---
title: Hunt: CL-UNK-1211's Linux web-server playbook (auto_prepend_file persistence, sudo-alias password theft, SysGoRAT) | ctxsec
url: https://ctxsec.com/items/hunt-cl-unk-1211-linux-php
description: ""
status: "hunt idea (vendor research)"
published: 2026-10-15
---

> 

[← Threat Hunting](/hunting) · [markdown](/items/hunt-cl-unk-1211-linux-php.md)

hunt idea (vendor research)

2026-10-15

### Hunt: CL-UNK-1211's Linux web-server playbook (auto_prepend_file persistence, sudo-alias password theft, SysGoRAT)

Unit 42's Oct 15 report on CL-UNK-1211 (government targets, Oct 2025 to Apr 2026) gives concrete Linux hunts. 1) Run `grep -R auto_prepend_file /etc/php /opt/plesk/php` and look for any non-empty value, especially files like `/usr/lib/php/plesk_sys_driver.php`. 2) Check `.bashrc` files for a `sudo` alias or function that reads a password, and look for a log named `Solarwinds.StatusLog.txt`. 3) Look for interactive shells spawned under `php-fpm`, the `mkfifo /tmp/f ... | nc` pattern, `bash -i >& /dev/tcp/`, and python socket+dup2 one-liners. 4) Find SysGoRAT, a Go RAT using WebSocket `wss://<addr>/ws` (default C2 104.194.158[.]65:443), under names like `sys-control-client`, `pip2.7`, `ea_install` or `semanage`, with a systemd unit `/etc/systemd/system/sys-update.service` or a 5-minute cron. 5) Look for qmail `/var/qmail/mailnames/` enumeration, `search_social.php` or `zip_mails.sh`. 6) For anti-forensics, look for `touch -t` timestomping, pkill/pgrep aimed at EDR, mass log deletion, and red-team decoys (`RedTeamOps2025`, a user with password `pentest123`). The full hash, IP and domain lists are in the report's IOC section (domains include magento[.]ink and solidmonpe[.]com).

Sources: [Unit 42: AI-Powered Espionage Campaign Targets Government Linux Infrastructure](https://unit42.paloaltonetworks.com/ai-campaign-targets-linux-infrastructure/)