Hackers, possibly using AI-generated scripts, targeted government Linux servers, stealing passwords and preparing sensitive data for theft. This campaign, identified as CL-UNK-1211, occurred between October 2025 and April 2026, involving government entities and state-affiliated infrastructure. The attackers combined web shells, credential loggers, open-source utilities, and a custom backdoor to maintain access.

Their activities included intelligence gathering, including database extraction and searches for government emails connected to social media accounts. Researchers discovered conversational comments and step-by-step reasoning notes within malicious scripts, indicating that attackers may have sourced code from large language model outputs or employed an automated AI agent. Cybercriminals utilized custom and publicly available web shells on Linux servers, altering the PHP auto_prepend_file setting across configuration files located in /etc/php/ and /opt/plesk/php/.

A fake authentication prompt captured the user’s password before passing it to the real command, minimizing the visibility of their intrusion. It utilized WebSocket communications and could execute commands, transfer files, open interactive shells, and relay network traffic. The default command server was 104.194.158.65:443.