SysGoRAT Malware: The Linux Espionage Campaign With Possibly AI-Written Scripts, and What to Check on Your Servers

Palo Alto Networks' Unit 42 researchers have described a spying campaign that broke into Linux web and database servers run by government bodies and state-affiliated organizations, then left a new remote-control program called SysGoRAT on them. The targets were government, but the methods (PHP web shells, a fake sudo command, quietly edited PHP settings) work just as well against any business that runs Linux servers, PHP websites or a Plesk hosting panel, and most of them leave traces you can check for today.

What happened in the SysGoRAT campaign

Unit 42 published its report on Thursday, October 15, 2026. It tracks the activity as CL-UNK-1211 and says it ran from October 2025 to April 2026, against "government entities and state-affiliated infrastructure," with a focus on enterprise Linux and database environments, including government mail servers and SQL servers.

According to the report, the attackers:

• Planted custom and open-source PHP web shells, some taken from GitHub, including one named /usr/lib/php/plesk_sys_driver.php.
• Changed the PHP auto_prepend_file setting in every PHP configuration under /etc/php/ and /opt/plesk/php/, so their code would run before every PHP page.
• Replaced users' .bashrc files with a version that made sudo a fake alias. It asked for the password, saved it to a file named Solarwinds.StatusLog.txt, then passed it on to the real sudo so nothing looked wrong. Unit 42 says SolarWinds itself was not compromised; the name was only cover.
• Added a password logger to a login page to capture admin usernames and passwords, and searched config and history files for email, SMTP and database passwords.
• Ran LinPEAS to look for ways to become root, then tried PwnKit, an exploit for the old polkit flaw CVE-2021-4034.
• Moved to other machines with sshpass and hard-coded admin credentials, added their own SSH key to authorized_keys, and turned on xp_cmdshell on an internal Microsoft SQL Server to reach a second SQL server on another subnet.
• Searched stolen government mailboxes for messages from social media services, to find and get into social media accounts linked to government email addresses.
• Deleted authentication, shell history, mail, web server and PHP session logs, ran a second cleanup pass, changed file timestamps, and had scripts delete themselves.

They also carried a scanner for CVE-2025-55182 (React2Shell), a critical flaw in React Server Components. The report does not say that scanner was used to get in.

What is confirmed, what is claimed, and what is not known

Confirmed by Unit 42's own report: the tools, file names, persistence methods, SysGoRAT's features and the indicator list (17 IP addresses, 4 domains and file hashes).

Suspected, not proven: the AI angle. The report's headline calls it an "AI-Powered Espionage Campaign," but the body is more careful. It points to chatty step-by-step comments, section headers, heavy Base64 use and constant switching between PHP, JavaScript, Bash and Python, "suggesting that the code was either generated using large language models (LLMs) or executed by an automated AI agent." That is a reasonable reading of the evidence, not a confirmed finding.

Not known:

• Who is behind it. "UNK" means Unit 42 has not yet decided whether this is a nation-state or a criminal group.
• Which countries were hit, or how many organizations. The report gives no victim count.
• How they got in first. The report names no specific vulnerability or version used for initial access.

Unit 42 also found decoys meant to make the intrusion look like an authorized test: the string RedTeamOps2025 in a script and the password pentest123 on an account the attackers created. Scripts that tried to kill Palo Alto's Cortex XDR agent were blocked, the report says.

What is SysGoRAT?

SysGoRAT is a remote access trojan written in Go that runs on both Linux and Windows. It talks to its control server over a WebSocket connection (wss://<address>/ws), defaulting to the hard-coded address 104.194.158[.]65 on port 443, which operators can change with a command-line option. It can open a remote shell, take screenshots, download files, act as a proxy into the network, and set itself up to survive a reboot.

On Linux it persists as a systemd service at /etc/systemd/system/sys-update.service or a cron job that runs every five minutes. On Windows it uses a registry Run key or a scheduled task. It has been seen under names meant to blend in, such as sys-control-client, pip2.7, ea_install and ./semanage. The attackers also left root backdoors: a renamed Python 3 interpreter (.libpython-helper) and SUID shells named .libsystemd-helper and .tourch.

Why this matters for a company network or website

Nothing in this toolkit is special to government. Web shells, edited PHP settings, stolen SSH passwords and old privilege escalation bugs are how a lot of business servers get taken over. Three points stand out for a company:

• Your website is a door into your network. Here a PHP web server led to database servers on other subnets. If your web host can reach your internal systems, one hacked plugin can turn into a much bigger incident.
• Logs on the server cannot be trusted after a break-in. These attackers wiped them on purpose. If your logs only live on the machine, you may never know what happened.
• Mailboxes are keys to everything else. Password reset emails let attackers reach social media, banking and vendor portals.

What to check this week

If you find any of these, do not just delete the file. Disconnect the server from the network, keep a copy of the disk if you can, and change passwords from a clean machine. One backdoor usually means there are others.

SysGoRAT questions people are asking

What is SysGoRAT?

A remote access trojan written in Go, found by Unit 42 in a campaign against government Linux servers. It gives attackers a remote shell, screenshots, file downloads and a proxy into the network.

Is SysGoRAT AI malware?

Not exactly. Unit 42 suspects the attack scripts were written by a large language model or run by an AI agent, based on their style. That is an inference, not proof, and SysGoRAT itself is ordinary Go code.

Who is behind CL-UNK-1211?

Unknown. Unit 42 has not linked it to any country or criminal group.

Does SysGoRAT work on Windows?

Yes. Unit 42 says it supports both Linux and Windows, with Windows persistence through a registry Run key or scheduled task.

Was SolarWinds or Plesk hacked?

Unit 42 says SolarWinds was not compromised; its name was only used for a password log file. The report describes edits to Plesk's PHP configuration folders but does not say a Plesk vulnerability was used.

How do I know if my Linux server is infected?

Run the checks in the table above, compare against Unit 42's published IP addresses, domains and hashes, and look for gaps in your logs. Missing logs are a warning sign in themselves.

The bigger lesson

The most dangerous part of this campaign is not the new malware, it is how much the attackers did with ordinary tools and settings almost nobody checks: a line in .bashrc, a PHP setting, one extra SSH key. Whether or not an AI wrote the scripts, attackers are clearly getting faster at this, and the fix is the same. Know what normal looks like on your servers, patch old flaws like PwnKit, limit what your servers can reach, and keep logs somewhere attackers cannot erase.

Want someone to run these checks and lock down your servers? See security hardening or request a quote.

Get security alerts by email, with our free checklist, at /security-alerts.

Sources: Unit 42: AI-Powered Espionage Campaign Targets Government Linux Infrastructure; React: Critical Security Vulnerability in React Server Components; Qualys: PwnKit Local Privilege Escalation in polkit's pkexec.