{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "The exfiltration of government mailboxes and databases represents a critical loss of sensitive data; a negative result for these collection patterns over the mail infrastructure is a high-value signal for national security." }, "name": "Interactive Shells and Data Collection (CL-UNK-1211)", "type": "investigation", "labels": [ "hunt", "attack.t1059", "attack.t1071", "attack.t1041", "collection", "command and control", "credential access", "execution", "persistence" ], "series": { "slug": "ai-powered-espionage-campaign-targets-government-linux-infrastructure", "index": 2, "title": "AI-Powered Espionage Campaign Targets Government Linux Infrastructure", "total": 2 }, "related": [ { "hunt": "cl-unk-1211-initial-access-and-persistence", "reason": "The initial web shell deployment and credential harvesting phase are handled in a separate hunt focused on web server persistence.", "relation": "precedes" }, { "hunt": "linux-persistence-credential-hijacking", "relation": "follows" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "network": { "name": "Network telemetry", "category": "network", "telemetry": [ "network" ] }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "A simple rule for 'nc' or 'bash -i' is often too noisy for developer-heavy Linux environments. This hunt pivots from the initial behavioral lead to verify C2 traffic and then stack-counts the specific data collection patterns (mailbox zipping) that define this intrusion cluster, using three surfaces to confirm a breach.", "coverage": [ { "stage": "reverse-shell-activity", "steps": [ "lead-reverse-shells" ], "status": "covered" }, { "stage": "c2-communication", "steps": [ "c2-network-hits" ], "status": "covered" }, { "stage": "data-collection-exfiltration", "steps": [ "mailbox-access-baseline" ], "status": "covered" }, { "stage": "web-shell-deployment", "reason": "Handled by the preceding hunt in this series.", "status": "out_of_scope" }, { "stage": "php-persistence-tampering", "reason": "Handled by the preceding hunt in this series.", "status": "out_of_scope" }, { "stage": "credential-harvesting-sudo", "reason": "Handled by the preceding hunt in this series.", "status": "out_of_scope" }, { "stage": "sysgorat-execution", "reason": "Handled by the preceding hunt in this series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "Web Shell Deployment", "slug": "web-shell-deployment", "tactic": "persistence", "techniques": [ "T1505.003" ], "observables": [ "/usr/lib/php/plesk_sys_driver.php", "POST requests to PHP files via php-fpm parent process", "search_social.php" ] }, { "name": "PHP Configuration Tampering", "slug": "php-persistence-tampering", "tactic": "persistence", "techniques": [ "T1505.003" ], "observables": [ "Modification of auto_prepend_file in /etc/php/", "Modification of auto_prepend_file in /opt/plesk/php/" ] }, { "name": "Sudo Command Hijacking", "slug": "credential-harvesting-sudo", "tactic": "credential-access", "techniques": [ "T1059" ], "observables": [ "Modification of .bashrc with sudo aliases", "Solarwinds.StatusLog.txt", "Commands searching for SMTP or database passwords in config files" ] }, { "name": "SysGoRAT Backdoor Execution", "slug": "sysgorat-execution", "tactic": "execution", "techniques": [ "T1059" ], "observables": [ "sys-control-client", "pip2.7", "ea_install", "./semanage", "Go-based multi-platform RAT" ] }, { "name": "In-Memory Reverse Shells", "slug": "reverse-shell-activity", "tactic": "execution", "techniques": [ "T1059" ], "observables": [ "mkfifo /tmp/f; cat /tmp/f | bash -i 2>&1 | nc", "bash -i >& /dev/tcp/", "python3 -c \"import socket,subprocess,os; s=socket.socket(...)\"" ] }, { "name": "WebSocket Command and Control", "slug": "c2-communication", "tactic": "command-and-control", "techniques": [ "T1071" ], "observables": [ "wss:///ws", "104.194.158.65:443", "proxy_connect command via RAT" ] }, { "name": "Mailbox and Database Collection", "slug": "data-collection-exfiltration", "tactic": "collection", "techniques": [ "T1041" ], "observables": [ "Enumeration of /var/qmail/mailnames/", "zip_mails.sh", "Iteration through Maildir/cur/ directories" ] } ], "summary": "CL-UNK-1211 is an AI-assisted campaign targeting government Linux infrastructure to exfiltrate mailboxes and sensitive databases. The attackers utilize custom Go-based backdoors (SysGoRAT), extensive web shell deployments, and creative credential theft such as hijacking the sudo command through .bashrc modifications." }, "severity": "high", "rationale": "Focus the hunt on Linux-based mail servers (qmail, postfix) and database servers, as these are the primary targets for the collection techniques described in the CL-UNK-1211 report.