[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"public-config":3,"i-flag:ph-4x3":14,"i-flag:us-4x3":19,"i-flag:de-4x3":21,"i-flag:hk-4x3":23,"i-tabler:lifebuoy":25,"i-tabler:timeline":28,"i-tabler:apps":30,"i-tabler:package":32,"i-tabler:circle-half-2":34,"i-tabler:sun":36,"i-tabler:moon":38,"i-tabler:menu-2":40,"i-tabler:user":42,"i-tabler:notebook":44,"i-simple-icons:forgejo":46,"i-tabler:shield-lock":48,"i-tabler:tools":50,"i-tabler:calendar":52,"i-tabler:x":54,"$f2qyarp0xs0za":56,"i-tabler:arrow-left":120,"i-tabler:tag":122},{"matomo":4,"booking":7,"site":9,"blog":11,"newsletter":12},{"enabled":5,"siteId":6},true,"7",{"enabled":5,"url":8},"https:\u002F\u002Fcal.com\u002Fjdbungart",{"url":10},"https:\u002F\u002Fjdneer.com",{"enabled":5},{"enabled":13},false,{"left":15,"top":15,"width":16,"height":17,"rotate":15,"vFlip":13,"hFlip":13,"body":18},0,640,480,"\u003Cpath fill=\"#0038a8\" d=\"M0 0h640v240H0z\"\u002F>\u003Cpath fill=\"#ce1126\" d=\"M0 240h640v240H0z\"\u002F>\u003Cpath fill=\"#fff\" d=\"M415.7 240L0 480V0\"\u002F>\u003Cpath fill=\"#fcd116\" d=\"M26.7 42.4L41 55l16.6-9.2l-7.4 17.5l14 13l-19-1.6l-8.1 17.2l-4.3-18.5L14 71l16.3-10zm323.8 172.3l.4 19l18 6.3l-18 6.2l-.4 19l-11.5-15.1l-18.2 5.5l10.8-15.6l-10.8-15.6l18.2 5.5zM37.2 388.1l8 17.2l19-1.6l-13.9 13l7.4 17.5l-16.6-9.1l-14.4 12.4l3.6-18.7L14 409l18.9-2.4zm114.2-249l-6.2 6.2l3.1 47l-3 .3l-5.7-42.9l-5.1 5l7.6 38.4a48 48 0 0 0-17.2 7.1l-21.7-32.4H96l26.4 34.3l-2.4 2l-31.1-35.5h-8.8v8.8l35.4 31l-2 2.5l-34.3-26.3v7.1l32.5 21.7q-5.2 7.8-7.1 17.2L66.3 223l-5.1 5l42.9 5.7q-.3 1.6-.3 3.1l-47-3l-6.2 6.2l6.2 6.2l47-3.1l.3 3.1l-42.9 5.7l5 5l38.4-7.6a48 48 0 0 0 7.1 17.2l-32.5 21.7v7.2l34.3-26.3l2 2.4l-35.4 31v8.8H89l31-35.4l2.5 2L96 312.2h7.2l21.7-32.5q7.8 5.2 17.2 7.1l-7.6 38.4l5 5l5.7-42.9q1.5.3 3.1.3l-3 47l6.1 6.2l6.3-6.2l-3.1-47l3-.3l5.7 43l5.1-5.1l-7.6-38.4a48 48 0 0 0 17.2-7.1l21.7 32.5h7.2l-26.4-34.3l2.4-2l31.1 35.4h8.8v-8.8l-35.4-31l2-2.4l34.3 26.3v-7.2l-32.5-21.7q5.2-7.8 7.1-17.2l38.3 7.6l5.1-5l-42.9-5.7q.3-1.5.3-3.1l47 3l6.2-6.1l-6.2-6.2l-47 3l-.3-3l42.9-5.7l-5-5l-38.4 7.5a48 48 0 0 0-7.1-17.2l32.5-21.7v-7.1l-34.3 26.3l-2-2.4l35.4-31v-8.9H214l-31 35.5l-2.5-2l26.4-34.3h-7.2L178 200.2q-7.8-5.2-17.2-7.1l7.6-38.3l-5-5l-5.7 42.8l-3.1-.3l3-47z\"\u002F>",{"left":15,"top":15,"width":16,"height":17,"rotate":15,"vFlip":13,"hFlip":13,"body":20},"\u003Cpath fill=\"#bd3d44\" d=\"M0 0h640v480H0\"\u002F>\u003Cpath stroke=\"#fff\" stroke-width=\"37\" d=\"M0 55.3h640M0 129h640M0 203h640M0 277h640M0 351h640M0 425h640\"\u002F>\u003Cpath fill=\"#192f5d\" d=\"M0 0h364.8v258.5H0\"\u002F>\u003Cmarker id=\"SVGEq3dreKJ\" markerHeight=\"30\" markerWidth=\"30\">\u003Cpath fill=\"#fff\" d=\"m14 0l9 27L0 10h28L5 27z\"\u002F>\u003C\u002Fmarker>\u003Cpath fill=\"none\" marker-mid=\"url(#SVGEq3dreKJ)\" d=\"m0 0l16 11h61h61h61h61h60L47 37h61h61h60h61L16 63h61h61h61h61h60L47 89h61h61h60h61L16 115h61h61h61h61h60L47 141h61h61h60h61L16 166h61h61h61h61h60L47 192h61h61h60h61L16 218h61h61h61h61h60z\"\u002F>",{"left":15,"top":15,"width":16,"height":17,"rotate":15,"vFlip":13,"hFlip":13,"body":22},"\u003Cpath fill=\"#fc0\" d=\"M0 320h640v160H0z\"\u002F>\u003Cpath fill=\"#000001\" d=\"M0 0h640v160H0z\"\u002F>\u003Cpath fill=\"red\" d=\"M0 160h640v160H0z\"\u002F>",{"left":15,"top":15,"width":16,"height":17,"rotate":15,"vFlip":13,"hFlip":13,"body":24},"\u003Cpath