--- analysis: A static rule can find the plesk_sys_driver.php filename, but this hunt correlates rare configuration changes with live behavioral anomalies like web server process managers spawning shells, identifying AI-generated payloads that use varying filenames or paths to evade simple rules. blind_spots: - id: missing-file-telemetry question: Which process originally modified the PHP configuration files requires: hb_linux_audit or real-time FIM on /etc/php and /opt/plesk risk: If file activity logging is not enabled for system configuration paths, the initial modification by the web shell may be missed, leaving only the persistent state visible. stage: php-persistence-tampering - id: ephemeral-webshell-execution question: Whether a web shell was deployed and deleted in a very short window requires: hb_process_activity with low latency risk: AI-automated agents may deploy a web shell, execute commands, and delete the file within seconds, making it invisible to file system snapshots. stage: web-shell-deployment coverage: - stage: web-shell-deployment status: covered steps: - webshell-execution-patterns - rare-config-modifications - stage: php-persistence-tampering status: covered steps: - rare-config-modifications - stage: credential-harvesting-sudo status: covered steps: - rare-config-modifications - reason: Belongs to another part of the 'AI-Powered Espionage Campaign Targets Government Linux Infrastructure' series. stage: sysgorat-execution status: out_of_scope - reason: Belongs to another part of the 'AI-Powered Espionage Campaign Targets Government Linux Infrastructure' series. stage: reverse-shell-activity status: out_of_scope - reason: Belongs to another part of the 'AI-Powered Espionage Campaign Targets Government Linux Infrastructure' series. stage: c2-communication status: out_of_scope - reason: Belongs to another part of the 'AI-Powered Espionage Campaign Targets Government Linux Infrastructure' series. stage: data-collection-exfiltration status: out_of_scope guardrails: claims: no_unsupported evidence: citation_required missing_data: not_benign telemetry: untrusted hunt: applicability: campaign-specific handoff: promote-to-detection justification: Protects Linux web infrastructure from automated, AI-driven persistence that bypasses standard signatures by masquerading as legitimate administrative configuration changes. methodology: model-assisted trigger: intel-report hypothesis: An adversary has established persistence on Linux web servers using AI-generated PHP web shells and hijacked administrative credentials by tampering with shell profiles and configuration files. labels: - hunt - attack.t1505.003 - attack.t1059 - attack.t1071 - attack.t1041 - collection - command and control - credential access - execution - persistence name: Linux Persistence and Credential Hijacking parameters: known_malicious_files: default: - plesk_sys_driver.php - search_social.php - Solarwinds.StatusLog.txt - zip_mails.sh description: Malicious filenames or decoy logs identified in the campaign. from: kind: article observed: '2026-10-15' ref: Unit 42 CL-UNK-1211 type: list[string] lookback_days: default: '14' description: Days of history to examine. type: number scope_hosts: default: [] description: List of hostnames identified in the scoping step; refresh this list with results from identify-linux-web-servers before running detection steps. type: list[host] provenance: authors: - name: Huntbase hunt generation org: huntbase.io generated: by: huntbase-hunt-generation from: https://unit42.paloaltonetworks.com/ai-campaign-targets-linux-infrastructure/ gates: - dry-run - lint model: hb_google/gemini-3-flash-preview rationale: Start with Linux servers running Plesk or public-facing PHP applications. The identify-linux-web-servers query finds these based on installed software. Use the resulting host list to populate scope_hosts for the detection queries. references: - name: "Unit 42 \u2014 AI-Powered Espionage Campaign Targets Government Linux Infrastructure" url: https://unit42.paloaltonetworks.com/ai-campaign-targets-linux-infrastructure/ related: - hunt: sysgorat-rat-detection reason: Detection of the custom Go-based SysGoRAT binary is handled in a separate hunt focused on binary-on-disk analysis. relation: out-of-scope-alternative scenario: stages: - name: Web Shell Deployment observables: - /usr/lib/php/plesk_sys_driver.php - POST requests to PHP files via php-fpm parent process - search_social.php slug: web-shell-deployment tactic: persistence techniques: - T1505.003 - name: PHP Configuration Tampering observables: - Modification of auto_prepend_file in /etc/php/ - Modification of auto_prepend_file in /opt/plesk/php/ slug: php-persistence-tampering tactic: persistence techniques: - T1505.003 - name: Sudo Command Hijacking observables: - Modification of .bashrc with sudo aliases - Solarwinds.StatusLog.txt - Commands searching for SMTP or database passwords in config files slug: credential-harvesting-sudo tactic: credential-access techniques: - T1059 - name: SysGoRAT Backdoor Execution observables: - sys-control-client - pip2.7 - ea_install - ./semanage - Go-based multi-platform RAT slug: sysgorat-execution tactic: execution techniques: - T1059 - name: In-Memory Reverse Shells observables: - mkfifo /tmp/f; cat /tmp/f | bash -i 2>&1 | nc - bash -i >& /dev/tcp/ - python3 -c "import socket,subprocess,os; s=socket.socket(...)" slug: reverse-shell-activity tactic: execution techniques: - T1059 - name: WebSocket Command and Control observables: - wss:///ws - 104.194.158.65:443 - proxy_connect command via RAT slug: c2-communication tactic: command-and-control techniques: - T1071 - name: Mailbox and Database Collection observables: - Enumeration of /var/qmail/mailnames/ - zip_mails.sh - Iteration through Maildir/cur/ directories slug: data-collection-exfiltration tactic: collection techniques: - T1041 summary: CL-UNK-1211 is an AI-assisted campaign targeting government Linux infrastructure to exfiltrate mailboxes and sensitive databases. The attackers utilize custom Go-based backdoors (SysGoRAT), extensive web shell deployments, and creative credential theft such as hijacking the sudo command through .bashrc modifications. series: index: 1 slug: ai-powered-espionage-campaign-targets-government-linux-infrastructure title: AI-Powered Espionage Campaign Targets Government Linux Infrastructure total: 2 severity: high targets: analyst: name: Tier-2 analyst role: analyst endpoint: category: endpoint name: Endpoint telemetry (hb_ surfaces) telemetry: - endpoint hunter: agent: true name: Hunt agent tlp: clear type: investigation --- # Linux Persistence and Credential Hijacking The adversary uses AI-assisted code to modify PHP configuration directories and .bashrc profiles, ensuring that malicious code executes whenever a web request is processed or a user elevates privileges. This hunt targets the activity of CL-UNK-1211, focusing on the specialized Linux persistence and credential theft observed in their campaign. The hunt identifies the web server estate and executes parallel checks: one to find anomalous shell execution originating from web server process managers, and another to baseline rare file modifications across critical configuration paths. The analyst evaluates the results to differentiate legitimate administrative activity from AI-automated intrusion artifacts. ## identify-linux-web-servers Scope the hunt to Linux hosts running PHP, Plesk, or common web server packages where these persistence techniques are viable. ```sqlite target=endpoint role=scoping ~~~yaml expected: A list of hostnames serving as web infrastructure. Use these results to populate the scope_hosts parameter for subsequent steps. reads: - device_hostname - package_name - package_version - asset_scope silence: not_evidence_of_absence source: hb_software_inventory verified: dry-run verified_at: '2026-10-17' ~~~ SELECT device_hostname, package_name, package_version FROM hb_software_inventory WHERE (LOWER(package_name) LIKE '%php%' OR LOWER(package_name) LIKE '%plesk%' OR LOWER(package_name) LIKE '%nginx%' OR LOWER(package_name) LIKE '%apache%') AND asset_scope = 'endpoint' ``` ## corroborate-threat-evidence parallel: - → webshell-execution-patterns - → rare-config-modifications join: → triage-compromise ## webshell-execution-patterns Identify the primary behavioral signature of a web shell: a web server process manager spawning an interactive shell or interpreter. ```sqlite target=endpoint role=detection-candidate params=(lookback_days=lookback_days, scope_hosts=scope_hosts) ~~~yaml