Government Linux Servers Targeted With SysGoRAT and Suspected AI-Generated Scripts

Cybersecurity researchers have revealed a cyber espionage campaign targeting Linux infrastructure used by government entities and related organizations. The campaign was observed by Palo Alto Networks Unit 42 from October 2025 to April 2026 and has been labeled CL-UNK-1211. This designation indicates that the activity is part of a cluster, but the specific actor or group behind it is unknown. The campaign involves the use of SysGoRAT and suspected AI-generated scripts to compromise Linux servers. The targeting of government-associated infrastructure suggests a focused effort to gather sensitive information. Researchers have tracked the activity to better understand the tactics and motivations of the unknown actor.