fill=\"#ec1b2e\" d=\"M0 0h640v480H0\"\u002F>\u003Cpath id=\"SVG5tfvBPpj\" fill=\"#fff\" d=\"M346.3 103.1C267 98 230.6 201.9 305.6 240.3c-26-22.4-20.6-55.3-10.1-72.4l1.9 1.1c-13.8 23.5-11.2 52.7 11.1 71c-12.7-12.3-9.5-39 12.1-48.9s23.6-39.3 16.4-49.1q-14.7-25.6 9.3-38.9M307.9 164l-4.7 7.4l-1.8-8.6l-8.6-2.3l7.8-4.3l-.6-8.9l6.5 6.1l8.3-3.3l-3.7 8.1l5.6 6.8z\"\u002F>\u003Cuse href=\"#SVG5tfvBPpj\" transform=\"rotate(72 312.5 243.5)\"\u002F>\u003Cuse href=\"#SVG5tfvBPpj\" transform=\"rotate(144 312.5 243.5)\"\u002F>\u003Cuse href=\"#SVG5tfvBPpj\" transform=\"rotate(216 312.5 243.5)\"\u002F>\u003Cuse href=\"#SVG5tfvBPpj\" transform=\"rotate(288 312.5 243.5)\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":27},24,"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M8 12a4 4 0 1 0 8 0a4 4 0 1 0-8 0\"\u002F>\u003Cpath d=\"M3 12a9 9 0 1 0 18 0a9 9 0 1 0-18 0m12 3l3.35 3.35M9 15l-3.35 3.35m0-12.7L9 9m9.35-3.35L15 9\"\u002F>\u003C\u002Fg>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":29},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"m4 16l6-7l5 5l5-6\"\u002F>\u003Cpath d=\"M14 14a1 1 0 1 0 2 0a1 1 0 1 0-2 0M9 9a1 1 0 1 0 2 0a1 1 0 1 0-2 0m-6 7a1 1 0 1 0 2 0a1 1 0 1 0-2 0m16-8a1 1 0 1 0 2 0a1 1 0 1 0-2 0\"\u002F>\u003C\u002Fg>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":31},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M4 5a1 1 0 0 1 1-1h4a1 1 0 0 1 1 1v4a1 1 0 0 1-1 1H5a1 1 0 0 1-1-1zm0 10a1 1 0 0 1 1-1h4a1 1 0 0 1 1 1v4a1 1 0 0 1-1 1H5a1 1 0 0 1-1-1zm10 0a1 1 0 0 1 1-1h4a1 1 0 0 1 1 1v4a1 1 0 0 1-1 1h-4a1 1 0 0 1-1-1zm0-8h6m-3-3v6\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":33},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"m12 3l8 4.5v9L12 21l-8-4.5v-9zm0 9l8-4.5M12 12v9m0-9L4 7.5m12-2.25l-8 4.5\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":35},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M3 12a9 9 0 1 0 18 0a9 9 0 1 0-18 0m9-9v18m0-7l7-7m-7 12l8.5-8.5M12 9l4.5-4.5\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":37},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M8 12a4 4 0 1 0 8 0a4 4 0 1 0-8 0m-5 0h1m8-9v1m8 8h1m-9 8v1M5.6 5.6l.7.7m12.1-.7l-.7.7m0 11.4l.7.7m-12.1-.7l-.7.7\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":39},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M12 3h.393a7.5 7.5 0 0 0 7.92 12.446A9 9 0 1 1 12 2.992z\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":41},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M4 6h16M4 12h16M4 18h16\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":43},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M8 7a4 4 0 1 0 8 0a4 4 0 0 0-8 0M6 21v-2a4 4 0 0 1 4-4h4a4 4 0 0 1 4 4v2\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":45},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M6 4h11a2 2 0 0 1 2 2v12a2 2 0 0 1-2 2H6a1 1 0 0 1-1-1V5a1 1 0 0 1 1-1m3 0v18m4-14h2m-2 4h2\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":47},"\u003Cpath fill=\"currentColor\" d=\"M16.777 0a2.9 2.9 0 1 1-2.529 4.322H12.91a4.266 4.266 0 0 0-4.265 4.195v2.118a7.08 7.08 0 0 1 4.147-1.42l.118-.002h1.338a2.9 2.9 0 0 1 5.43 1.422a2.9 2.9 0 0 1-5.43 1.422H12.91a4.266 4.266 0 0 0-4.265 4.195v2.319A2.9 2.9 0 0 1 7.222 24A2.9 2.9 0 0 1 5.8 