Loading threat actor…
CL-UNK-1211 is an unattributed intrusion cluster tracked by Palo Alto Networks Unit 42, with activity observed from October 2025 through April 2026 against government entities and state-affiliated infrastructure. Its operations focused on Linux servers, government databases, and email accounts. The operators' geographic origin, organizational affiliation, and dominant motivation remain undetermined; no nation-state sponsorship has been established. The cluster deployed custom and publicly available PHP web shells and maintained persistence through PHP configuration changes, unauthorized SSH keys, modified system binaries, and SUID-enabled executables. Credential theft included intercepting sudo passwords through malicious shell aliases, modifying PHP authentication pages, and searching configuration files and command histories for administrative, database, and email credentials. Operators used LinPEAS and attempted exploitation of CVE-2021-4034, although that exploit's success was not established. Lateral movement used harvested SSH credentials and Microsoft SQL Server's xp_cmdshell functionality, including execution across network segments. Its custom Go-based backdoor, SysGoRAT, supports Linux and Windows and provides WebSocket command and control, arbitrary command execution, interactive shells, directory enumeration, TCP proxying, screenshot capture, file retrieval, and persistence. Additional tooling included reverse shells, revsocks, pysoxy, GSocket, and a custom scanner for CVE-2025-55182. Operators extracted database records, staged compressed exports, searched government correspondence for social-media-related messages, and attempted mailbox archiving and external data transfers. The total extent of successful exfiltration remains unconfirmed. Defense evasion included log and command-history deletion, timestamp manipulation, removal of temporary scripts, and misleading artifacts intended to resemble authorized security testing. Observed attempts to terminate Cortex XDR were blocked. Some malicious scripts contained conversational annotations consistent with AI-assisted development, but autonomous AI operation was not established.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
7 malware families Mallory has associated with this actor across public reporting.
2 additional families tracked in Mallory.
1 CVE Mallory has associated with this actor across public reporting. 1 of them is exploited in the wild (not necessarily by this actor).
36 indicators attributed to this actor. Values are masked here and available in full in Mallory.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.