Attackers planted web shells on government Linux servers and changed PHP configuration so the shells loaded before ordinary PHP pages. Palo Alto Networks Unit 42 tracked the activity as CL-UNK-1211 across operations it observed from October 2025 through April 2026. The same attackers dumped database contents and searched government mailboxes for social-media account mail, while their scripts left conversational comments consistent with AI-assisted development.
The most durable change sat in auto_prepend_file, a PHP setting that can load an attacker-chosen file ahead of a site’s normal code. Anyone maintaining a PHP-backed government service, especially one running Plesk, has a concrete configuration and filesystem check to make. A clean-looking web page can still execute a malicious prelude on every request.
PHP configuration reloaded the shell
Unit 42 saw the attackers alter auto_prepend_file across PHP configurations under /etc/php/ and /opt/plesk/php/. One web shell was stored as /usr/lib/php/plesk_sys_driver.php, a name chosen to look like a Plesk component. The PHP documentation says the configured file is “automatically parsed before the main file” and included as if called through require. One changed setting can therefore run the shell when users request otherwise legitimate PHP pages; an analyst who looks only for requests to the shell’s filename can miss that entry point.
The attackers also replaced a user’s .bashrc with one that aliased sudo to a password-capturing prompt, then handed the entered password to the real command. The user could finish the intended task while the password landed in Solarwinds.StatusLog.txt. Unit 42 says the SolarWinds name was camouflage and reports no evidence of compromised SolarWinds systems in this operation. Search for the log filename as an attacker-chosen marker, not as proof that SolarWinds software is installed.
Mailboxes led toward social accounts
On government mail servers, the attackers enumerated /var/qmail/mailnames/ and searched messages for social-media account mail. Their search_social.php script presented message paths, senders, recipients and subjects, giving the operator a way to pick accounts tied to government addresses. Unit 42 also found an attempted mailbox-archive script, zip_mails.sh, that contained a syntax error and would fail when run. Treat the mailbox search and the broken archive attempt separately when assessing possible access to mail.
A custom Go backdoor that Unit 42 calls SysGoRAT added another foothold. It used a WebSocket connection to a default address of 104[.]194[.]158[.]65:443 and could execute commands, browse directories, proxy connections and install persistence. Its operator could change that address at launch. One Linux persistence option wrote the sys-update.service unit under /etc/systemd/system/; the malware also ran under names including sys-control-client, pip2.7 and ea_install. Unit 42 observed reverse shells across at least seven distinct command-and-control servers. Three of those C2 servers carried named-pipe Netcat reverse shells.
AI clues and disrupted cleanup
The payloads carried conversational explanations and developer-style reasoning comments. Unit 42 assesses that scripts were copied from large-language-model output or deployed by an automated AI agent. Those comments help an analyst recognize AI-assisted tooling in a recovered script. Attribution to an operator requires separate evidence. Unit 42 assigns the cluster the UNK designation because its nation-state or criminal affiliation remains undetermined.
The attackers tried to terminate Cortex XDR-related processes, tampered with logs and backdated long-lived scripts with touch -t. They used RedTeamOps2025 as a key in a malicious script and pentest123 as a password for a user they created, to make the intrusion resemble an authorized assessment. In Unit 42’s observed telemetry, the process-termination attempts were detected and mitigated: “endpoint protections were not suppressed.” A local configuration or artifact match warrants incident triage even where the agent stayed running; the cleanup attempts make missing host logs a poor shortcut for ruling out access. Unit 42 evaluates its own Palo Alto Networks protections in this report, so that product result describes its observed deployments.
Inspect PHP and mail access
Start on the Linux web servers and Plesk hosts that serve PHP. Compare effective auto_prepend_file settings and the configuration files under /etc/php/ and /opt/plesk/php/ with your approved baseline. Investigate any unexpected included file, particularly /usr/lib/php/plesk_sys_driver.php, and review web-server and process telemetry for php-fpm launching an interactive shell. Restore trusted configuration and remove unauthorized files through your incident-response process, then verify a normal PHP request loads only the approved prepend file, or none where that is the intended setting.
On affected user accounts, inspect .bashrc for a sudo alias and look for Solarwinds.StatusLog.txt. Rotate credentials exposed by a malicious alias and check authentication activity from those accounts. On qmail hosts, examine access to /var/qmail/mailnames/, any search_social.php or zip_mails.sh artifacts, and mailbox export activity. Check Linux service inventory for sys-update.service and correlate outbound connections to 104[.]194[.]158[.]65:443 with process activity; because the backdoor can change its destination, investigate the binary and its launch context even without an address match. Restrict unexpected PHP file inclusion and outbound server connections while preserving evidence.
A server restored from clean PHP configuration but still carrying the credential trap or SysGoRAT remains exposed. Validate the web-request path, account startup files, service units and mail access together before returning the host to service.