18.57V8.589a7.11 7.11 0 0 1 6.991-7.108l.118-.001h1.338A2.9 2.9 0 0 1 16.778 0M7.223 19.905a1.194 1.194 0 1 0 0 2.389a1.194 1.194 0 0 0 0-2.389m9.554-10.464a1.194 1.194 0 1 0 0 2.389a1.194 1.194 0 0 0 0-2.39m0-7.735a1.194 1.194 0 1 0 0 2.389a1.194 1.194 0 0 0 0-2.389\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":49},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M12 3a12 12 0 0 0 8.5 3A12 12 0 0 1 12 21A12 12 0 0 1 3.5 6A12 12 0 0 0 12 3\"\u002F>\u003Cpath d=\"M11 11a1 1 0 1 0 2 0a1 1 0 1 0-2 0m1 1v2.5\"\u002F>\u003C\u002Fg>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":51},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M3 21h4L20 8a1.5 1.5 0 0 0-4-4L3 17zM14.5 5.5l4 4\"\u002F>\u003Cpath d=\"M12 8L7 3L3 7l5 5M7 8L5.5 9.5M16 12l5 5l-4 4l-5-5m4 1l-1.5 1.5\"\u002F>\u003C\u002Fg>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":53},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M4 7a2 2 0 0 1 2-2h12a2 2 0 0 1 2 2v12a2 2 0 0 1-2 2H6a2 2 0 0 1-2-2zm12-4v4M8 3v4m-4 4h16m-9 4h1m0 0v3\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":55},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M18 6L6 18M6 6l12 12\"\u002F>",{"slug":57,"title":58,"excerpt":59,"image":60,"publishedAt":61,"topics":62,"readMinutes":66,"html":67,"metaTitle":58,"metaDescription":68,"shareImage":69,"updatedAt":61,"author":73,"related":76},"ai-written-scripts-helped-hackers-backdoor-government-linux-servers-for-months-unit-42-says","AI-Written Scripts Helped Hackers Backdoor Government Linux Servers for Months, Unit 42 Says","Unit 42 says an unattributed group, CL-UNK-1211, used AI-assisted scripts to backdoor government Linux servers from October 2025 to April 2026, stealing sudo passwords and planting a Go RAT. Here is how it worked and how to check your servers.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Fclunk1211_threat_report_v2.png","2026-10-17T14:48:24.000+08:00",[63],{"key":64,"label":65},"security","Security",5,"\u003Cp>Security researchers at Palo Alto Networks' Unit 42 have published a detailed look at a hacking campaign that spent months inside Linux servers run by government entities and state-affiliated organizations. The activity ran from October 2025 to April 2026, and what makes it stand out is how much of the attackers' tooling appears to have been written with help from AI.\u003C\u002Fp>\u003Cp>Unit 42 tracks the group as CL-UNK-1211, according to \u003Ca href=\"https:\u002F\u002Funit42.paloaltonetworks.com\u002Fai-campaign-targets-linux-infrastructure\u002F?ref=ghost.jdneer.com\">its report published October 15\u003C\u002Fa> by researchers Roey Porat and Tom Fakterman. The \"UNK\" in the name is deliberate: under Unit 42's attribution framework it means the researchers have not determined whether the activity belongs to a nation-state or to cybercriminals. Unit 42 has not tied the cluster to any country, and the report does not name which AI tool or model the attackers used.