BETWEEN October 2025 and April 2026, a threat cluster designated CL-UNK-1211 conducted a campaign against government and state‑affiliated Linux servers, deploying SysGoRAT, a Go-based backdoor, alongside persistent PHP web shells. The operation leveraged both custom and open‑source PHP shells on enterprise Linux and Plesk web servers to establish initial access, then used the web server process to fetch additional scripts from public file hosting platforms.
Analysts noted that intruders renamed system binaries (such as Python and Bash) to disguise their activities and to facilitate credential harvesting and data exfiltration.
Once inside, CL-UNK-1211 targeted credentials, mailboxes and databases. They modified the user shell profile to present a fake sudo password prompt and captured typed passwords in a Base64‑encoded log file, injected code into an administrator login page to log credentials, and searched command histories and WordPress configs for plaintext passwords.
The attackers deployed SysGoRAT, a cross‑platform Go backdoor that communicates over an encrypted WebSocket channel on port 443, supports multiple commands, and can proxy TCP traffic. In addition to on‑disk malware, they established in‑memory reverse shells via Netcat pipes and Python sockets to prevent extra artefacts being written. They also attempted to exfiltrate mailboxes and scan email headers for references to social media accounts in a bid to hijack official government profiles.
Defence guidance from the report emphasises strict outbound Linux firewall rules, monitoring for unauthorized PHP auto‑prepend changes and rogue sudo aliases, and deploying behavioural endpoint protection to detect interactive shells spawned by web server processes.