Threat reportAPTTL-2026-3673
CL-UNK-1211: AI-Powered Espionage Campaign Targets Government Linux Infrastructure (SysGoRAT, CVE-2025-55182, CVE-2021-4034)
CL-UNK-1211: AI-Powered Espionage Campaign Targets (TL-2026-3673), also tracked as AI-Powered Espionage Campaign Targets Government Linux Infrastructure, is a high-severity advanced persistent threat campaign, first published 2026-10-15. It is attributed to CL-UNK-1211 with low confidence, affects Meta React Server Components (react-server-dom-parcel, references 2 CVEs (CVE-2025-55182, CVE-2021-4034), maps to 25 MITRE ATT&CK techniques (T1021.004, T1036.005, T1046), and is covered by 9 detection rules and 37 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 2Referenced vulnerabilities
- Techniques
- 25MITRE ATT&CK
- Actors
- 1CL-UNK-1211
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 37Indicators of compromise
Key facts for TL-2026-3673
- Threat ID
- TL-2026-3673
- Also known as
- AI-Powered Espionage Campaign Targets Government Linux Infrastructure, SysGoRAT campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- APT
- First published
- Last reviewed
- Attribution
- CL-UNK-1211
- Attribution confidence
- LOW
- Motivation
- ESPIONAGE
- Target sectors
- government administration, state-affiliated organizations, email and web hosting
- Detection rules
- 9
- Indicators of compromise
- 37
Malware and tooling in CL-UNK-1211: AI-Powered Espionage Campaign Targets
Malware and tooling: SysGoRAT
How CL-UNK-1211: AI-Powered Espionage Campaign Targets works
Unit 42 reports CL-UNK-1211, an activity cluster of undetermined affiliation that targeted government entities and state-affiliated Linux infrastructure between October 2025 and April 2026. Intrusion artifacts contained AI-style conversational annotations and reasoning comments; activity included PHP web shells, the Go-based SysGoRAT, PwnKit privilege escalation, credential harvesting, mailbox collection and database exfiltration attempts.
Unit 42 (Palo Alto Networks) published a DFIR-derived analysis on 2026-10-15 of a multi-month intrusion cluster tracked as CL-UNK-1211 (CL = cluster, UNK = unknown affiliation; neither confirmed nation-state nor cybercrime). Activity was observed from October 2025 to April 2026 against government entities and state-affiliated Linux infrastructure, with objectives of intelligence gathering, credential theft, mailbox exfiltration and social media account access.
Initial footholds were PHP web shells on Linux web servers. The operators modified PHP configuration (auto_prepend_file) under /etc/php/ and /opt/plesk/php/ and dropped a shell disguised as a system driver at /usr/lib/php/plesk_sys_driver.php. A custom vulnerability scanner for CVE-2025-55182 (React2Shell, an unauthenticated deserialization RCE in React Server Components, CVSS 10.0, CISA KEV 2025-12-05) was deployed to find vulnerable servers. For privilege escalation the actor used the CVE-2021-4034 (PwnKit) polkit pkexec exploit, LinPEAS enumeration, a renamed Python 3 interpreter (.libpython-helper) calling os.setuid(0)/os.setgid(0), a custom SUID shell (.libsystemd-helper) and a SUID copy of /bin/bash renamed .tourch.
SysGoRAT is a multi-platform (Windows/Linux) Go RAT, initially named sys-control-client, that communicates over WebSocket over TLS to wss://<addr>/ws with a default C2 of 104.194.158.65:443 (changeable by command-line parameter). It supports command execution, control actions, directory listing, interactive shell and TCP proxying. Persistence uses a systemd service (/etc/systemd/system/sys-update.service, binary copied to /usr/local/bin/), a five-minute cron job, and on Windows Run keys and scheduled tasks. Observed disguise names include pip2.7, ea_install and ./semanage.
Credential theft included a .bashrc sudo alias that showed a fake password prompt and logged the password to Solarwinds.StatusLog.txt before invoking real sudo, a PHP credential logger inserted into login pages, and cleartext searches of configuration files and shell history for email, SMTP and database credentials (including WordPress wp-config.php). Collection targeted mail stores under /var/qmail/mailnames/ (counting Maildir/cur messages), a search_social.php script for social-media-related email headers, and a zip_mails.sh archiver whose syntax errors suggested automated generation. Databases were sampled (TOP 100), staged in dump.sqlite, dumped to CSV, compressed with tar -czf and exfiltration was attempted via netcat to C2 and via file-hosting services (transfer.sh, bashupload.com, filebin.net, catbox.moe).
The operators used reverse shells (mkfifo/netcat, bash /dev/tcp, Python sockets) across seven C2 servers, GSocket (gs-netcat) in /dev/shm/.gs-10085/ with the process name [kcached], revsocks and pysoxy proxies, SSH with sshpass and authorized_keys injection, and MSSQL xp_cmdshell/sqlcmd double-hop execution to reach other subnets. Defense evasion included pgrep/pkill attempts against Cortex XDR processes (detected and prevented), log deletion, touch -t timestomping, HISTFILE=/dev/null and planted false-flag strings (RedTeamOps2025, pentest123).
Unit 42 assesses that artifacts contained AI-made conversational annotations and developer reasoning comments, section headers that help an AI parse output, heavy Base64 use and seamless switching between PHP, JavaScript, Bash and Python, suggesting code copied from AI output or deployed by an automated AI agent. Attribution is not determined.
