AI-generated scripts and SysGoRAT target government Linux servers

Palo Alto Networks Unit 42 researchers have identified a cyber espionage campaign targeting government Linux infrastructure between October 2025 and April 2026. The operation, tracked as CL-UNK-1211, leverages large language models to generate attack scripts and deploys a custom Go-based backdoor known as SysGoRAT.

What happened

The threat actors focused their efforts on Linux environments associated with state-affiliated entities to conduct extensive reconnaissance and maintain persistent network access. Their primary objectives included dumping sensitive databases and exfiltrating government mailboxes, specifically looking for credentials that could grant access to social media accounts. This activity represents a shift toward using automated intelligence to accelerate traditional post-exploitation techniques.

To maintain access, the attackers employed a versatile mix of open-source tools, custom cross-platform backdoors, and web shells. A distinct characteristic of this campaign was the attempt to disguise malicious activity as legitimate security assessments. The operators disabled endpoint protections, wiped system logs, and planted deceptive red-team markers to confuse defenders and delay incident response efforts.

Researchers Roey Porat and Tom Fakterman noted that the attackers attempted to dump sensitive databases and exfiltrate government mailboxes. The campaign relied heavily on malicious PHP and shell scripts that appeared to be generated by AI agents. These scripts contained conversational, step-by-step reasoning notes rather than standard developer documentation, suggesting they were copied directly from AI prompt outputs or deployed by automated agents.

How it works

The core of the technical execution involves SysGoRAT, a custom remote access trojan written in Go. It supports persistence on both Windows and Linux systems and establishes a command-and-control connection over WebSocket to a hard-coded IP address. Once connected, the trojan can execute arbitrary commands, spawn interactive shells, take screenshots, exfiltrate files, and establish proxy connections to relay data bidirectionally.

Credential harvesting was achieved through three specific methods. First, the attackers replaced the .bashrc file with a malicious version designed to steal passwords. Second, they injected code into PHP login pages to capture admin credentials. Third, they scanned configuration files and command history for cleartext email, SMTP, and database passwords. These methods allowed them to move laterally and deepen their access within the compromised networks.

The use of AI extended to the creation of operational scripts. For example, a PHP script named search_social.php was deployed to search email headers for keywords related to social media accounts. Another script, zip_mails.sh, was intended to compress and exfiltrate emails but failed due to syntax errors. These errors highlight the current limitations of AI-generated code, which may lack the rigorous testing typical of human-developed malware.

Key details

• The campaign, tracked as CL-UNK-1211, targeted government Linux infrastructure from October 2025 to April 2026.
• Attackers used SysGoRAT, a Go-based trojan, to maintain persistence and communicate via WebSocket to 104.194.158[.]65:443.
• Malicious scripts contained conversational reasoning notes, indicating generation by large language models or AI agents.
• Credential theft involved modifying .bashrc files, injecting PHP code, and scanning for cleartext passwords in configs.
• Threat actors planted fake red-team markers and wiped logs to disguise their activity as authorized security tests.
• Broader industry reports show abuse of agentic frameworks like ARTEX and PentAGI by groups including Storm-0940 and Onyx Sleet.

Why it matters

For engineering teams managing Linux infrastructure, this campaign highlights a new class of threat where speed and volume outweigh stealth. The use of AI allows attackers to generate and adapt scripts rapidly, minimizing manual overhead. While the AI-generated code in this case contained errors, the ability to launch attacks at machine speed compresses the timeline for detection and response, requiring faster automated defenses.

The blending of offensive operations with defensive markers poses a significant challenge for security operations centers. When attackers plant red-team artifacts, it creates ambiguity that can stall investigation efforts. Teams must now verify not just the presence of suspicious activity, but also the legitimacy of any apparent security testing markers, adding complexity to incident response workflows.

Furthermore, the reliance on open-source agentic frameworks like ARTEX indicates that sophisticated tooling is becoming more accessible. Even if specific tools are taken down, variants like ARTEX PRO and ScopeWeaver emerge quickly. This democratization of advanced offensive capabilities means that organizations must assume that adversaries have access to powerful, automated penetration testing tools that can scan and exploit vulnerabilities at scale.

What you can do

• Monitor for unusual WebSocket connections to external IPs, particularly those attempting to establish persistent command-and-control channels.
• Audit .bashrc files and PHP login pages for unauthorized modifications or injected code that could harvest credentials.
• Scan configuration files and command histories for cleartext passwords and enforce the use of secret management solutions.
• Implement strict verification processes for any red-team markers or security assessment activities found on production systems.
• Review server logs for signs of log wiping or endpoint protection disablement, which are early indicators of compromise.
• Update detection rules to identify AI-generated script patterns, such as conversational comments or non-standard coding structures.