\u003C\u002Fp>\u003Cp>What Unit 42 did find were fingerprints. Several of the attackers' PHP and shell scripts contained conversational, step-by-step reasoning comments explaining the code to whoever asked for it, which the researchers say suggests the code was either copied straight from an AI model's output or run by an automated AI agent. Section headers inside scripts, heavy use of Base64-encoded commands, and smooth switching between PHP, JavaScript, Bash and Python fit the same pattern. AI help did not make the code flawless, though. A mailbox-collection script called \u003Ccode>zip_mails.sh\u003C\u002Fcode> contained a broken variable assignment and would have failed when run.\u003C\u002Fp>\u003Cp>The attackers got their foothold with a mix of custom and open-source web shells on Linux web servers. To keep it, they changed the \u003Ccode>auto_prepend_file\u003C\u002Fcode> setting in every PHP configuration under \u003Ccode>\u002Fetc\u002Fphp\u002F\u003C\u002Fcode> and \u003Ccode>\u002Fopt\u002Fplesk\u002Fphp\u002F\u003C\u002Fcode>, so a file of their choosing ran before any other PHP script on the server. In one case that file was a web shell disguised as \u003Ccode>\u002Fusr\u002Flib\u002Fphp\u002Fplesk_sys_driver.php\u003C\u002Fcode>.\u003C\u002Fp>\u003Cp>Stealing passwords was a big part of the playbook. The attackers swapped in a modified \u003Ccode>.bashrc\u003C\u002Fcode> that aliased \u003Ccode>sudo\u003C\u002Fcode> to a fake password prompt, saved whatever the user typed to a log file named \u003Ccode>Solarwinds.StatusLog.txt\u003C\u002Fcode>, and then passed the password on to the real \u003Ccode>sudo\u003C\u002Fcode> so nothing looked wrong. Unit 42 says it found no evidence that SolarWinds systems were compromised; the name was just camouflage. The attackers also added a credential logger to a PHP login page and searched configuration files and shell history for email, SMTP and database passwords.\u003C\u002Fp>\u003Cp>Their custom implant is a Go-based remote access trojan that Unit 42 named SysGoRAT. It runs on both Linux and Windows, talks to its operators over WebSocket, and by default connects to \u003Ccode>104.194.158[.]65:443\u003C\u002Fcode>. It can run commands, open interactive shells, list directories, take screenshots, pull files and proxy TCP connections. On disk it went by names such as \u003Ccode>sys-control-client\u003C\u002Fcode>, \u003Ccode>pip2.7\u003C\u002Fcode>, \u003Ccode>ea_install\u003C\u002Fcode> and \u003Ccode>semanage\u003C\u002Fcode>. On Linux it can persist through a systemd service at \u003Ccode>\u002Fetc\u002Fsystemd\u002Fsystem\u002Fsys-update.service\u003C\u002Fcode> or a cron entry that runs every five minutes.\u003C\u002Fp>\u003Cp>The attackers went after government mail servers too. They enumerated \u003Ccode>\u002Fvar\u002Fqmail\u002Fmailnames\u002F\u003C\u002Fcode>, used a script called \u003Ccode>search_social.php\u003C\u002Fcode> to find messages tied to social media accounts, and dumped databases into local archives before trying to send them out over netcat or to file-hosting sites such as transfer[.]sh, bashupload[.]com, filebin[.]net and catbox[.]moe. Unit 42 describes these as exfiltration attempts and does not say how much data actually left.