Cybersecurity researchers have uncovered a cyber espionage campaign targeting Linux systems linked to government organizations and state-affiliated infrastructure.
The campaign, tracked as CL-UNK-1211, was observed by Palo Alto Networks’ Unit 42 between October 2025 and April 2026. Researchers say the attackers used a combination of open-source tools, custom malware and artificial intelligence (AI) to compromise networks and maintain access.
Threat actors likely used AI tools to create malicious scripts and execute commands. Some PHP and shell scripts contained conversational notes explaining how the code worked, suggesting they may have been generated by AI or deployed through automated AI agents.
The attackers used the scripts to gather information, steal credentials and extract sensitive data. They also attempted to access government email accounts and databases, as well as targeted social media accounts.
Researchers also identified a custom remote access trojan called SysGoRAT, written in the Go programming language. The malware can operate on both Linux and Windows systems and allows attackers to maintain long-term access to compromised networks. It communicates with its command-and-control (C&C) server through WebSocket connections.
To avoid detection, the attackers used reverse shells that operate directly in system memory, making them harder to identify through traditional forensic checks. They also attempted to disable security tools, delete system logs and leave fake signs of legitimate security testing.