Key points
- Unit 42 identified the campaign targeting government entities between October 2025 and April 2026.
- Attackers modified .bashrc files to alias the sudo command, capturing credentials while maintaining normal operation.
- Scripts contained AI-generated characteristics but were not independently planned by automated agents.
Researchers from Unit 42 tracked a credential-stealing campaign targeting government organisations and state-linked infrastructure from October 2025 to April 2026. The operation, tracked as CL-UNK-1211, used altered shell configurations to intercept sudo passwords without disrupting user activity.
The attackers replaced users’ .bashrc files with malicious copies containing a sudo alias. This alias displayed a standard password prompt, recorded the input to an attacker-controlled log, and then passed the credentials to the legitimate command. This method allowed the theft to occur silently, making the requests appear normal to the user.
Context of the investigation
Unit 42 described the activity as credential interception through changed shell configuration rather than exploitation of a sudo software flaw. The group, labelled CL-UNK-1211, has no confirmed links to state-backed activity or cybercrime syndicates. Several scripts featured conversational comments and reasoning notes consistent with AI-assisted creation, though AI did not independently plan the campaign.
Who is affected
The campaign specifically targeted government entities and state-affiliated infrastructure during the six-month observation period. The attackers also employed web shells, custom malware, and mailbox searches to maintain access and seek sensitive data. They attempted to erase evidence of their presence, complicating detection efforts for security teams.
What happens next
Applying a standard software patch for sudo would not remove this tampering, as the issue lies in user shell configuration. Administrators must audit .bashrc files for unauthorized aliases or modifications. Teams should monitor for Base64-encoded commands and scripts moving between PHP, JavaScript, Bash, and Python, which may indicate suspicious activity.
Why this attack works
This technique exploits the trust users place in familiar command-line tools. By modifying shell startup files, attackers intercept input before it reaches the intended application. This serves the persistence and credential harvesting stages of an intrusion. Teams usually check shell configuration files for unexpected aliases or hooks. Defenders should verify that critical commands like sudo are not redefined in user profiles. Monitoring for unusual file changes in home directories helps detect this early.
What to do and how to stay safe: Linux
- Audit user shell configuration files like .bashrc and .profile for unauthorized aliases or command redirections.
- Monitor for unexpected Base64-encoded strings or scripts switching between multiple languages such as PHP and Bash.
- Verify that sudo commands are not being intercepted by checking process trees and command histories for anomalies.
- Review access logs for credential use that does not match normal user patterns or expected administrative activity.
Step-by-step guide: Security Awareness Training: How Human Behaviour Shapes Defence
General security guidance from the Payload Report newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Is this a vulnerability in the sudo software itself?
No, Unit 42 stated this was credential interception through changed shell configuration, not a flaw in sudo.
Did artificial intelligence plan this attack?
No, AI helped create or adapt parts of the toolkit, but did not independently plan or carry out the campaign.
Which organisations were targeted?
The campaign targeted government organisations and state-linked infrastructure between October 2025 and April 2026.