\u003C\u002Fp>\u003Cp>They also worked hard to cover their tracks. Unit 42 describes attempts to kill endpoint security processes, which it says its own product blocked, deletion of authentication, mail, system and web server logs, backdated file timestamps with \u003Ccode>touch -t\u003C\u002Fcode>, and planted markers such as \u003Ccode>RedTeamOps2025\u003C\u002Fcode> and the password \u003Ccode>pentest123\u003C\u002Fcode> to make the intrusion look like an authorized penetration test. To get root, they ran LinPEAS and the public PwnKit exploit for CVE-2021-4034, then left hidden root shells behind, including a SUID copy of bash named \u003Ccode>.tourch\u003C\u002Fcode>, a SUID shell named \u003Ccode>.libsystemd-helper\u003C\u002Fcode>, and a renamed Python interpreter, \u003Ccode>\u002Fusr\u002Flib\u002Fx86_64-linux-gnu\u002F.libpython-helper\u003C\u002Fcode>. For tunneling they used revsocks, pysoxy and GSocket's \u003Ccode>gs-netcat\u003C\u002Fcode>, which ran from \u003Ccode>\u002Fdev\u002Fshm\u002F.gs-10085\u002F\u003C\u002Fcode> under the fake kernel-thread name \u003Ccode>[kcached]\u003C\u002Fcode>. They also added their own SSH public key to a user's \u003Ccode>authorized_keys\u003C\u002Fcode> file for passwordless access, and the toolkit included a custom Go scanner for CVE-2025-55182 (React2Shell). Independent coverage from \u003Ca href=\"https:\u002F\u002Ftheinjection.dev\u002Fitems\u002Funit42-cl-unk-1211-linux-espionage\u002F?ref=ghost.jdneer.com\">The Injection\u003C\u002Fa> and \u003Ca href=\"https:\u002F\u002Fgbhackers.com\u002Flinux-servers-compromised\u002F?ref=ghost.jdneer.com\">GBHackers\u003C\u002Fa> matches Unit 42's account.\u003C\u002Fp>\u003Cp>\u003Cstrong>Are you affected?\u003C\u002Fstrong> Every check below comes from indicators in the Unit 42 report. Run them as root on Linux web, mail and database servers, especially Plesk hosts. A hit is a reason to investigate, not proof of compromise, and a clean result does not rule out activity the report did not cover.\u003C\u002Fp>\u003Cul>\u003Cli>Look for an unexpected PHP prepend file, and for the known disguised web shell:\u003C\u002Fli>\u003C\u002Ful>\u003Cpre>\u003Ccode>grep -rn 'auto_prepend_file' \u002Fetc\u002Fphp\u002F \u002Fopt\u002Fplesk\u002Fphp\u002F \\\n  2>\u002Fdev\u002Fnull | grep -v '= *$'\nls -la \u002Fusr\u002Flib\u002Fphp\u002Fplesk_sys_driver.php\u003C\u002Fcode>\u003C\u002Fpre>\u003Cul>\u003Cli>Check every user's shell profile for a \u003Ccode>sudo\u003C\u002Fcode> alias and look for the password log:\u003C\u002Fli>\u003C\u002Ful>\u003Cpre>\u003Ccode>grep -n 'alias sudo' \u002Froot\u002F.bashrc \u002Fhome\u002F*\u002F.bashrc\nfind \u002F -xdev -name 'Solarwinds.StatusLog.txt' 2>\u002Fdev\u002Fnull\u003C\u002Fcode>\u003C\u002Fpre>\u003Cul>\u003Cli>Hunt for the hidden root shells and the renamed Python interpreter:\u003C\u002Fli>\u003C\u002Ful>\u003Cpre>\u003Ccode>find \u002F -xdev \\( -name '.tourch' -o -name '.libsystemd-helper' \\\n  -o -name '.libpython-helper' \\) 2>\u002Fdev\u002Fnull\nfind \u002F -xdev -type f -perm -4000 -name '.*' 2>\u002Fdev\u002Fnull\u003C\u002Fcode>\u003C\u002Fpre>\u003Cul>\u003Cli>Check for SysGoRAT persistence and binaries:\u003C\u002Fli>\u003C\u002Ful>\u003Cpre>\u003Ccode>systemctl status sys-update.service\nls -la \u002Fetc\u002Fsystemd\u002Fsystem\u002Fsys-update.service \u002Fusr\u002Flocal\u002Fbin\u002F\ncrontab -l\nls -la \u002Fvar\u002Fspool\u002Fcron\u002F \u002Fvar\u002Fspool\u002Fcron\u002Fcrontabs\u002F 2>\u002Fdev\u002Fnull\npgrep -af 'sys-control-client|pip2.7|ea_install|semanage'\u003C\u002Fcode>\u003C\u002Fpre>\u003Cul>\u003Cli>Look for GSocket