MITRE ATT&CK techniques used in TL-2026-3673
Lateral Movement
Defense Evasion
T1036.005 Match Legitimate Resource Name or Location; T1070.003 Clear Command History; T1070.006 Timestomp
Discovery
T1046 Network Service Discovery
Persistence
T1053.003 Cron; T1098.004 SSH Authorized Keys; T1505.003 Web Shell; T1543.002 Systemd Service
Credential Access
T1056.001 Keylogging; T1552.001 Credentials In Files
Execution
T1059.004 Unix Shell; T1059.006 Python
Command and Control
T1071.001 Web Protocols; T1090 Proxy; T1219 Remote Access Tools; T1572 Protocol Tunneling
Collection
T1114.001 Local Email Collection; T1560.001 Archive via Utility
Initial Access
T1190 Exploit Public-Facing Application
Privilege Escalation
Exfiltration
T1567.002 Exfiltration to Cloud Storage
Reconnaissance
T1595.002 Vulnerability Scanning
defense-impairment
T1685 Disable or Modify Tools; T1685.006 Clear Linux or Mac System Logs
Affected products and versions in CL-UNK-1211: AI-Powered Espionage Campaign Targets
- Meta — React Server Components (react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack)
Vulnerable versions: 19.0.0; 19.1.0; 19.1.1; 19.2.0
Fixed in: Patched releases per the React advisory of 2025-12-03 - Vercel — Next.js (App Router)
Vulnerable versions: 15.0.0-15.0.4; 15.1.0-15.1.8; 15.2.0-15.2.5; 15.3.0-15.3.5; 15.4.0-15.4.7; 15.5.0-15.5.6; 16.0.0-16.0.6
Fixed in: Patched releases per the Next.js advisory - Polkit / Linux distributions — polkit pkexec (PwnKit)
Vulnerable versions: polkit releases before the January 2022 fixes
Fixed in: Distribution polkit updates for CVE-2021-4034 - Various — Linux web/mail hosting servers running PHP and Plesk
Vulnerable versions: Compromised environments (not version-specific)
Remediation for CL-UNK-1211: AI-Powered Espionage Campaign Targets
Patches
- Upgrade React Server Components packages and Next.js to the fixed releases named in the React advisory for CVE-2025-55182
- Apply distribution polkit updates for CVE-2021-4034 (PwnKit)
Immediate actions
- Block the published C2 IPs and domains at the perimeter and in DNS and web filtering
- Hunt for /usr/lib/php/plesk_sys_driver.php, auto_prepend_file changes under /etc/php/ and /opt/plesk/php/, search_social.php and zip_mails.sh
- Hunt for sys-update.service, sys-control-client, pip2.7, ea_install, ./semanage and /dev/shm/.gs-10085/ with a [kcached] process name
- Audit .bashrc files for sudo aliases and look for Solarwinds.StatusLog.txt
- Rotate administrator, SMTP, database and WordPress credentials and review authorized_keys files on exposed Linux hosts
Workarounds
- Remove the SUID bit from pkexec where polkit cannot be patched immediately
- Place vulnerable React/Next.js server function endpoints behind WAF virtual patching until upgraded
Longer-term hardening
- Deploy EDR with behavioral detection on Linux servers, including shell-history tampering and security-agent kill attempts
- Alert on outbound access to anonymous file-hosting services (transfer.sh, bashupload.com, filebin.net, catbox.moe) from servers
- Restrict xp_cmdshell and segment database and mail servers
- Monitor integrity of PHP configuration and web roots
CVEs associated with CL-UNK-1211: AI-Powered Espionage Campaign Targets
Weaknesses (CWE) in CL-UNK-1211: AI-Powered Espionage Campaign Targets
Timeline of CL-UNK-1211: AI-Powered Espionage Campaign Targets
- CVE-2021-4034 (PwnKit), a polkit pkexec local privilege escalation, was publicly disclosed; it later became a privilege escalation tool in this campaign.
- Unit 42 reports CL-UNK-1211 activity beginning in October 2025 against government entities and state-affiliated Linux infrastructure.
- CVE-2025-55182 (React2Shell, CVSS 10.0) published for React Server Components pre-authentication RCE.
- CISA added CVE-2025-55182 to the Known Exploited Vulnerabilities catalog.
- Observed CL-UNK-1211 activity continued through April 2026, including web shells, SysGoRAT, credential theft, mailbox access and database exfiltration attempts.
- Unit 42 published its analysis of CL-UNK-1211, citing AI-generated artifacts, SysGoRAT and a full IOC set.
Sources cited for CL-UNK-1211: AI-Powered Espionage Campaign Targets
- AI-Powered Espionage Campaign Targets Government Linux Infrastructure (Unit 42)
- NVD - CVE-2025-55182
- React: Critical Security Vulnerability in React Server Components
- Meta Security Advisory CVE-2025-55182
- CISA Known Exploited Vulnerabilities Catalog (CVE-2025-55182 added 2025-12-05)
- AWS Security Blog: China-nexus threat groups rapidly exploit React2Shell (CVE-2025-55182)
- NVD - CVE-2021-4034 (PwnKit)
Detection coverage for TL-2026-3673
As of 2026-10-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3673 across Splunk SPL, Microsoft KQL and Sigma, covering 37 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.