AI-Generated Attack Code Used in Long-Running Espionage Campaign Against Government Linux Systems

Researchers at Unit 42 have identified a campaign aimed at government entities and state-affiliated infrastructure, with activity observed from October 2025 to April 2026. They track it as CL-UNK-1211. The "UNK" label means they have not yet determined whether the group is a nation-state or a cybercrime actor.

The attackers focused on Linux environments, carrying out extensive reconnaissance and keeping long-term access to support intelligence gathering. Several files left behind during the intrusions contained conversational notes and developer-style reasoning comments. This suggests the code was either written by a large language model or run by an automated AI agent. The attackers tried to dump sensitive databases and steal government mailboxes, with the aim of reaching social media accounts.

Their toolkit mixed open-source tools, custom backdoors that work across platforms, and web shells (hidden pages that give remote control of a server) installed widely. They also tried to avoid detection by disabling endpoint protections, erasing system logs and planting fake red-team markers to make the activity look like a legitimate security assessment. This is only the opening of the research, so further technical detail is not covered here.