Government Linux servers targeted with SysGoRAT and AI-generated scripts
Original title: Government Linux Servers Targeted With SysGoRAT and Suspected AI-Generated Scripts
Palo Alto Unit 42 tracks CL-UNK-1211 campaign using SysGoRAT RAT and AI scripts to compromise government Linux servers for espionage
Palo Alto Networks Unit 42 observed CL-UNK-1211 targeting Linux infrastructure from October 2025 to April 2026. Attackers use SysGoRAT RAT with WebSocket C2, AI-generated PHP and shell scripts for reconnaissance, persistence, data exfiltration including government mailboxes and social media accounts. Attempts to disable protections and plant red-team markers.
- SysGoRAT supports commands, shells and proxy
- Uses AI scripts with reasoning notes
- Targets government entities and state infrastructure
- Exfiltrates /var/qmail/mailnames/ directories
- Observed by Unit 42 October 2025–April 2026
Impact: persistent access and data exfiltration on government Linux servers
- 1.Monitor for SysGoRAT C2 indicators
- 2.Review Linux server logs for anomalous activity
- 3.Check for malicious .bashrc or PHP injections
- Threat actors
- CL-UNK-1211
- Malware
- SysGoRAT
- Victims
- government entities
- Organizations
- Palo Alto Networks
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 104.194.158.65 | (C2) connection over WebSocket to a hard-coded IP address ("104.194.158[.]65:443") and fetches seven types of commands - command, to e |
From the original article
4 min read at thehackernews.com
Cybersecurity researchers have disclosed details of a cyber espionage campaign specifically targeting Linux infrastructure associated with government entities and state-affiliated infrastructure. The activity, observed by Palo Alto Networks Unit 42 between October 2025 and April 2026, has been tracked under the moniker CL-UNK-1211, where "CL" refers to cluster and "UNK" stands for unknown
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.