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An adversary is using in-memory reverse shells to conduct interactive discovery and exfiltrate government mailboxes, likely use AI-assisted scripting patterns for efficiency.", "parameters": { "c2_ips": { "from": { "ref": "unit42-ai-espionage-2026", "kind": "article", "observed": "2026-10-15" }, "type": "list[ip]", "default": [ "104.194.158.65" ], "description": "Known C2 IP addresses from the CL-UNK-1211 report." }, "lookback_days": { "type": "number", "default": "14", "description": "Days of history to examine." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://unit42.paloaltonetworks.com/ai-campaign-targets-linux-infrastructure/", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://unit42.paloaltonetworks.com/ai-campaign-targets-linux-infrastructure/", "name": "Unit 42 \u2014 AI-Powered Espionage Campaign Targets Government Linux Infrastructure" } ], "blind_spots": [ { "id": "shell-visibility-gap", "risk": "If the bash redirect is executed via an eval or inside a pre-existing shell without a new process launch, the command line might not be visible in hb_process_activity.", "stage": "reverse-shell-activity", "question": "whether the redirect pattern bash -i >& /dev/tcp/ was executed inside a complex script", "requires": "command-line auditing or script block logging on Linux" }, { "id": "network-visibility-gap", "risk": "WebSocket traffic (wss://) is encrypted; hb_network_connection sees only the IP and port, preventing confirmation of the WebSocket protocol or URI path without a decrypting proxy.", "stage": "c2-communication", "question": "whether the WebSocket traffic was for SysGoRAT or a benign service", "requires": "hb_http_activity with decrypted WebSocket headers" } ] }, "name": "Interactive Shells and Data Collection (CL-UNK-1211)", "description": "This hunt focuses on the active intrusion phase of the CL-UNK-1211 campaign. It identifies behavioral indicators of interactive reverse shells (Netcat, Bash redirects, and Python subprocesses) which the attacker uses to enumerate and compress mailbox data for exfiltration. The hunt uses a gated flow, first identifying the characteristic shell patterns before fanning out to check for known C2 traffic and unusual mailbox access across the Linux estate." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "ai-powered-espionage-campaign-targets-government-linux-infrastructure", "index": 2, "title": "AI-Powered Espionage Campaign Targets Government Linux Infrastructure", "total": 2 }, "coverage": [ { "stage": "reverse-shell-activity", "steps": [ "lead-reverse-shells" ], "status": "covered" }, { "stage": "c2-communication", "steps": [ "c2-network-hits" ], "status": "covered" }, { "stage": "data-collection-exfiltration", "steps": [ "mailbox-access-baseline" ], "status": "covered" }, { "stage": "web-shell-deployment", "reason": "Handled by the preceding hunt in this series.", "status": "out_of_scope" }, { "stage": "php-persistence-tampering", "reason": "Handled by the preceding hunt in this series.", "status": "out_of_scope" }, { "stage": "credential-harvesting-sudo", "reason": "Handled by the preceding hunt in this series.", "status": "out_of_scope" }, { "stage": "sysgorat-execution", "reason": "Handled by the preceding hunt in this series.", "status": "out_of_scope" } ], "rationale": "An adversary is using in-memory reverse shells to conduct interactive discovery and exfiltrate government mailboxes, likely use AI-assisted scripting patterns for efficiency.", "blind_spots": [ { "id": "shell-visibility-gap", "risk": "If the bash redirect is executed via an eval or inside a pre-existing shell without a new process launch, the command line might not be visible in hb_process_activity.", "stage": "reverse-shell-activity", "question": "whether the redirect pattern bash -i >& /dev/tcp/ was executed inside a complex script", "requires": "command-line auditing or script block logging on Linux" }, { "id": "network-visibility-gap", "risk": "WebSocket traffic (wss://) is encrypted; hb_network_connection sees only the IP and port, preventing confirmation of the WebSocket protocol or URI path without a decrypting proxy.", "stage": "c2-communication", "question": "whether the WebSocket traffic was for SysGoRAT or a benign service", "requires": "hb_http_activity with decrypted WebSocket headers" } ], "scoping_notes": "Focus the hunt on Linux-based mail servers (qmail, postfix) and database servers, as these are the primary targets for the collection techniques described in the CL-UNK-1211 report.", "beyond_detection": "A simple rule for 'nc' or 'bash -i' is often too noisy for developer-heavy Linux environments. This hunt pivots from the initial behavioral lead to verify C2 traffic