unit42 · Crawled Oct 18, 2026

AI-Powered Espionage Campaign Targets Government Linux Infrastructure

30 IoCs 2 CVEs
Read original article ↗

AI Summary

Unit 42 identified an AI-powered espionage campaign, tracked as CL-UNK-1211, targeting government entities and state-affiliated Linux infrastructure from October 2025 to April 2026. The attackers used AI-generated payloads, including malicious PHP scripts and custom malware such as SysGoRAT—a cross-platform Go-based remote access Trojan—to maintain persistence, conduct reconnaissance, and exfiltrate sensitive data like government mailboxes and databases. The campaign employed diverse techniques including web shells, credential harvesting via .bashrc hijacking and PHP loggers, reverse shells, and anti-forensics methods such as log tampering and timestomping to evade detection.

AI-extracted · verify before operational use

Extracted Entities 2 found

CVE CVE-2025-55182 → CVE CVE-2021-4034 →

Indicators of Compromise 30 extracted

Type Value Detail
SHA-256 2bf7992e6260c1a98c709fa98ec766fb9f27692f338b30b43ac821b824fd849e Details →
SHA-256 27d799ceadb570bfca890d4c2572314afe57eecf14083d30409da15afdfc4704 Details →
SHA-256 d73186cea6cf2cf3d48c09139a9d15521365aab675787b4e7a6f81767331c9fd Details →
SHA-256 9e45830171eb607cf2c0fc80f5cc9cc3db39bb937032136990383a595f6f151e Details →
SHA-256 c527b94e3d21824a674face4cd9d862e536b60ccbf54573839e3360f99188343 Details →
SHA-256 d94f75a70b5cabaf786ac57177ed841732e62bdcc9a29e06e5b41d9be567bcfa Details →
SHA-256 44e83f84a5d5219e2f7c3cf1e4f02489cae81361227f46946abe4b8d8245b879 Details →
SHA-256 1505a3a727f8899b2ad343519f7bf9c438b8b802f8d6b854f5db3b52f857c76a Details →
SHA-256 76c58fad4f70cf277a15a499b9a2151ac60e7a6b5c7a9ab684843dcc19f0d0a5 Details →
SHA-256 b1e82c6b0caea177e8bb71ad826867f509c65f0a43a651b50253e7c726566eac Details →
IP 45[.]88[.]188[.]140 Details →
IP 198[.]23[.]185[.]234 Details →
IP 138[.]68[.]244[.]146 Details →
IP 185[.]21[.]136[.]6 Details →
IP 72[.]61[.]89[.]179 Details →
IP 104[.]194[.]158[.]65 Details →
IP 109[.]224[.]53[.]140 Details →
IP 162[.]243[.]175[.]162 Details →
IP 154[.]93[.]37[.]228 Details →
IP 141[.]164[.]58[.]87 Details →
IP 88[.]80[.]150[.]232 Details →
IP 88[.]119[.]167[.]57 Details →
IP 173[.]212[.]247[.]23 Details →
IP 104[.]248[.]131[.]53 Details →
IP 147[.]182[.]224[.]216 Details →
IP 93[.]93[.]112[.]57 Details →
IP 192[.]210[.]183[.]17 Details →
Domain magento[.]ink Details →
Domain solidmonpe[.]com Details →
Domain wibu-bau-bawang[.]online Details →

MITRE ATT&CK TTPs 33 techniques

T1001.002 Steganography · Command And Control T1021.004 SSH · Lateral Movement T1053.005 Scheduled Task · Execution T1059 Command and Scripting Interpreter · Execution T1059.001 PowerShell · Execution T1059.004 Unix Shell · Execution T1070.001 Clear Windows Event Logs · Defense Evasion T1071.001 Web Protocols · Command And Control T1078 Valid Accounts · Defense Evasion T1082 System Information Discovery · Discovery T1090 Proxy · Command And Control T1098 Account Manipulation · Persistence T1110 Brute Force · Credential Access T1133 External Remote Services · Persistence T1190 Exploit Public-Facing Application · Initial Access T1203 Exploitation for Client Execution · Execution T1210 Exploitation of Remote Services · Lateral Movement T1211 Exploitation for Defense Evasion · Defense Evasion T1218 System Binary Proxy Execution · Defense Evasion T1485 Data Destruction · Impact T1558.003 Kerberoasting · Credential Access T1566 Phishing · Initial Access T1569 System Services · Execution T1570 Lateral Tool Transfer · Lateral Movement T1571 Non-Standard Port · Command And Control T1572 Protocol Tunneling · Command And Control T1589 Gather Victim Identity Information · Reconnaissance T1595 Active Scanning · Reconnaissance T1599 Network Boundary Bridging · Defense Evasion T1650 Acquire Access · Resource Development T1068 Exploitation for Privilege Escalation · Privilege Escalation T1071.004 DNS · Command And Control T1220 XSL Script Processing · Defense Evasion