Cyber Espionage Campaign Targets Government Linux Infrastructure

A cyber espionage campaign targeting Linux-based infrastructure within government and state-affiliated organisations has been uncovered, according to researchers at Palo Alto Networks Unit 42.

The activity, which was observed between October 2025 and April 2026, has been tracked under the designation CL-UNK-1211. In this naming convention, “CL” identifies the activity as part of a cluster, while “UNK” indicates that the specific threat actor remains unknown.

SysGoRAT and Suspected AI Involvement

The attackers utilised SysGoRAT, a remote access trojan (RAT), to target critical Linux servers. Beyond the use of established malware, researchers identified scripts used during the campaign that are suspected to have been generated using artificial intelligence.

The suspected use of AI-generated scripts suggests an attempt to automate the development of malicious code or to create unique, obfuscated scripts that can evade traditional signature-based detection systems.

Targeting Linux Infrastructure

By focusing on Linux environments, the threat actors are specifically targeting the backend systems and infrastructure often used by state entities. The deployment of SysGoRAT allows for persistent access, enabling long-term surveillance and the potential exfiltration of sensitive government data.

Security professionals are advised to monitor Linux systems for unauthorised script executions and unusual outbound network connections that may signal the presence of SysGoRAT or other remote access tools.