Unit 42 Details AI-Assisted Espionage Campaign Targeting Government Linux Systems

Article Details

Attack Vectors

• Deployed custom and open-source web shells on targeted Linux servers, including persistence through changes to PHP auto_prepend_file settings.
• Harvested credentials by hijacking the sudo command through .bashrc, inserting credential-logging code into PHP login pages, and searching configuration files and command histories for cleartext passwords.
• Used SysGoRAT and in-memory reverse shells for remote access, command execution, proxying, and persistence.
• Enumerated mailboxes and attempted to collect email and database contents for exfiltration.
• Used SSH with hard-coded administrative credentials for lateral movement and added an SSH public key to authorized_keys for persistence.
• Used PHP scripts to scan networks and enumerate SQL servers, databases, users, computers, and open shares; also scanned for systems vulnerable to CVE-2025-55182.
• Attempted privilege escalation with PwnKit and SUID-enabled binaries.
• Attempted to disable endpoint protection, alter file timestamps, delete logs and residual files, and disguise activity as a red-team operation.

Defensive Notes

• Enforce strict outbound firewall rules and use endpoint detection to identify standard utilities spawning interactive shells.
• Maintain visibility across Linux servers and database environments, and monitor for attempts to terminate endpoint protection, manipulate shell history, or delete system logs.
• The article reports that Cortex XDR detected and mitigated attempts to terminate its processes; endpoint protection was not suppressed.