In brief
Security researchers at Palo Alto Networks' Unit 42 have described an espionage campaign against government Linux servers that ran for months, using scripts that appear to have been written by AI. Nothing about the break-in techniques is new. What's new is how quickly AI may let attackers build and adapt them.
What happened?
Unit 42 says it observed the campaign, which it tracks as CL-UNK-1211, targeting government entities and state-affiliated infrastructure between October 2025 and April 2026. It published its report on October 15, 2026, without naming victims or countries.
The attackers came in through web servers. They planted web shells, small programs that let an outsider control a server through the web, alongside open-source tools and custom backdoors that work on more than one operating system.
Then they went after what spies want. Unit 42 says they tried to dump sensitive databases and take government mailboxes to reach social media accounts. An official email inbox can be the key to official social media, and a hijacked government account is a powerful tool.
The AI fingerprints
Here is the unusual part. Scripts left behind contained explanations of their own logic, written like a chatbot talking to its user. Unit 42 says these suggest the code was generated by large language models or run by an automated AI agent.
Our reading: that doesn't mean an AI ran the operation alone. It means the attackers likely used AI as a fast, tireless assistant, producing working scripts across several programming languages on demand.
What is confirmed?
- The campaign targeted government and state-affiliated Linux infrastructure (Unit 42).
- Attackers hid their tracks: they tried to disable endpoint protection, erase logs, and plant fake red-team markers so the intrusion would look like an authorised security test.
- To stay in, they changed a PHP setting called auto_prepend_file, so their code ran before every page the server delivered.
What remains unknown?
- Who did it. Unit 42 labels the group UNK because it has not determined whether they are state-backed or criminal.
- Which governments and countries were hit, and what was taken.
- How the attackers first got their web shells onto the servers.
Why it matters
The fake red-team markers are the detail that should worry defenders most. Many organisations run authorised security tests. An intruder who looks like your own testers can stay hidden in plain sight.
And the PHP angle is timely. This campaign abused PHP configuration on Linux servers, while a separate pair of critical PHP flaws, known as PHP2Shell, are being actively exploited right now. If you run PHP on Linux, both stories point to the same servers.
What readers should do
- Check PHP configuration for auto_prepend_file. Any value you didn't set deliberately is a red flag.
- Treat unexplained red-team markers with suspicion. Confirm with whoever authorises tests before dismissing them.
- Protect logs off the server. Send logs somewhere attackers on the box can't erase.
- Watch official mailboxes. Turn on strong sign-in, and alerting, for accounts that control public social media.
- Patch PHP now, and read our story on the PHP2Shell flaws.
Right of reply
This story is based on Unit 42's published research. Unit 42 has not identified the attackers or named the governments affected, and neither do we. We will update this story if more is disclosed.