Government Linux Servers Targeted With SysGoRAT and Suspected AI-Generated Scripts Ravie LakshmananNov 02, 2026Cyber Espionage / Malware Cybersecurity researchers have disclosed details of a cyber espionage campaign specifically targeting Linux infrastructure associated with government entities and state-affiliated infrastructure. The activity, observed by Palo Alto Networks Unit 42 between October 2025 and April 2026, has been tracked under the moniker CL-UNK-1211, where "CL" refers to cluster and "UNK" stands for unknown motivation. A notable aspect of the campaign concerns the use of large language models (LLMs) and/or automated artificial intelligence (AI) agents to generate payloads and execute malicious code. "The attackers behind this cluster of activity focused on Linux environments to conduct extensive reconnaissance and maintain persistent network access to support intelligence-gathering," researchers Roey Porat and Tom Fakterman said. "The attackers attempted to dump sensitive databases and exfiltrate government mailboxes to access social media accounts." The campaign employs a "versatile operational playbook," leveraging a combination of open-source tools, custom cross-platform backdoors, and web shells to maintain access. Another hallmark involves attempts to disable endpoint protections, wipe system logs, and plant deceptive red-team markers so as to disguise the activity as a legitimate security assessment. The threat actor has also been observed using malicious PHP and shell scripts, likely generated using AI, to maintain persistence, perform reconnaissance, and exfiltrate data. "Rather than standard developer documentation, multiple scripts contained conversational, step-by-step reasoning notes. These notes explained the code's logic to the operator who provided the initial instructions," the cybersecurity company said. "Their presence suggests that the code was either copied directly from an AI prompt output or deployed by an automated AI agent." A mix of open-source and bespoke PHP web shells is used as a way to maintain a persistent backdoor into the host networks. The access is then abused to gather credentials from the targeted environment using three different methods - Replacing the .bashrc file with a malicious version containing a command to steal passwords. Injecting code into PHP login pages to harvest admin credentials. Scanning for cleartext email, SMTP, and database passwords within configuration files and command history files. Also deployed as part of the attacks is a custom, multi-platform remote access trojan written in Go that supports various persistence methods to maintain long-term access on Windows and Linux systems. Called SysGoRAT, it establishes a command-and-control (C2) connection over WebSocket to a hard-coded IP address ("104.194.158[.]65:443") and fetches seven types of commands - command, to execute arbitrary commands via /bin/sh -c (Linux) or cmd /C (Windows) control, to spawn via sub-commands an interactive shell (shell_start), screenshots (screenshot), exfiltrate files to the C2 server (download), and install persistence (persist) shell_input, to create an interactive shell session proxy_connect, to establish a TCP connection to an arbitrary target proxy_data, to relay data bidirectionally to an established proxy connection proxy_close, to terminate and remove a proxy session Furthermore, the attacks make use of in-memory reverse shells to avoid leaving forensic artifacts on disk, as well as enumerate "/var/qmail/mailnames/" directories to count the number of emails stored in specific folders. "Next, the attackers searched for social media-related emails," Unit 42 explained. "They deployed a PHP script, named search_social.php, that searched for specific keywords in email headers and displayed the results in a user-friendly format." "The script then parsed the response and displayed the exact file path, social media account email sender, recipient and subject." The attackers have also been found attempting to generate a bash script named "zip_mails.sh" in a bid to compress emails of interest into ZIP archives and exfiltrate the information. However, syntax errors present in the script meant that the program failed upon execution. "This campaign demonstrates how attackers are combining traditional post-exploitation techniques with AI-accelerated workflows to target governmental Linux server infrastructure," Unit 42 said. "By leveraging AI to rapidly generate, adapt and deploy operational scripts, the attackers behind CL-UNK-1211 maintained a fast pace of operation while minimizing manual developer overhead." The development comes as Google Threat Intelligence Group (GTIG) and Mandiant, along with Microsoft, documented threat actors' abuse of open-source agentic