Unit 42's Oct 15 report on CL-UNK-1211 (government targets, Oct 2025 to Apr 2026) gives concrete Linux hunts. 1) Run grep -R auto_prepend_file /etc/php /opt/plesk/php and look for any non-empty value, especially files like /usr/lib/php/plesk_sys_driver.php. 2) Check .bashrc files for a sudo alias or function that reads a password, and look for a log named Solarwinds.StatusLog.txt. 3) Look for interactive shells spawned under php-fpm, the mkfifo /tmp/f ... | nc pattern, bash -i >& /dev/tcp/, and python socket+dup2 one-liners. 4) Find SysGoRAT, a Go RAT using WebSocket wss://<addr>/ws (default C2 104.194.158[.]65:443), under names like sys-control-client, pip2.7, ea_install or semanage, with a systemd unit /etc/systemd/system/sys-update.service or a 5-minute cron. 5) Look for qmail /var/qmail/mailnames/ enumeration, search_social.php or zip_mails.sh. 6) For anti-forensics, look for touch -t timestomping, pkill/pgrep aimed at EDR, mass log deletion, and red-team decoys (RedTeamOps2025, a user with password pentest123). The full hash, IP and domain lists are in the report's IOC section (domains include magento[.]ink and solidmonpe[.]com).