AI-Generated Payloads Power CL-UNK-1211 Attacks on Government Organizations

Summary

A sophisticated threat cluster tracked as CL-UNK-1211 is targeting government entities with AI-generated payloads and scripts. The attackers primarily focus on Linux environments to perform reconnaissance, dump databases, and exfiltrate sensitive information, including mailbox data. The campaign features custom Go-based RATs, web shells, and advanced anti-forensic techniques designed to reduce visibility.

Investigation

Unit 42 analyzed the attack chain from initial access through web shells to lateral movement and data exfiltration. The investigation uncovered distinctive AI-generated conversational comments embedded in malicious scripts, indicating automated or LLM-assisted code creation. Analysts also identified custom malware known as SysGoRAT along with multiple in-memory reverse shell techniques.

Mitigation

Organizations should enforce strict outbound firewall policies to prevent unauthorized reverse shells and data exfiltration. Hardening Linux environments through timely patching of vulnerabilities such as PwnKit and securing PHP configurations, including auto_prepend_file, is critical. Deploying advanced endpoint protection capable of identifying anomalous process behavior and log tampering is also strongly recommended.

Response

When malicious activity is detected, incident responders should isolate compromised Linux hosts and review all PHP and shell configurations for unauthorized changes. Conduct a thorough examination of system logs while accounting for possible attacker attempts to clear or manipulate them. Perform a comprehensive credential reset for all administrative and service accounts identified across the affected environment.

Simulation Execution

• Attack Narrative & Commands: The adversary has gained initial access to a Linux-based production server. To ensure persistence and prevent their activities from being flagged by the EDR, they intend to disable the Cortex XDR agent. The attacker first uses pgrep to identify the running processes associated with “cortex”. Once the names are confirmed, they use pkill to send a termination signal to all processes matching that pattern. This is a classic “Living off the Land” approach using standard system binaries to avoid triggering signature-based malware alerts.

• Regression Test Script:

  #!/bin/bash
  # Simulation script to trigger the "Defense Evasion by Terminating Cortex XDR Processes" rule.
  
  echo "[+] Starting Simulation: Identifying Cortex processes..."
  # This generates the 'pgrep cortex' telemetry
  pgrep cortex || echo "[-] No cortex process found, but telemetry generated."
  
  echo "[+] Simulating Attack: Attempting to kill Cortex processes..."
  # This generates the 'pkill cortex' telemetry
  pkill cortex || echo "[-] pkill executed (target likely not running)."
  
  echo "[+] Simulation Complete."

• Cleanup Commands:

  # No persistent changes are made by this simulation script.
  # If a process was actually stopped (in a real test environment), 
  # the service would need to be restarted:
  # sudo systemctl start cortex-agent
  echo "[+] Cleanup: No artifacts to remove."