Bash .bashrc Manipulation Steals Sudo Passwords From Government Targets In Unit 42 Tracked Campaign
Attackers modified Bash startup files to intercept sudo commands and steal passwords from government and infrastructure targets, according to Unit 42 research.
Key points
- Unit 42 tracked the campaign targeting government entities from October 2025 to April 2026.
- Attackers replaced .bashrc files with malicious aliases that captured sudo passwords.
- Scripts contained AI-generated comments and moved between multiple programming languages.
Linux environments face credential theft risks when attackers manipulate shell configuration files rather than exploiting software vulnerabilities. Unit 42 reported a campaign targeting government organizations and state-linked infrastructure that used this technique to steal sudo passwords and maintain access to servers. The activity involved intercepting commands through modified user startup files, allowing attackers to capture credentials while keeping operations appearing normal to the victim.
Root cause
The core issue involves tampering with the .bashrc file, which executes commands when a Bash shell starts. Attackers replaced this file with a modified version containing a malicious alias for the sudo command. This alias displayed a prompt that looked like the standard password request. It then copied the entered password to an attacker-controlled log file before passing the credential to the legitimate sudo command, ensuring the user’s request succeeded without raising immediate suspicion.
Attack path
Researchers identified the group as CL-UNK-1211, noting activity from October 2025 to April 2026. The operation included web shells, custom malware, and mailbox searches. Scripts contained conversational comments and reasoning notes consistent with AI-generated code. Unit 42 stated that AI likely helped create or adapt parts of the toolkit, though it did not establish that AI independently planned the campaign. Code moved between PHP, JavaScript, Bash, and Python, often using Base64 encoding.
Affected versions
This attack targets Linux systems using Bash shells. It does not rely on a specific vulnerability in the sudo software itself. Instead, it exploits the trust users place in shell startup configurations. Any Linux distribution where users have write access to their .bashrc file is potentially exposed to this type of credential interception. The threat affects environments regardless of the specific Linux kernel or sudo version installed, as the compromise occurs at the user configuration level.
Mitigation
- Verify the integrity of .bashrc and other shell startup files against known good backups.
- Monitor for unauthorized modifications to user home directories and configuration files.
- Implement strict file integrity monitoring on critical system and user configuration paths.
- Review shell aliases and functions for unexpected commands or redirections to external files.
Detection notes
Security teams should monitor for unusual file modifications in user home directories, particularly changes to .bashrc or .profile. Look for new or modified aliases that redefine standard commands like sudo or ssh. Check for unexpected network connections originating from shell scripts or encoded commands. Examine logs for repeated failed sudo attempts followed by successful executions, which may indicate credential interception. Review file access patterns for scripts writing to hidden log files or temporary directories.
What to do and how to stay safe: Linux
- Audit shell configuration files for unexpected aliases or function definitions that redirect command output.
- Scan for scripts containing Base64-encoded payloads or mixed-language code in user directories.
- Monitor for new files created in user home directories with permissions allowing write access.
- Verify that sudo executions are not being intercepted by checking for extra processes spawned during authentication.
Step-by-step guide: Phishing Defenses: Answers to 10 Critical Questions
General security guidance from the BlueTeam Insider newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Is this a vulnerability in the sudo software itself?
No, Unit 42 described credential interception through a changed shell configuration, not a flaw in the sudo program.
Did AI independently carry out this attack campaign?
No, the evidence points to AI helping create or adapt parts of the toolkit, but not planning the campaign.
What group is responsible for this activity?
Unit 42 tracks the operations as CL-UNK-1211, with no confirmed link to a specific state or criminal group.
