Suspected AI-Assisted Espionage Campaign Targets Government Linux Servers

Unit 42 identified an espionage campaign tracked as CL-UNK-1211 targeting government entities and state-affiliated infrastructure, primarily through Linux servers, from October 2025 through April 2026. Attackers used persistent PHP web shells, credential theft, a custom Go backdoor called SysGoRAT, and lateral movement to gather intelligence and attempt database and mailbox exfiltration. The report does not establish that all exfiltration attempts succeeded, and the attackers’ affiliation remains undetermined.

Conversational annotations and reasoning comments in malicious scripts suggest AI-assisted payload development, but researchers did not establish deployment by an autonomous AI agent. Attackers attempted to disable endpoint protection, erase logs, alter file timestamps, and plant misleading red-team markers; observed attempts to terminate Cortex XDR were blocked. Defenders should prioritize hunting for persistent web shells and SysGoRAT, investigating credential misuse and unusual database or mailbox access, and reviewing endpoint-tampering alerts alongside centrally retained logs.