PHP auto_prepend_file Modified by AI Scripts to Steal Gov Admin Credentials on Linux
Attackers modified PHP settings to persist on Linux servers and harvest admin credentials during a campaign observed from October 2025 to April 2026.
Key points
- Hackers used AI-assisted scripts to compromise government Linux servers and steal administrator credentials.
- Persistence was established by modifying the auto_prepend_file setting in PHP configurations.
- Researchers found conversational annotations in malicious code, suggesting direct use of large language model outputs.
Security researchers observed a campaign between October 2025 and April 2026 where attackers compromised government Linux servers. The group used AI-assisted scripts to harvest administrator credentials and deploy persistent backdoors. Palo Alto Networks Unit 42 tracks this activity as CL-UNK-1211. The cluster remains unattributed, with researchers unable to determine if the motivation was state-sponsored or financial.
The risk
The attackers deployed custom and public web shells to maintain access. They modified the auto_prepend_file setting in PHP configurations located under /etc/php/ and /opt/plesk/php/. This change forced a malicious file to execute before other PHP scripts, ensuring persistence across hosted applications. One implant disguised itself as /usr/lib/php/plesk_sys_driver.php to blend in with system files.
Who is exposed
Operators targeted government Linux servers during this campaign. They searched configuration files and command histories for exposed SMTP, email, and database passwords to enable lateral movement. The toolkit included SysGoRAT, a custom Go-based remote access Trojan supporting both Linux and Windows environments. Researchers documented reconnaissance and database dumping activities associated with these intrusions.
Cost and compliance
The source material does not specify financial costs or compliance penalties resulting from this campaign. Unit 42 noted that intelligence-gathering behavior did not establish a nation-state connection. Researchers found no evidence that SolarWinds infrastructure was compromised, despite the use of a log file named Solarwinds.StatusLog.txt to impersonate routine software activity.
What to watch
Managers should verify that PHP configuration files have not been altered to include unauthorized auto_prepend_file directives. Teams should audit web directories for unexpected shell scripts or files masquerading as system drivers. Monitoring for anomalous outbound connections from web servers can help detect credential exfiltration attempts before lateral movement occurs.
Signals worth monitoring
Teams usually detect this activity by reviewing web server access logs for unusual requests to PHP configuration directories. Check whether any scripts are executing before standard application code loads. Look for new or modified files in system library paths that mimic legitimate drivers. Monitor for unexpected aliases in shell initialization files that capture input. Verify that no unknown remote access tools are running on web-facing servers.
What to do and how to stay safe: Linux
- Audit PHP configuration files in /etc/php/ and /opt/plesk/php/ for unauthorized auto_prepend_file entries.
- Scan web directories for recently modified shell scripts or files with misleading names like system drivers.
- Review shell initialization files such as .bashrc for aliases that log keystrokes or redirect output.
- Monitor outbound network traffic from web servers for connections to unknown external IP addresses.
Step-by-step guide: Security Awareness Training: 6 Misunderstandings That Waste Your Budget
General security guidance from the SecOps Signal newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Did the attackers use fully automated AI agents to break in?
Researchers found evidence of AI assistance, but malformed code in some scripts suggests operators did not rely on fully autonomous agents for all tasks.
Was SolarWinds software compromised in this campaign?
No, researchers found no evidence that SolarWinds infrastructure was compromised; the attackers only used a filename to impersonate routine software activity.
What is the attribution for this threat group?
The cluster is currently unattributed, with Unit 42 marking it as "UNK" because researchers have not determined if it is state-sponsored or financially motivated.