expected: Web server child processes that are shell interpreters. User name 'www-data' or similar indicates web shell context; 'root' indicates successful privilege escalation. reads: - device_hostname - user_name - process_name - process_cmd_line - parent_process_name - time silence: not_evidence_of_absence source: hb_process_activity verified: dry-run verified_at: '2026-10-17' ~~~ SELECT device_hostname, user_name, process_name, process_cmd_line, parent_process_name, time FROM hb_process_activity WHERE (LOWER(parent_process_name) LIKE '%php-fpm%' OR LOWER(parent_process_name) LIKE '%httpd%' OR LOWER(parent_process_name) LIKE '%nginx%' OR LOWER(parent_process_name) LIKE '%apache%') AND (LOWER(process_name) LIKE '%bash%' OR LOWER(process_name) LIKE '%sh%' OR LOWER(process_name) LIKE '%nc%' OR LOWER(process_name) LIKE '%python%' OR LOWER(process_name) LIKE '%perl%' OR LOWER(process_name) LIKE '%php%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') ``` ## rare-config-modifications Identify modifications to PHP configuration directories and shell profiles that are rare across the fleet, suggesting targeted tampering. ```sqlite target=endpoint role=baseline params=(lookback_days=lookback_days, scope_hosts=scope_hosts, known_malicious_files=known_malicious_files) ~~~yaml baseline: compare: first_seen window: '{{lookback_days}}d' expected: Rare file modifications in critical paths. The presence of deceptive names like Solarwinds.StatusLog.txt or plesk_sys_driver.php on specific hosts is a strong indicator of the CL-UNK-1211 playbook. prevalence: by: device_hostname key: - file_path rare_below: 5 reads: - device_hostname - actor_user_name - file_path - file_name - time silence: not_evidence_of_absence source: hb_file_activity verified: dry-run verified_at: '2026-10-17' ~~~ SELECT device_hostname, actor_user_name, file_path, time FROM hb_file_activity WHERE (LOWER(file_path) LIKE '%/etc/php/%' OR LOWER(file_path) LIKE '%/opt/plesk/php/%' OR LOWER(file_path) LIKE '%/.bashrc' OR instr(',' || '{{known_malicious_files}}' || ',', ',' || LOWER(file_name) || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND file_path IN (SELECT file_path FROM hb_file_activity WHERE (LOWER(file_path) LIKE '%/etc/php/%' OR LOWER(file_path) LIKE '%/opt/plesk/php/%' OR LOWER(file_path) LIKE '%/.bashrc' OR instr(',' || '{{known_malicious_files}}' || ',', ',' || LOWER(file_name) || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY file_path HAVING COUNT(DISTINCT device_hostname) <= 5) AND time >= datetime('now', '-{{lookback_days}} days') ``` ## triage-compromise ```agent target=hunter cite: required context: - webshell-execution-patterns - rare-config-modifications max_iterations: 4 objective: Identify persistent web shells or credential harvesting artifacts by correlating rare file modifications with anomalous shell execution under web server processes. Compare the user context of process execution against the file actors to identify suspicious elevation. success_criteria: A per-host verdict of malicious, suspicious, or benign citing the relevant process and file rows. tools: - endpoint ``` ## route-on-verdict if~: "the triage verdict is malicious for at least one host based on shell execution and config tampering" (confidence: high, judge=hunter) then: → isolate-host indeterminate: → forensic-verification unavailable: → forensic-verification (blind_spot: missing-file-telemetry) else: → close-out ## isolate-host ```action target=endpoint ~~~yaml approval: required ~~~ Isolate the host from the network and revoke any active sessions for administrative accounts seen in the interactive shell telemetry. ``` → forensic-verification ## forensic-verification ```manual target=analyst Examine the identified .bashrc and PHP configuration files on the isolated host. Check for conversational comments or 'AI-reasoning' markers within the code. Recover the content of any deceptive log files like Solarwinds.StatusLog.txt to identify captured administrative passwords and force immediate resets for those accounts. ``` → close-out ## close-out ```manual target=analyst Record the effectiveness of the prevalence check for identifying configuration tampering. Note any hosts that lacked software inventory for web services. ``` → end