UNIT 42 identifies an AI-enabled espionage campaign dubbed CL-UNK-1211, targeting government Linux infrastructure and extended across Linux servers and databases. The operation ran from October 2025 to April 2026, with attackers pursuing broad reconnaissance, credential harvesting, mailbox and data exfiltration, and persistent access.
A notable feature is the use of AI-generated payloads and AI-related developer comments within malware and scripts, suggesting generation or orchestration by large language models or an automated AI agent. The threat cluster employed a mix of custom cross‑platform backdoors, open-source tools and numerous web shells to gain and maintain access, including efforts to disable endpoint protections and tamper with logs as part of anti-forensics. Evidence points to data exfiltration aims, including attempts to dump entire databases and access government mailboxes to reach social media accounts.
Technical analysis details an extensive Linux-focused playbook: initial access via web shells and credential harvesting, followed by SysGoRAT, a Go-based multi-platform RAT, and in-memory reverse shells that minimise disk artefacts. The operators targeted mail servers to identify social-media accounts, used PHP and shell scripts with AI-generated notes, and deployed a mix of backdoors and proxies to pivot and exfiltrate data.
The campaign explicitly references CVEs and indicators of compromise, such as CVE-2025-55182 (React2Shell) and CVE-2021-4034 (PwnKit), alongside a roster of IPs and domains. Defence notes highlight Cortex XDR protections, timestomping, log removal attempts and red-team masquerading. The article also lists mitigation and response options via Unit 42 services and Palo Alto Networks products, including Advanced WildFire, DNS Security, URL Filtering, and Cortex XDR/XSIAM capabilities.