As cited
Copy frozen at (site build).
threat intel
Government Linux Servers Targeted With SysGoRAT and Suspected AI-Generated Scripts
Palo Alto Networks Unit 42 disclosed a cyber espionage campaign tracked as CL-UNK-1211 that targeted Linux infrastructure used by government entities and state-affiliated organizations from October 2025 through April 2026. The threat actor deployed SysGoRAT and potentially artificial intelligence (AI)-generated scripts in the attacks.
Why it matters: Government infrastructure operators and security teams defending state assets must assess whether their Linux systems were compromised by this espionage campaign and review logs from the October 2025 to April 2026 timeframe for indicators of SysGoRAT or suspicious script activity.
- Source published
- First seen by Cybersecurity Tracker