CL-UNK-1211: Unit 42 sees LLM traces in Linux espionage tooling
Unit 42 reports that an espionage cluster it calls CL-UNK-1211 left LLM-style comments in the scripts it ran against government Linux servers.
· Unit 42 · Research by Roey Porat, Tom Fakterman
Unit 42 reports that an espionage cluster it tracks as CL-UNK-1211 hit government Linux servers from October 2025 to April 2026, and that comments left in the attacker's scripts suggest an LLM wrote or ran them.
- unit42.paloaltonetworks.comUnit 42 Analysis
- cveawg.mitre.orgReact2Shell CVE
- cveawg.mitre.orgPwnKit CVE
01What happened
Unit 42 published an analysis of CL-UNK-1211 on 2026-10-15, an intrusion cluster that targeted government entities and state-affiliated infrastructure between October 2025 and April 2026. Roey Porat and Tom Fakterman write that several of the attacker's scripts carried conversational annotations and developer reasoning comments, which they read as a sign the code was generated by an LLM or run by an automated AI agent. Unit 42 names no AI product or model on the attacker's side, and has not tied the cluster to a state or to a criminal group.
02How it works
Web shells on Linux servers gave the cluster entry, and persistence came from setting auto_prepend_file across PHP configurations in /etc/php/ and /opt/plesk/php/, so a malicious file loads before any other PHP script. A hijacked .bashrc imitated a sudo password prompt and wrote captured passwords to a file named Solarwinds.StatusLog.txt, which Unit 42 says was evasion naming and not a SolarWinds compromise. The authors name a custom cross-platform Go remote access trojan, SysGoRAT, which uses WebSocket command and control and renames itself to blend in. Besides the LLM-style comments, Unit 42 cites heavy Base64 command encoding and switching between PHP, JavaScript, Bash and Python as traits consistent with AI assistance.
03Who is affected
Government entities and state-affiliated infrastructure running Linux servers and databases are the reported targets. Unit 42 publishes no victim count, and lists at least seven command and control servers, 17 IP addresses and four domains. The cluster also used LinPEAS, PwnKit and a custom Go scanner for the React Server Components flaw CVE-2025-55182.
04What to do
Enforce strict outbound firewall rules and alert when standard utilities spawn interactive shells. Monitor Linux servers for PHP configuration changes, shell history clearing and log tampering, and check the indicators the report publishes.
Sources 3 links, all fetched
- 1unit42.paloaltonetworks.comUnit 42 Analysis
- 2cveawg.mitre.orgReact2Shell CVE
- 3cveawg.mitre.orgPwnKit CVE