In a campaign spanning from October 2025 through April 2026, government agencies and organizations tied to state infrastructure were hit by a sophisticated threat that used AI-assisted scripts to intercept Linux commands and steal credentials. Threat researchers have been tracking these operations under the label CL-UNK-1211, noting the use of familiar tools turned malicious. Any patching at the software level would be insufficient, because the attack manipulated configuration files rather than relying on a bug in sudo itself.
Exploiting Bash & Sudo for Credential Theft
The attackers made changes to user shell startup scripts—specifically the .bashrc file—creating an alias that hijacked sudo commands. When anyone on the machine entered a password, it was first captured and logged by the malicious alias, then forwarded to the real sudo process so the command appeared to run normally. To conceal their tracks, they stored credential logs under deceptive filenames like Solarwinds.StatusLog.txt.
Beyond altering shell behavior, the attackers also tampered with PHP login pages to harvest admin credentials, poked through config files, and combed through command histories to expose database, email, and SMTP credentials. Their activity included use of web shells for remote control, along with malware tailored for persistence, remote commands, and exfiltration.
Tools, Tactics & Indicators
A custom remote access tool written in Go, dubbed SysGoRAT, was key to maintaining access. It operated on both Linux and Windows, used WebSocket communication with a command-and-control server, and masked its presence with generic names such as sys-control-client, pip2.7, and ea_install. Attempts were made to hide evidence by disabling monitoring tools, removing logs and shell histories, and altering timestamps.
Multiple scripts observed in the campaign included conversational comments and logical step explanations characteristic of AI assistance or auto-generated code. Not every script worked properly—one mailbox-archiving script, for example, contained errors that prevented it from running successfully.
Security teams are advised to watch for signs of compromise such as suspicious aliases in .bashrc, unexpected credential files, unnoticed alterations to login pages or PHP settings, outbound connections to strange hosts, unexpected shell activity, and sudden changes in file timestamps. A list of SHA-256 hashes tied to tools and malware used in the campaign has also been released for defenders to cross-reference.
CL-UNK-1211 is being tracked as a cluster, rather than attributed to any known state or criminal actor. The campaigns’ blend of AI-generated code, low-level system tampering, and clean-looking aliases marks a significant shift in how attackers may leverage automation to scale up stealth and impact.
Analytical perspective: What makes this campaign unusual isn’t the tools so much as the craftsmanship. By layering AI-generated scripting atop standard Linux administration tools like sudo and using configuration files as the vector, attackers bypass classic patching and focus on subverting trust in system behavior. Defenders will need to shift from reactive patch-management toward proactively auditing shell configs, login entry points, and system artifacts. In an era when even comments inside scripts can be red flags, the capacity to trace supply chains of code, verify expected shell behavior, and ensure observability into hidden aliases becomes a core part of server hygiene. What to monitor: strange aliases, renamed credential logs, odd behavior at login shells, and any unexpected code in startup or web-login files.
