Government Linux Servers Hit by Espionage Campaign Using Suspected AI-Written Scripts

Palo Alto Networks Unit 42 has disclosed a cyber espionage campaign aimed at Linux infrastructure linked to government and state-affiliated organisations. Tracked as CL-UNK-1211, the activity was observed between October 2025 and April 2026. Researchers say the attackers carried out extensive reconnaissance and worked to keep long-term access to networks in support of intelligence gathering. They also tried to dump sensitive databases and exfiltrate government mailboxes to reach social media accounts.

A notable feature is the apparent use of large language models or automated AI agents to create and run malicious code. Several PHP and shell scripts contained conversational, step-by-step reasoning notes rather than normal developer documentation. Unit 42 says this suggests the code was either copied straight from an AI prompt output or deployed by an automated AI agent.

The attackers combined open-source tools, web shells and a custom backdoor written in Go, called SysGoRAT, which works on both Windows and Linux. They also tried to disable endpoint protections, wipe system logs and plant fake red-team markers so the activity might look like a legitimate security assessment. Although the targets were government-linked, the tactics are a reminder that Linux servers need the same monitoring and protection as other systems.