running from shared memory under its fake name:\u003C\u002Fli>\u003C\u002Ful>\u003Cpre>\u003Ccode>ps -eo pid,args | grep -E '\\[kcached\\]|gs-dbus|gs-netcat' \\\n  | grep -v grep\nls -la \u002Fdev\u002Fshm\u002F \u002Fdev\u002Fshm\u002F.gs-10085\u002F 2>\u002Fdev\u002Fnull\nfor p in \u002Fproc\u002F[0-9]*; do\n  grep -qa GSOCKET_ARGS $p\u002Fenviron 2>\u002Fdev\u002Fnull && echo $p\ndone\u003C\u002Fcode>\u003C\u002Fpre>\u003Cul>\u003Cli>Review SSH keys you did not add:\u003C\u002Fli>\u003C\u002Ful>\u003Cpre>\u003Ccode>cat \u002Froot\u002F.ssh\u002Fauthorized_keys \u002Fhome\u002F*\u002F.ssh\u002Fauthorized_keys \\\n  2>\u002Fdev\u002Fnull\u003C\u002Fcode>\u003C\u002Fpre>\u003Cul>\u003Cli>Search for the deception markers and the mail-search script:\u003C\u002Fli>\u003C\u002Ful>\u003Cpre>\u003Ccode>grep -rlE 'RedTeamOps2025|pentest123' \u002Ftmp \u002Fvar\u002Fwww \u002Fhome \u002Froot \\\n  2>\u002Fdev\u002Fnull\nfind \u002F -xdev \\( -name 'search_social.php' -o -name 'zip_mails.sh' \\) \\\n  2>\u002Fdev\u002Fnull\u003C\u002Fcode>\u003C\u002Fpre>\u003Cul>\u003Cli>Search firewall, proxy and DNS logs for the network indicators in the table below, plus traffic to gsocket[.]io. Unit 42's report also lists SHA-256 hashes for the web shells, SysGoRAT tooling and the PwnKit binary.\u003C\u002Fli>\u003C\u002Ful>\n\n\u003Ctable>\u003Cthead>\u003Ctr>\u003Cth>Type\u003C\u002Fth>\u003Cth>Indicator (defanged)\u003C\u002Fth>\u003C\u002Ftr>\u003C\u002Fthead>\u003Ctbody>\u003Ctr>\u003Ctd>SysGoRAT C2\u003C\u002Ftd>\u003Ctd>104.194.158[.]65\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd>IP\u003C\u002Ftd>\u003Ctd>45.88.188[.]140, 198.23.185[.]234, 138.68.244[.]146\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd>IP\u003C\u002Ftd>\u003Ctd>185.21.136[.]6, 72.61.89[.]179, 109.224.53[.]140\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd>IP\u003C\u002Ftd>\u003Ctd>162.243.175[.]162, 154.93.37[.]228, 141.164.58[.]87\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd>IP\u003C\u002Ftd>\u003Ctd>88.80.150[.]232, 88.119.167[.]57, 173.212.247[.]23\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd>IP\u003C\u002Ftd>\u003Ctd>104.248.131[.]53, 147.182.224[.]216, 93.93.112[.]57\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd>IP\u003C\u002Ftd>\u003Ctd>192.210.183[.]17\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd>Domain\u003C\u002Ftd>\u003Ctd>magento[.]ink, solidmonpe[.]com\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd>Domain\u003C\u002Ftd>\u003Ctd>wibu-bau-bawang[.]online, beraskencur[.]site\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\n\n\u003Cp>Unit 42's own advice for defenders is to watch for changes to PHP configuration, unexpected \u003Ccode>sudo\u003C\u002Fcode> aliases, new services and outbound shell connections, to enforce strict outbound firewall rules, and to use behavioral endpoint detection that flags standard Linux utilities spawning interactive shells. If anything above turns up, treat the host as compromised: preserve evidence before cleaning, rotate every password typed on that machine, and check the servers it can reach over SSH and SQL.