Government Linux Servers Targeted by CL-UNK-1211 Campaign Using SysGoRAT and Suspected AI-Generated Scripts
A cyber espionage campaign, dubbed CL-UNK-1211, has been targeting Linux infrastructure of government entities and state-affiliated organizations, employing the SysGoRAT malware and potentially AI-generated scripts.
Cybersecurity researchers have detailed a sophisticated cyber espionage campaign, tracked as CL-UNK-1211, that has been actively targeting the Linux infrastructure of government entities and state-affiliated organizations. Observed between October 2025 and April 2026, the campaign's primary objective appears to be extensive reconnaissance and the maintenance of persistent network access to facilitate intelligence gathering.
The attackers behind CL-UNK-1211 have demonstrated a versatile operational playbook, utilizing a combination of open-source tools, custom cross-platform backdoors, and web shells. A particularly noteworthy aspect of this campaign is the suspected use of large language models (LLMs) and/or automated artificial intelligence (AI) agents to generate malicious payloads and execute code. This is evidenced by conversational, step-by-step reasoning notes found within multiple scripts, suggesting direct output from AI prompts or deployment by AI agents.
The campaign's technical arsenal includes custom PHP and shell scripts, likely AI-generated, for persistence, reconnaissance, and data exfiltration. The threat actors also employ a custom, multi-platform remote access trojan written in Go, named SysGoRAT. This malware establishes command-and-control (C2) connections over WebSocket and supports various commands, including arbitrary command execution, interactive shell sessions, screenshotting, file exfiltration, and establishing persistence on both Windows and Linux systems.
To maintain access and gather credentials, the attackers deploy a mix of open-source and bespoke PHP web shells. They also employ tactics such as replacing the .bashrc file with a malicious version to steal passwords, injecting code into PHP login pages to harvest admin credentials, and scanning configuration files and command history for cleartext passwords.
Furthermore, the campaign leverages in-memory reverse shells to minimize forensic artifacts on disk. The attackers have been observed enumerating specific directories to count emails and actively searching for social media-related emails using a PHP script named search_social.php. They also attempted to compress and exfiltrate emails of interest using a bash script, though syntax errors reportedly caused this to fail.
Beyond the direct malware deployment, the threat actors have been observed attempting to disable endpoint protections, wipe system logs, and plant deceptive red-team markers. This tactic aims to disguise their malicious activities as legitimate security assessments, adding a layer of obfuscation to their operations.
The CL-UNK-1211 campaign highlights a growing trend of threat actors combining traditional post-exploitation techniques with AI-accelerated workflows. By leveraging AI for rapid script generation and adaptation, attackers can maintain a high operational tempo while reducing manual effort, posing a significant challenge to traditional cybersecurity defenses.
This development aligns with broader observations of threat actors adopting AI-powered tools and frameworks, such as ARTEX and PentAGI, to automate various stages of the attack lifecycle, enabling faster and more scalable operations across diverse industry verticals.