Palo Alto Networks Unit 42 has disclosed details of a cyber espionage campaign targeting Linux infrastructure associated with government entities and state-affiliated organizations. The activity, tracked as CL-UNK-1211, was observed between October 2025 and April 2026. The designation refers to an unidentified cluster and unknown motivation.
Researchers said the attackers focused on Linux systems to conduct reconnaissance, maintain persistent access and support intelligence-gathering operations. Their reported objectives included dumping sensitive databases and exfiltrating government mailboxes in search of information linked to social media accounts.
The campaign combined open-source utilities, custom cross-platform backdoors and PHP web shells. The attackers also attempted to disable endpoint protections, delete system logs and leave markers that could make the activity appear to be part of a legitimate red-team assessment.
Unit 42 identified malicious PHP and shell scripts that may have been generated with large language models or automated AI agents. Several scripts contained conversational, step-by-step reasoning notes rather than conventional developer comments, suggesting that the code may have been copied from an AI-generated response or produced by an automated agent.
The operation used multiple techniques to collect credentials. These included replacing the .bashrc file with a malicious version designed to steal passwords, injecting code into PHP login pages to capture administrator credentials, and searching configuration and command-history files for plaintext email, SMTP and database passwords.
A key component was SysGoRAT, a custom remote access trojan written in Go for Windows and Linux. It connects to a hard-coded command-and-control address over WebSocket and supports arbitrary command execution, interactive shells, screenshots, file exfiltration and persistence installation. Its other functions include directory listing, proxy connections and bidirectional data relay.
The attackers also used in-memory reverse shells to reduce forensic traces on disk. They enumerated the /var/qmail/mailnames/ directories to count messages in specific folders and deployed a PHP script called search_social.php to search email headers for terms related to social media. The tool displayed file paths, senders, recipients and subjects associated with matching messages.
Another script, zip_mails.sh, was apparently intended to compress selected emails into ZIP archives for exfiltration. Unit 42 said syntax errors prevented the script from running successfully.
The findings were published alongside reporting from Google Threat Intelligence Group, Mandiant and Microsoft on the misuse of open-source agentic penetration-testing frameworks, including ARTEX, PentAGI, Hexstrike and CAIRN. These tools have been linked to reconnaissance, vulnerability scanning and data-theft operations by state-sponsored and financially motivated actors.
According to the security companies, such frameworks can accelerate attacks to machine speed, although their automated activity may sacrifice stealth by generating recognizable traffic and code-level traces that can aid detection and mitigation.
Sources: The Hacker News.