A months-long cyber espionage campaign targeted government Linux servers with a custom remote-access tool and scripts that researchers say were likely generated with artificial intelligence, according to Palo Alto Networks' Unit 42. The activity itself is historical; the disclosure is the news.

Unit 42 tracks the activity as CL-UNK-1211 and observed it between October 2025 and April 2026, targeting government and state-affiliated Linux servers and databases. Initial access came through web shell deployment and credential harvesting. The attackers used a custom Go scanner for React2Shell, CVE-2025-55182, during reconnaissance, although the report does not link that flaw to initial access.

SysGoRAT and suspected AI-generated scripts

The campaign's custom tool is SysGoRAT, a remote-access trojan written in Go for Windows and Linux that connects to its controller over WebSocket, using the hard-coded address 104.194.158.65 on port 443. It supports shell sessions, screenshots, file download and persistence. The attackers also used PHP web shells kept alive by changing PHP configuration so a malicious file loads before every script, a hijacked .bashrc that aliased sudo to capture passwords, and tools including LinPEAS, PwnKit (CVE-2021-4034) and GSocket tunnels.

Unit 42 assessed that several malicious PHP and shell scripts were likely generated using large language models or automated AI agents, based on conversational, step-by-step reasoning comments found in them. That assessment is "likely", not proven, and the researchers do not say which model or service was used. Attribution is unknown: the "UNK" label means Unit 42 cannot yet say whether the actor is a government or a criminal group, and no attribution is made here. A script intended to compress selected emails for exfiltration reportedly failed because of syntax errors.

Sources: The Hacker News via Unit 42, CL-UNK-1211 Targets Government Linux Servers With SysGoRAT and Suspected AI-Generated Scripts, 2 November 2026; Unit 42, Palo Alto Networks, CL-UNK-1211 report.