1211: AI-Assisted Espionage Targets Government Linux Infrastructure; CVE-2025-55182 — CL-UNK-1211: AI-Assisted Espionage Targets Government Linux Infrastructure. A product row answers "is the software from that story reachable from the internet", not "is this card about that software".

vuln:CVE-2025-55182

vuln:CVE-2021-4034

cpe:"cpe:/a:facebook:react"

product:"React"

host.services: (software.product = "React")

cpe:"cpe:/a:vercel:next.js"

product:"Next.js"

host.services: (software.product = "Next.js")

cpe:"cpe:/a:polkit_project:polkit"

product:"Polkit"

host.services: (software.product = "Polkit")

cpe:"cpe:/a:oracle:http_server"

product:"Http Server"

host.services: (software.product = "Http Server")

http.title:"Oracle HTTP Server"

product:"Oracle HTTP Server"

http.component:"Next.js"

http.html:"react-dom"

Internet-wide count, trend

Shodan's count of matching services on the whole internet, one point a day; the scope (your ranges) is never part of it. A count moves with Shodan's crawl as much as with patching, so read the direction, not the digit.

NVD names 9 more affected products (libraries and embedders); the CVE query covers them where Shodan has fingerprinted the version.

Banner spellings: a model read 4 from the NVD names and this card's text (former and marketing names, console titles); 4 matched something on Shodan and are shown above, the rest were dropped.

Scope every query in your own tool, never in a shared document: Shodan `net:<your_ranges>`, `org:"<your_org>"` or `hostname:<your_domain>` (or a Shodan Monitor network alert, which applies the scope for you); Censys `host.ip: <your_ranges>` or `host.dns.names: <your_domain>`. Then compare the banner version with the affected range. Generated automatically 2026-11-10 04:09Z from the CVE ids and NVD's CPE configurations, each Shodan query counted against Shodan itself; re-built daily with the coverage check.

Open questions

• Which CVE, if any, gave initial access? The Hacker News coverage names no CVE or KEV entry [S1], while the earlier thread listed CVE-2025-55182 and CVE-2021-4034.
• Was SysGoRAT observed on Windows hosts, or is Windows support only a capability [S1]?
• Which government entities and countries were affected, and how many?

Sources

• [S1] https://thehackernews.com/2026/11/government-linux-servers-targeted-with.html · The Hacker News
• [S2] https://unit42.paloaltonetworks.com/ai-campaign-targets-linux-infrastructure/ · Unit 42 (Palo Alto Networks)

Public OSINT only. AI-generated by the pipeline; structure follows the DAIR model from Dynamic Incident Response (Joshua Wright). Published automatically; a dismissed draft unpublishes it.