Hackers Used AI-Written Code to Spy on Government Linux Servers for Months, Unit 42 Finds

Hackers used AI-generated code to target government Linux servers for months, deploying web shells, credential stealers and custom malware while attempting to access government email, social media accounts and sensitive databases, according to Palo Alto Networks' Unit 42.

The activity, tracked as CL-UNK-1211, was observed from Oct. 2025 through Apr. 2026.

AI-Generated Code Left Clues Inside the Attack

Unit 42 said multiple malicious scripts contained conversational annotations and developer-style reasoning that appeared consistent with code produced by large language models or an automated AI agent .

"Rather than standard developer documentation, multiple scripts contained conversational, step-by-step reasoning notes. These notes explained the code's logic to the operator who provided the initial instructions. Their presence suggests that the code was either copied directly from an AI prompt output or deployed by an automated AI agent," Unit 42 said.

"Rather than standard developer documentation, multiple scripts contained conversational, step-by-step reasoning notes. These notes explained the code's logic to the operator who provided the initial instructions. Their presence suggests that the code was either copied directly from an AI prompt output or deployed by an automated AI agent," Unit 42 said.

The attackers also used section headers, extensive Base64-encoded commands and moved between PHP, JavaScript, Bash and Python.

Unit 42 said AI helped streamline payload creation and allowed attackers to rapidly generate, adapt and deploy operational scripts.

Government Email Became a Route to Social Accounts

The campaign focused heavily on Linux environments, where attackers deployed custom and open-source web shells and modified PHP configurations to establish persistence. In one case, they planted a malicious PHP web shell and altered the auto_prepend_file setting so it would execute before other PHP scripts.

Attackers also harvested credentials by hijacking .bashrc, inserting malicious code into PHP login pages and searching configuration and command-history files for cleartext passwords. One .bashrc modification hijacked the sudo command, captured a user's password and recorded it in a file named Solarwinds.StatusLog.txt.

Unit 42 stressed that it found no evidence that SolarWinds systems or infrastructure were compromised.

The attackers then targeted government mail servers, searching email directories for messages related to social media accounts. They attempted to create scripts to compress and exfiltrate entire mailboxes, although Unit 42 found that one such script contained syntax errors and would fail.

Attackers Tried to Erase the Trail

The toolkit also included SysGoRAT, a custom Go-based remote-access Trojan capable of running on Windows and Linux, alongside reverse shells, privilege-escalation tools and proxy utilities.

Attackers attempted to disable endpoint protections, alter timestamps, delete authentication and command-history logs, remove malicious files and disguise their activity as a red-team operation.

Unit 42 said Cortex XDR detected and prevented attempts to terminate its processes, confirming that endpoint protections were not suppressed.

Researchers also found indications that the attackers intended to steal multiple databases and highly sensitive government data. They dumped database contents into local files and attempted to exfiltrate the data through command-and-control infrastructure and legitimate file-hosting services.

Unit 42 stated: "Attackers continue to adopt AI to streamline payload development and scale their campaigns. Comprehensive visibility into Linux servers, databases and environments remains critical to countering attackers' efforts and strengthening enterprise security."

Unit 42 stated: "Attackers continue to adopt AI to streamline payload development and scale their campaigns. Comprehensive visibility into Linux servers, databases and environments remains critical to countering attackers' efforts and strengthening enterprise security."