Government Linux Servers Targeted With Sys GoRAT and Suspected AI-Generated Scripts
Summary: Palo Alto Networks Unit 42 observed a cyber espionage campaign it tracks as CL-UNK-1211 targeting Linux infrastructure tied to government and state-affiliated entities between October 2025 and April 2026, using open-source tools, PHP web shells, and a Go-based remote access trojan called SysGoRAT that connects over WebSocket to a hard-coded IP address. Unit 42 said multiple malicious PHP and shell scripts contained conversational, step-by-step reasoning notes rather than developer documentation, suggesting the code was copied from AI prompt output or deployed by an automated AI agent.
Key Takeaway: The attackers attempted to dump sensitive databases and exfiltrate government mailboxes to reach social media accounts, and a bash script named zip_mails.sh meant to compress and exfiltrate emails of interest failed only because of syntax errors. Unit 42 tied the same period to ARTEX-derived intrusion attempts, and DIVD reported one case going from initial access to root in twelve minutes by chaining two Zammad zero-days.
Read the original at The Hacker News ↗
- Topics
- AI Security
- Related
- SECURITY AFFAIRS AI-CYBERSECURITY NEWSLETTER ROUND 8 Cyber Risks · Nov 15, 2026Pentagon Renames CDAO ‘Super Intelligence Office’ Cyber Risks · Nov 15, 2026186 Fake AI Domains Redirect Users to Click Fix Lures, Browser Malware, and Search Hijackers Cyber Risks · Nov 12, 2026