Unit 42 reports AI-assisted campaign targeting government Linux servers

Unit 42 said multiple scripts contained conversational, step-by-step reasoning notes. Those notes suggested the scripts had been copied from AI prompt output or deployed by an automated AI agent; Unit 42 did not identify which explanation applied.[1] The researchers said AI helped streamline payload creation, allowing attackers to rapidly generate, adapt and deploy operational scripts.[1] The scripts used section headers, Base64-encoded commands and several programming languages.[1] For security teams, the distinction matters: the report describes evidence of AI-related assistance, not a confirmed account of the attackers’ workflow.[1]

The attackers deployed custom and open-source web shells in Linux environments to establish persistence.[1] To seek credentials, Unit 42 said they hijacked.bashrc, inserted malicious code into PHP login pages and searched files for cleartext passwords.[1] One.bashrc modification hijacked sudo to capture a user’s password in a file named Solarwinds.StatusLog.txt.[1] Unit 42 said it found no evidence that SolarWinds systems or infrastructure had been compromised.[1] The reported filename should therefore be treated as part of the observed credential-theft technique, not as proof of a SolarWinds incident.[1]

Unit 42 said attackers searched government mail-server email directories for messages about social media accounts.[1] They also attempted to create scripts to compress and exfiltrate entire mailboxes, but one script contained syntax errors and would fail.[1] Researchers found indications that the attackers intended to steal multiple databases and highly sensitive government data.[1] The attackers dumped database contents into local files and tried to exfiltrate them through command-and-control infrastructure and legitimate file-hosting services.[1]

The toolkit included SysGoRAT, a custom Go-based remote-access Trojan capable of running on Windows and Linux, as well as reverse shells, privilege-escalation tools and proxy utilities.[1] Attackers attempted to disable endpoint protections, alter timestamps, delete logs and remove malicious files, and tried to disguise their activity as a red-team operation.[1] Unit 42 said Cortex XDR detected and prevented attempts to terminate its processes, and endpoint protections were not suppressed.[1] The researchers said comprehensive visibility across Linux servers, databases and other environments remains critical to countering attackers.[1]