> ## Content Index > Fetch the complete content index at: https://thecyberstories.com/llms.txt > Use this file to discover other available public pages before exploring further. # Spies used AI-written code to break into government Linux servers - URL: https://thecyberstories.com/ai-assisted-espionage-government-linux-servers-2/ - Published: 2026-11-03T04:41:47.000Z - Updated: 2026-11-03T04:41:47.000Z - Description: Researchers at Unit 42 describe a months-long espionage campaign against government Linux servers, built with code that appears to have been written by AI. The techniques are old, the speed is new. Here is what they did, and what defenders should check. - Author: Raja Sekhar Thota - Tags: Incidents, #csv-6ae966073ef94ba63e061d50, #Import 2026-11-03 16:27 ## In brief Security researchers at Palo Alto Networks' Unit 42 have described an espionage campaign against government Linux servers that ran for months, using scripts that appear to have been written by AI. Nothing about the break-in techniques is new. What's new is how quickly AI may let attackers build and adapt them. ## What happened? Unit 42 says it observed the campaign, which it tracks as CL-UNK-1211, targeting [government entities and state-affiliated infrastructure between October 2025 and April 2026](https://unit42.paloaltonetworks.com/ai-campaign-targets-linux-infrastructure/?ref=thecyberstories.com). It published its report on October 15, 2026, without naming victims or countries. The attackers came in through web servers. They planted web shells, small programs that let an outsider control a server through the web, alongside [open-source tools and custom backdoors that work on more than one operating system](https://unit42.paloaltonetworks.com/ai-campaign-targets-linux-infrastructure/?ref=thecyberstories.com). Then they went after what spies want. Unit 42 says they [tried to dump sensitive databases and take government mailboxes to reach social media accounts](https://unit42.paloaltonetworks.com/ai-campaign-targets-linux-infrastructure/?ref=thecyberstories.com). An official email inbox can be the key to official social media, and a hijacked government account is a powerful tool. ## The AI fingerprints Here is the unusual part. Scripts left behind contained explanations of their own logic, written like a chatbot talking to its user. Unit 42 says these [suggest the code was generated by large language models or run by an automated AI agent](https://unit42.paloaltonetworks.com/ai-campaign-targets-linux-infrastructure/?ref=thecyberstories.com). Our reading: that doesn't mean an AI ran the operation alone. It means the attackers likely used AI as a fast, tireless assistant, producing working scripts across several programming languages on demand. ## What is confirmed? - The campaign targeted government and state-affiliated Linux infrastructure ([Unit 42](https://unit42.paloaltonetworks.com/ai-campaign-targets-linux-infrastructure/?ref=thecyberstories.com)). - Attackers hid their tracks: they tried to [disable endpoint protection, erase logs, and plant fake red-team markers](https://unit42.paloaltonetworks.com/ai-campaign-targets-linux-infrastructure/?ref=thecyberstories.com) so the intrusion would look like an authorised security test. - To stay in, they [changed a PHP setting called auto\_prepend\_file](https://unit42.paloaltonetworks.com/ai-campaign-targets-linux-infrastructure/?ref=thecyberstories.com), so their code ran before every page the server delivered. ## What remains unknown? - Who did it. Unit 42 labels the group UNK because it [has not determined whether they are state-backed or criminal](https://unit42.paloaltonetworks.com/ai-campaign-targets-linux-infrastructure/?ref=thecyberstories.com). - Which governments and countries were hit, and what was taken. - How the attackers first got their web shells onto the servers. ## Why it matters The fake red-team markers are the detail that should worry defenders most. Many organisations run authorised security tests. An intruder who looks like your own testers can stay hidden in plain sight. And the PHP angle is timely. This campaign abused PHP configuration on Linux servers, while a separate pair of critical PHP flaws, known as PHP2Shell, are being actively exploited right now. If you run PHP on Linux, both stories point to the same servers. ## What readers should do - **Check PHP configuration for auto\_prepend\_file.** Any value you didn't set deliberately is a red flag. - **Treat unexplained red-team markers with suspicion.** Confirm with whoever authorises tests before dismissing them. - **Protect logs off the server.** Send logs somewhere attackers on the box can't erase. - **Watch official mailboxes.** Turn on strong sign-in, and alerting, for accounts that control public social media. - **Patch PHP now**, and read our story on the PHP2Shell flaws. ## Right of reply This story is based on Unit 42's published research. Unit 42 has not identified the attackers or named the governments affected, and neither do we. We will update this story if more is disclosed. ## Sources - [AI-powered espionage campaign targets government Linux infrastructure (Unit 42, Palo Alto Networks, October 15, 2026)](https://unit42.paloaltonetworks.com/ai-campaign-targets-linux-infrastructure/?ref=thecyberstories.com)