AI-Generated Scripts Exploit Sudo Vulnerability to Hijack Linux Commands

Key Takeaways

• A sophisticated campaign, dubbed CL-UNK-1211, has targeted government and state-linked Linux infrastructure from October 2025 to April 2026.
• Attackers utilized AI-generated scripts to create a malicious alias for the sudo command, enabling the stealthy theft of user credentials.
• The campaign involved a multi-stage attack, including the deployment of custom Go-based malware (SysGoRAT), web shells, and extensive data exfiltration attempts.
• The threat actors employed various evasion techniques, such as disguising malicious files, erasing logs, and manipulating timestamps, to maintain persistence and avoid detection.
• This attack highlights the growing trend of leveraging AI for accelerated script development in cyber campaigns, emphasizing the need for robust detection and response strategies beyond simple vulnerability patching.

A coordinated cyber campaign has been actively targeting government organizations and state-affiliated Linux infrastructure, employing advanced, AI-assisted scripting to compromise systems. The objective of these attacks includes stealing credentials, maintaining covert access to Linux servers, and exfiltrating sensitive data, according to recent findings.

The attackers ingeniously manipulated the shell startup files of targeted users, specifically by injecting a malicious alias for the sudo command. This allowed them to intercept passwords entered by users, record them to a hidden file, and then seamlessly pass them to the legitimate sudo command. This method ensured that the user’s command execution appeared normal, masking the underlying credential theft. An in-depth investigation by Researchers from Unit 42 identified additional malicious activities, including the deployment of web shells, custom malware, targeted mailbox searches, and deliberate attempts to erase forensic evidence.

This operation underscores how common Linux utilities can be weaponized against their users. Instead of exploiting a direct vulnerability within sudo itself, the attackers opted to place a malicious alias within the .bashrc file. This file is automatically executed when a user initiates a Bash shell session. This critical distinction means that simply applying a software patch for sudo would not remediate this particular form of tampering. While administrators might find information on older Linux sudo vulnerabilities relevant for context, Unit 42’s report explicitly details a credential interception method that relies on altered shell configurations, not a flaw in the sudo software itself.

Unit 42, which categorizes this series of operations as CL-UNK-1211, observed these malicious activities between October 2025 and April 2026. The “UNK” designation signifies that Unit 42 has not yet definitively linked these clusters to either state-sponsored entities or established cybercrime groups, indicating the perpetrators remain unidentified at this time.

Several of the scripts discovered contained conversational comments and detailed step-by-step reasoning notes, which researchers believe are indicative of AI-generated code or the involvement of an automated AI agent in their creation. While this evidence points to AI playing a role in developing or adapting parts of the attacker’s toolkit, it does not confirm that AI autonomously planned or executed the entire campaign.

The researchers also noted the use of Base64-encoded commands and scripts that transitioned between various programming languages, including PHP, JavaScript, Bash, and Python. While these technical indicators can assist defenders in identifying suspicious code, they do not, on their own, constitute definitive proof of AI utilization.

Hackers Use AI-Generated Scripts

The primary method for credential theft involved modifying a user’s .bashrc file to include a malicious alias for sudo. When a user executed the sudo command, the fraudulent alias presented a prompt identical to the legitimate one, captured the entered password, and then saved it to an attacker-controlled log file. Subsequently, the stolen password was forwarded to the genuine sudo command, allowing the original operation to proceed without interruption, thereby making the interception largely imperceptible to the user. The attackers named this log file Solarwinds.StatusLog.txt, a tactic designed to camouflage it as a legitimate system file. Unit 42 clarified that their investigation found no evidence of compromise within SolarWinds systems or infrastructure related to this naming convention.

The credential harvesting extended beyond the shell environment. Attackers injected malicious code into PHP login pages to collect administrator usernames and passwords. They also systematically searched configuration files and command histories for email, SMTP, and database credentials. The campaign’s use of web shells and hidden access mechanisms bears similarities to other Linux credential-stealing malware, though it is important to distinguish this specific CL-UNK-1211 threat from other documented malware families.

Malware, Persistence, and Data Theft

Unit 42 uncovered a custom remote access Trojan (RAT) written in Go, which they named SysGoRAT. This versatile malware is capable of operating on both Linux and Windows systems. It establishes communication with a command-and-control (C2) server via WebSocket and supports a range of functionalities, including remote command execution, shell access, file manipulation, and persistence mechanisms. To evade detection, attackers disguised the binary using filenames like sys-control-client, pip2.7, and ea_install. The default C2 address identified was 104.194.158[.]65:443, although the report indicates that operators could modify this address during the malware’s launch.

Beyond the custom RAT, the attackers deployed web shells and altered PHP configurations to ensure that a malicious file would be loaded prior to other PHP scripts. Their data exfiltration efforts included searching government mailboxes for social media-related messages, attempting to package mailbox contents, and targeting database information. Interestingly, Unit 42 observed that one of the mailbox-archiving scripts contained a syntax error, rendering it non-functional as written. This detail serves as a reminder that even in sophisticated campaigns, malicious code may contain flaws that prevent its intended execution.

To obscure their activities, the operators actively attempted to terminate endpoint security processes, delete logs and shell histories, remove temporary scripts after use, and manipulate file timestamps. They also strategically planted “red-team-like” markers, such as RedTeamOps2025 and pentest123, in an attempt to make their unauthorized actions appear as legitimate penetration testing. Unit 42 reported that their Cortex XDR endpoint protections successfully detected and blocked attempts to terminate its processes on the observed systems, though this does not imply that every malicious activity was universally prevented.

This campaign aligns with a broader trend where threat actors are increasingly leveraging AI to accelerate the development of their malicious scripts, as evidenced by other research into AI-generated malware. For cybersecurity defenders, the practical implications necessitate a proactive approach to monitoring and incident response.

What You Should Do

• Review Configuration Files: Regularly inspect .bashrc, other shell startup files (e.g., .profile, .zshrc), and critical PHP configuration files (e.g., php.ini) for any unexpected changes or malicious aliases.
• Monitor for Suspicious Files: Look for unfamiliar files, especially those named to resemble system artifacts (e.g., Solarwinds.StatusLog.txt), or any new credential log files.
• Enhance Endpoint Detection: Ensure endpoint detection and response (EDR) solutions are up-to-date and configured to monitor for unusual process terminations, unauthorized script executions, and suspicious file modifications.
• Network Monitoring: Implement robust network monitoring to detect unusual outbound connections from Linux servers, particularly to known malicious IP addresses or domains.
• Log Management: Maintain comprehensive and immutable logs of shell activity, authentication attempts, and system events. Ensure logs are regularly reviewed and securely stored to aid in forensic investigations.
• User Education: Educate users about the importance of strong, unique passwords and the dangers of phishing attempts that could lead to initial compromise.
• Incident Response Plan: Have a well-defined incident response plan that includes steps for preserving system evidence and logs during an investigation.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.