\u003C\u002Fp>","Unit 42 says an unattributed group, CL-UNK-1211, used AI-assisted scripts to backdoor government Linux servers from October 2025 to April 2026, stealing...",{"src":60,"width":70,"height":71,"type":72},1600,900,"image\u002Fpng",{"name":74,"url":75,"owner":13},"Aiko Tanaka",null,[77,89,100,111],{"slug":78,"title":79,"excerpt":80,"image":81,"publishedAt":82,"topics":83,"readMinutes":88},"http2shell-cve-2026-111497-brotli-decoder","HTTP2Shell (CVE-2026-111497): What the Brotli Decoder Bug Really Hits, and How to Patch","CVE-2026-111497 is an out-of-bounds write in Google's Brotli decoder, 1.0.3 through 1.2.0. Fixed in 1.0.10, 1.1.1 and 1.2.1, plus Node.js, Bun, Python, Envoy and .NET updates. You are exposed if you decode untrusted Brotli data. Not in CISA KEV.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Fhttp2shell_cve_2026_111497_v2.png","2026-10-26T20:51:27.000+08:00",[84,87],{"key":85,"label":86},"advisories","Advisories",{"key":64,"label":65},1,{"slug":90,"title":91,"excerpt":92,"image":93,"publishedAt":94,"topics":95,"readMinutes":88},"package-cooldowns-github-package-firewall-npm-pnpm-bun-pip-uv-poetry","Package Cooldowns Compared: GitHub Package Firewall vs. What npm, pnpm, Yarn, Bun, pip, uv and Poetry Already Do","GitHub now offers an install-time firewall for npm, free in preview and metered later. Most package managers already ship a free cooldown. Here is what each tool does, the copy-paste config, and where cooldowns stop helping.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Fpkg-cooldowns-conveyor-alberto-rodriguez-unsplash.jpg","2026-10-26T14:00:00.000+08:00",[96,99],{"key":97,"label":98},"guides","Guides",{"key":64,"label":65},{"slug":101,"title":102,"excerpt":103,"image":104,"publishedAt":105,"topics":106,"readMinutes":88},"tailscale-ssh-tailworm-mesh-vpn-agent-risk","Your Mesh VPN Agent Is Root on Every Box. Tailworm Is the Reminder.","A researcher showed one hacked Tailscale node reaching root on other servers through Tailscale SSH forwarding. No patch yet. Here is why mesh VPN agents deserve the same suspicion as any privileged daemon.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Ftailworm-padlock-light-trails-flyd-unsplash.jpg","2026-10-26T12:00:00.000+08:00",[107,110],{"key":108,"label":109},"opinion","Opinion",{"key":64,"label":65},{"slug":112,"title":113,"excerpt":114,"image":115,"publishedAt":116,"topics":117,"readMinutes":88},"emudhra-ca-weak-keys-chain-of-trust","eMudhra Broke Almost Nothing, and Still Dented the Chain of Trust","Eight eMudhra intermediate CA keys turned out to be numbers under 256. Browsers blocked them within hours, almost no site broke, and eMudhra is leaving the TLS business. The service impact was tiny. The lesson for the chain of trust is not.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Femudhra-keys-iolandino-baiano-unsplash.jpg","2026-10-25T16:00:00.000+08:00",[118,119],{"key":108,"label":109},{"key":64,"label":65},{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":121},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M5 12h14M5 12l6 6m-6-6l6-6\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":123},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M6.5 7.5a1 1 0 1 0 2 0a1 1 0 1 0-2 0\"\u002F>\u003Cpath d=\"M3 6v5.172a2 2 0 0 0 .586 1.414l7.71 7.71a2.41 2.41 0 0 0 3.408 0l5.592-5.592a2.41 2.41 0 0 0 0-3.408l-7.71-7.71A2 2 0 0 0 11.172 3H6a3 3 0 0 0-3 3\"\u002F>\u003C\u002Fg>"]