Recent research has uncovered a sophisticated cyber campaign targeting government and state-linked infrastructure through the use of AI-assisted scripts. These scripts are designed to steal credentials and maintain access to Linux servers, while also searching for sensitive data.
AI Scripts Hijack Linux Commands
Attackers have modified shell startup files to capture passwords by intercepting the ‘sudo’ command. This tactic involves copying the entered passwords to a file while still allowing the commands to be executed normally, effectively masking the theft.
The operation also utilized web shells, custom malware, and mailbox searches, highlighting how attackers can repurpose familiar Linux tools against users without exploiting inherent flaws in the tools themselves.
Details of the Attack
According to Unit 42, the group behind these actions, designated as CL-UNK-1211, was active from October 2025 to April 2026. They targeted government entities and infrastructure, although their exact affiliations remain undetermined.
AI-generated code was evident in the scripts used, supported by conversational comments and step-by-step reasoning, suggesting the presence of an automated AI agent in the toolkit development.
Broader Implications and Defensive Measures
The campaign underscores a growing trend of using AI to accelerate malware development. Defenders are advised to monitor for unusual changes in shell configurations, PHP settings, and login pages, and to preserve system logs and evidence during investigations.
The identification of specific Indicators of Compromise (IoCs), such as manipulated shell files and encoded commands, can aid in detecting potential threats. However, these indicators should be verified with local telemetry to confirm a compromise.
In conclusion, as attackers continue to leverage AI for malicious purposes, it is crucial for organizations to update their defenses promptly and integrate threat intelligence feeds to safeguard against evolving cyber threats.