and then stack-counts the specific data collection patterns (mailbox zipping) that define this intrusion cluster, using three surfaces to confirm a breach." } }, { "id": "lead-reverse-shells", "type": "query", "label": "Suspicious reverse shell patterns", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, user_name, process_cmd_line, time FROM hb_process_activity WHERE ((LOWER(process_cmd_line) LIKE '%mkfifo%' AND LOWER(process_cmd_line) LIKE '%nc %') OR (LOWER(process_cmd_line) LIKE '%/dev/tcp/%') OR (LOWER(process_cmd_line) LIKE '%socket.socket%' AND LOWER(process_cmd_line) LIKE '%subprocess.call%')) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_process_activity", "description": "Identify the characteristic behavioral patterns of in-memory reverse shells using pipes, redirects, or scripted sockets.", "expected_signal": "Rows containing shell commands that redirect I/O to network sockets. Silence indicates no shell redirection was captured in the process logs during the window." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Suspicious reverse shell patterns", "reads": [ "device_hostname", "process_cmd_line", "time", "user_name" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, user_name, process_cmd_line, time FROM hb_process_activity WHERE ((LOWER(process_cmd_line) LIKE '%mkfifo%' AND LOWER(process_cmd_line) LIKE '%nc %') OR (LOWER(process_cmd_line) LIKE '%/dev/tcp/%') OR (LOWER(process_cmd_line) LIKE '%socket.socket%' AND LOWER(process_cmd_line) LIKE '%subprocess.call%')) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Rows containing shell commands that redirect I/O to network sockets. Silence indicates no shell redirection was captured in the process logs during the window.", "verified": "dry-run", "verified_at": "2026-10-17" } }, { "id": "lead-assessment", "type": "analytic", "label": "Assess lead validity", "config": { "cite": "required", "tools": [ "endpoint", "network" ], "context": [ "lead-reverse-shells" ], "objective": "Decide if the reverse shell patterns in lead-reverse-shells require further investigation based on the context of the user and host.", "description": "Determine if the identified reverse shell patterns are likely malicious or part of legitimate administrative activity.", "max_iterations": 3, "expected_signal": "A verdict on whether the shell activity is suspicious.", "success_criteria": "A verdict of malicious | suspicious | benign for the reverse shell patterns found." }, "parents": [ { "id": "lead-reverse-shells" } ] }, { "id": "gate-on-lead", "type": "checkpoint", "label": "Gate on reverse shell activity", "config": { "fuzzy": true, "judge": "hunter", "question": "the lead-assessment verdict is malicious or suspicious for at least one host", "condition": "the lead-assessment verdict is malicious or suspicious for at least one host", "blind_spot": "shell-visibility-gap", "confidence": "high", "description": "Stop the hunt if no suspicious shells are found to conserve resources.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "lead-assessment" } ] }, { "id": "c2-network-hits", "type": "query", "label": "Network connections to C2 IPs", "config": { "dsl": "sqlite", "role": "enrichment", "source": "network", "content": "SELECT device_hostname, process_name, dst_endpoint_ip, dst_endpoint_port, time FROM hb_network_connection WHERE instr(',' || '{{c2_ips}}' || ',', ',' || dst_endpoint_ip || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_network_connection", "description": "Verify if the hosts with suspicious shells are communicating with the reported C2 infrastructure.", "expected_signal": "Outbound connections to 104.194.158.65. Silence does not rule out infection if the adversary rotated IPs." }, "parents": [ { "id": "gate-on-lead", "branch": "on_supports" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "Network connections to C2 IPs", "reads": [ "device_hostname", "dst_endpoint_ip", "dst_endpoint_port", "process_name", "time" ], "source": "hb_network_connection", "target": "network", "content": "SELECT device_hostname, process_name, dst_endpoint_ip, dst_endpoint_port, time FROM hb_network_connection WHERE instr(',' || '{{c2_ips}}' || ',', ',' || dst_endpoint_ip || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Outbound connections to 104.194.158.65. Silence does not rule out infection if the adversary rotated IPs.", "verified": "dry-run", "verified_at": "2026-10-17" } }, { "id": "mailbox-access-baseline", "type": "query", "label": "Rare mailbox access and compression", "config": { "dsl": "sqlite", "role": "baseline", "source": "endpoint", "content": "SELECT LOWER(process_cmd_line) AS cmd, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen FROM hb_process_activity WHERE (LOWER(process_cmd_line) LIKE '%/var/qmail/%' OR LOWER(process_cmd_line) LIKE '%/maildir/%' OR LOWER(process_cmd_line) LIKE '%/cur/%') AND (LOWER(process_cmd_line) LIKE '%zip %' OR LOWER(process_cmd_line) LIKE '%tar %' OR LOWER(process_cmd_line) LIKE '%find %') AND LOWER(process_name) NOT LIKE '%backup%' AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY 1 HAVING host_count <= 3", "surface": "hb_process_activity", "description": "Stack-count directory enumeration and compression commands involving mail storage to identify data collection while filtering common administrative noise.", "expected_signal": "A rare command string zipping a mail directory on one or two hosts. Genuine backup processes should be frequent across the fleet." }, "parents": [ { "id": "gate-on-lead", "branch": "on_supports" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Rare mailbox access and compression", "reads": [ "device_hostname", "process_cmd_line", "process_name", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT LOWER(process_cmd_line) AS cmd, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen FROM hb_process_activity WHERE (LOWER(process_cmd_line) LIKE '%/var/qmail/%' OR LOWER(process_cmd_line) LIKE '%/maildir/%' OR LOWER(process_cmd_line) LIKE '%/cur/%') AND (LOWER(process_cmd_line) LIKE '%zip %' OR LOWER(process_cmd_line) LIKE '%tar %' OR LOWER(process_cmd_line) LIKE '%find %') AND LOWER(process_name) NOT LIKE '%backup%' AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY 1 HAVING host_count <= 3", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "A rare command string zipping a mail directory on one or two hosts. Genuine backup processes should be frequent across the fleet.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "cmd" ], "rare_below": 3 }, "verified_at": "2026-10-17" } }, { "id": "final-triage", "type": "analytic", "label": "Combined evidence triage", "config": { "cite": "required", "tools": [ "endpoint", "network" ], "context": [ "lead-assessment", "c2-network-hits", "mailbox-access-baseline" ], "objective": "Determine if the evidence across lead-reverse-shells, c2-network-hits, and mailbox-access-baseline confirms an active intrusion on the target hosts.", "description": "Weigh the shell activity, C2 hits, and data collection patterns to reach a final verdict.", "max_iterations": 6, "expected_signal": "A detailed verdict citing all three sources of evidence.", "success_criteria": "A combined verdict on whether the initial shell activity and follow-on collection constitute a confirmed intrusion." }, "parents": [ { "id": "c2-network-hits", "kind": "merge" }, { "id": "mailbox-access-baseline", "kind": "merge" } ] }, { "id": "route-on-verdict", "type": "checkpoint", "label": "Route based on confirmed intrusion", "config": { "fuzzy": true, "judge": "hunter", "question": "the final-triage verdict is malicious for at least one host", "condition": "the final-triage verdict is malicious for at least one host", "blind_spot": "network-visibility-gap", "confidence": "high", "description": "Isolate confirmed malicious hosts or route suspicious findings to manual review.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "final-triage" } ] }, { "id": "isolate-endpoint", "type": "action", "label": "Isolate confirmed host", "config": { "target": "endpoint", "description": "Contain the breach by isolating the host from the network while maintaining investigation access.", "instructions": "Isolate the host and preserve process memory to capture the in-memory shell scripts and the SysGoRAT binary.", "action_approval": "required" }, "parents": [ { "id": "route-on-verdict", "branch": "on_supports" } ] }, { "id": "manual-review", "type": "task", "label": "Analyst manual review", "config": { "assignee": "analyst", "description": "Validate findings that were not automatically isolated and prepare a report.", "instructions": "Review the shell commands and network hits; determine if the mailbox collection represents a breach of sensitive data and notify the relevant government mailbox owners." }, "parents": [ { "id": "gate-on-lead", "branch": "default" }, { "id": "gate-on-lead", "branch": "on_unavailable" }, { "id": "route-on-verdict", "branch": "default" }, { "id": "route-on-verdict", "branch": "on_unavailable" }, { "id": "route-on-verdict", "branch": "on_refutes" }, { "id": "isolate-endpoint" } ] }, { "id": "close-out", "type": "task", "label": "Hunt close-out", "config": { "assignee": "analyst", "description": "Finalize the hunt run and record gaps.", "instructions": "Document the findings and update the detection rule for reverse shells based on any tuning notes identified." }, "parents": [ { "id": "gate-on-lead", "branch": "on_refutes" }, { "id": "manual-review" } ] } ] }