A sudo hijack is an attack that steals Linux passwords by tampering with shell startup files instead of the sudo binary itself. Palo Alto Networks Unit 42 reports an espionage campaign — tracked as CL-UNK-1211, active Oct 2025–Apr 2026 against government and state-affiliated Linux infrastructure — that stole credentials by replacing victims' .bashrc with a version containing a malicious sudo alias. The alias intercepted typed passwords, copied them to an attacker log disguised as Solarwinds.StatusLog.txt, and passed everything through to the real sudo. Updating sudo would not have stopped it. Five questions for Linux admins.
Key figure: Reported cybercrime losses in the United States reached $16.6 billion in 2024, up 33% from 2023 (FBI IC3, 2024 Internet Crime Report).
Short answer: the attack lives in shell startup files, not in the sudo binary. Monitor .bashrc/.profile integrity, alert on sudo aliases and wrappers, keep EDR tamper-protection on, and audit PHP configs and privilege-escalation CVEs.
Answer for the Linux estate you administer.
.bashrc with a modified copy containing a malicious alias shadowing sudo.Solarwinds.StatusLog.txt to blend in. Unit 42 found no evidence SolarWinds was compromised — the name was pure disguise.| Fact | Detail |
|---|---|
| Reported by | Palo Alto Networks Unit 42, published Oct 15, 2026 |
| Tracking name | CL-UNK-1211 (cluster, unknown affiliation) — attribution explicitly unknown |
| Active | Oct 2025 – Apr 2026 |
| Targets | Government entities and state-affiliated Linux infrastructure; government administration, email/web hosting |
| Objectives | Intelligence gathering, credential theft, mailbox exfiltration, social media account access |
| Tooling | PHP web shells; auto_prepend_file persistence (disguised as /usr/lib/php/plesk_sys_driver.php); SysGoRAT (Go RAT, Linux+Windows, WebSocket C2, systemd/cron persistence); PwnKit (CVE-2021-4034) privesc; custom scanner for CVE-2025-55182 (React2Shell); SSH lateral movement with hardcoded creds + authorized_keys |
| Anti-forensics | Log deletion, timestamp changes, fake red-team markers, attempts to kill Cortex XDR — detected and blocked |
Source: Palo Alto Networks Unit 42 (Oct 2026). C2 address defanged in this table per standard practice.
zip_mails.sh) had malformed syntax and would have failed outright — AI assistance did not guarantee working code.~/.bashrc, ~/.profile, ~/.bash_profile, /etc/profile.d/ — alert on any change outside approved windows.sudo, su, ssh on every host.auto_prepend_file across web servers for anything pointing outside your approved include path.authorized_keys for unknown entries; alert on outbound WebSocket connections to unknown infrastructure.The attacker plants a malicious sudo alias in the victim's shell startup file (.bashrc). Every time the victim types sudo, the alias intercepts the typed password and sends it to the attacker.
Unit 42 found evidence that AI helped create or adapt parts of the toolkit — scripts carried conversational, step-by-step comments consistent with LLM generation. But AI assistance is not the same as AI autonomy.
Use file-integrity monitoring on .bashrc, .profile, .bash_profile and /etc/profile.d/; alert on any change outside approved deployment windows; periodically audit aliases with the alias command.
Unknown. Palo Alto Networks Unit 42 tracks it as CL-UNK-1211 — cluster, unknown affiliation — and explicitly does not attribute it to any state or criminal group.
AI-assisted espionage is when attackers use artificial intelligence to help plan, write, or adapt cyber-espionage tools — as Unit 42 documented in the CL-UNK-1211 campaign, where LLM-generated comments appeared in the attack scripts. The AI writes the tools; humans still run the operation.
Most would not — the malicious alias lives in a dotfile nobody audits, and the password theft looks like normal sudo use. File-integrity monitoring on shell startup files is the defense most teams are missing, and it takes an afternoon to deploy.