AI Driven Campaign Targets Government Linux Servers

Cybersecurity researchers have detailed a cyber espionage campaign targeting government Linux infrastructure, observed by Palo Alto Networks Unit 42 between October 2025 and April 2026 and tracked under the name CL-UNK-1211. The operation utilises large language models and AI agents to fabricate payloads and drive execution, with attackers focusing on Linux environments to perform extensive reconnaissance and maintain long‑term network access to gather intelligence. Unit 42 notes that the intruders attempted to dump sensitive databases and exfiltrate government mailboxes to access social media accounts.

The attackers employ a versatile playbook combining open‑source tools, bespoke cross‑platform backdoors, and web shells to sustain access, with additional efforts to disable endpoint protections, wipe logs, and plant deceptive red‑team markers to mimic legitimate security testing.

A notable component is SysGoRAT, a Go‑written remote access trojan used to achieve persistence on Windows and Linux, which communicates with a hard‑coded C2 address over WebSocket at 104.194.158[.]65:443 and accepts seven commands, including arbitrary command execution, interactive shells, file exfiltration, and proxy management.

The campaign also uses in‑memory reverse shells to avoid on‑disk artefacts and scans /var/qmail/mailnames/ to count emails, while scripts like PHP‑based search_social.php harvest email headers and display file paths, sender, recipient and subject.

Unit 42 emphasises that these activities illustrate AI‑accelerated post‑exploitation workflows accelerating data collection against government Linux servers, with references to ARTEX and related agentic tooling. The report attributes findings to Palo Alto Networks Unit 42, researchers Roey Porat and Tom Fakterman, and notes ongoing industry commentary from GTIG, Mandiant and others. The Hacker News. 2 November 2026.