penetration testing frameworks like ARTEX, PentAGI, Hexstrike, and CAIRN to carry out a "broad range of actions" across various stages of the attack life cycle at an unprecedented speed and scale. Although ARTEX was taken down by its author after reports of widespread misuse emerged, it has spawned multiple versions, including a commercial offering dubbed ARTEX PRO and a localized variation called ScopeWeaver. Use of ARTEX by Storm-0940 (aka UNC7228) to orchestrate data theft campaigns targeting entities in the U.S. and Europe across the enterprise software, industrial automation, semiconductor manufacturing and design, and telecommunications industry verticals. Use of ARTEX by financially motivated threat actors to facilitate data theft extortion, including the targeting of the financial sector in Asia. Use of ARTEX by North Korean state-sponsored hacking groups like Onyx Sleet (aka Andariel) and Pearl Sleet (aka Lawrencium) in operations. Use of PentAGI for WHOIS asset mapping and systematic reconnaissance and vulnerability scanning against organizations in Asia. "The emergence of ARTEX and similar agentic offensive intrusion frameworks underscores a broader shift toward threat actor adoption of open source multi-agent offensive frameworks, as well as potentially custom agentic harnesses," GTIG and Mandiant said. "Frameworks such as ARTEX compress attack timelines to machine speed; however, they currently trade stealth for velocity. Unrestricted autonomous execution generates forensic traffic, relies on recognizable identifiers, and leaves behind distinct code-level traces, increasing the likelihood of detection and mitigation." Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. artificial intelligence, Cyber Attack, cyber espionage, data theft, linux, Malware, Nation-State Critical 16-Year-Old UEFI Flaw Can Run Code Before Secure Boot on Network-Booting Servers PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces TeamViewer Flaw Lets Remote Computers Attack Users Who Connect to Control Them Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls GoAhead TLS Flaws Allow Revoked Client Certificates and Enable Session Decryption Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software Chinese Hackers Use AI-Powered ARTEX to Target Over 200 Organizations Worldwide China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility The Rise of the Threat Operator: How AI Will Redefine Security Operations and Careers Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions AI-Generated Fake Login Pages Are Making Account Takeovers Easier PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network American Organizations Under Attack: Skyw4lker Device Code Phishing Campaign Exposed CyberStrikeAI Uses 44 AI Agents to Automate Hacking Operations Against Japan Targets Anthropic's Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen Why Urgent Security Fixes Aren't Fixed. Observe, Prove, Act, Confirm Gets Them Moving Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor ThreatsDay: Critical Firewall Flaws, Banking Trojans Rented, Weaponized PDF, Token Theft + 26 More Stories Beyond CVE Scanning: Book a Demo of Continuous AI-Powered Web Pentesting Detect Lateral Movement and Evasive Attacks With Corelight's Open NDR Platform Assess Your Organization's AI Code Sprawl Exposure With This Practical Guide See How Bitdefender GravityZone Identifies Shadow AI and Prioritizes Endpoint Risks Your SOC Has an Identity Blind Spot. Here's How to Fix It Learn how to close critical identity visibility gaps in your SOC, detect hidden threats, and accelerate incident response across human, machine, and AI identities. Watch Free Now Roadmap for AI-Ready Security Operations Evaluate Attack Surface Visibility With an AI Threat Readiness Framework Learn how to assess AI threat readiness, strengthen attack surface visibility, and prepare security operations for emerging threats in this practical webinar. Uncover Identity Dark Matter: SACR Research Brief Eliminate the blind spots undermining your security. Download the SACR brief. BeyondTrust an 8X Gartner® Magic Quadrant™ Leader for PAM Gain clarity on the PAM market and understand why BeyondTrust is again a Leader. 11 Real Stories: How Identity Exposure Unlocks Active Attack Paths Map cross-domain privilege escalation to sever breach routes at key choke points. Governance Sets the Ceiling on Your AI Security Program See the five moves that raise a Stage 2 Govern score to a defensible Stage 3. The MSP Margin Math Nobody's Doing: Your Next Technician Might Already be on Payroll PEDM vs. Standing Elevated Privileges: Control Access Without Flooding the Helpdesk Your Backup Isn't Ransomware-Proof Just Because It Exists Why Root and Jailbreak Detection Alone Cannot Guarantee Mobile App Security