Cybersecurity researchers have disclosed details of a cyber espionage campaign specifically targeting Linux infrastructure associated with government entities and state-affiliated infrastructure.
The activity, observed by Palo Alto Networks Unit 42 between October 2025 and April 2026, has been tracked under the moniker CL-UNK-1211, where “CL” refers to cluster and “UNK” stands for unknown motivation.
A notable aspect of the campaign concerns the use of large language models (LLMs) and/or automated artificial intelligence (AI) agents to generate payloads and execute malicious code.
“The attackers behind this cluster of activity focused on Linux environments to conduct extensive reconnaissance and maintain persistent network access to support intelligence-gathering,” researchers Roey Porat and Tom Fakterman said. “The attackers attempted to dump sensitive databases and exfiltrate government mailboxes to access social media accounts.”
The campaign employs a “versatile operational playbook,” leveraging a combination of open-source tools, custom cross-platform backdoors, and web shells to maintain access. Another hallmark involves attempts to disable endpoint protections, wipe system logs, and plant deceptive red-team markers so as to disguise the activity as a legitimate security assessment.
The threat actor has also been observed using malicious PHP and shell scripts, likely generated using AI, to maintain persistence, perform reconnaissance, and exfiltrate data.
“Rather than standard developer documentation, multiple scripts contained conversational, step-by-step reasoning notes. These notes explained the code’s logic to the operator who provided the initial instructions,” the cybersecurity company said. “Their presence suggests that the code was either copied directly from an AI prompt output or deployed by an automated AI agent.”
A mix of open-source and bespoke PHP web shells is used as a way to maintain a persistent backdoor into the host networks. The access is then abused to gather credentials from the targeted environment using three different methods –
- Replacing the .bashrc file with a malicious version containing a command to steal passwords.
- Injecting code into PHP login pages to harvest admin credentials.
- Scanning for cleartext email, SMTP, and database passwords within configuration files and command history files.
Also deployed as part of the attacks is a custom, multi-platform remote access trojan written in Go that supports various persistence methods to maintain long-term access on Windows and Linux systems. Called SysGoRAT, it establishes a command-and-control (C2) connection over WebSocket to a hard-coded IP address (“104.194.158[.]65:443”) and fetches seven types of commands –
- command, to execute arbitrary commands via /bin/sh -c (Linux) or cmd /C (Windows)
- control, to spawn via sub-commands an interactive shell (shell_start), screenshots (screenshot), exfiltrate files to the C2 server (download), and install persistence (persist)
- list_dir, to list directory content
- shell_input, to create an interactive shell session
- proxy_connect, to establish a TCP connection to an arbitrary target
- proxy_data, to relay data bidirectionally to an established proxy connection
- proxy_close, to terminate and remove a proxy session
Furthermore, the attacks make use of in-memory reverse shells to avoid leaving forensic artifacts on disk, as well as enumerate “/var/qmail/mailnames/” directories to count the number of emails stored in specific folders.
“Next, the attackers searched for social media-related emails,” Unit 42 explained. “They deployed a PHP script, named search_social.php, that searched for specific keywords in email headers and displayed the results in a user-friendly format.”
“The script then parsed the response and displayed the exact file path, social media account email sender, recipient and subject.”
The attackers have also been found attempting to generate a bash script named “zip_mails.sh” in a bid to compress emails of interest into ZIP archives and exfiltrate the information. However, syntax errors present in the script meant that the program failed upon execution.
“This campaign demonstrates how attackers are combining traditional post-exploitation techniques with AI-accelerated workflows to target governmental Linux server infrastructure,” Unit 42 said. “By leveraging AI to rapidly generate, adapt and deploy operational scripts, the attackers behind CL-UNK-1211 maintained a fast pace of operation while minimizing manual developer overhead.”
The development comes as Google Threat Intelligence Group (GTIG) and Mandiant, along with Microsoft, documented threat actors’ abuse of open-source agentic penetration testing frameworks like ARTEX, PentAGI, Hexstrike, and CAIRN to carry out a “broad range of actions” across various stages of the attack life cycle at an unprecedented speed and scale.
Although ARTEX was taken down by its author after reports of widespread misuse emerged, it has spawned multiple versions, including a commercial offering dubbed ARTEX PRO and a localized variation called ScopeWeaver.
Some of the cases are listed below –
- Use of ARTEX by Storm-0940 (aka UNC7228) to orchestrate data theft campaigns targeting entities in the U.S. and Europe across the enterprise software, industrial automation, semiconductor manufacturing and design, and telecommunications industry verticals.
- Use of ARTEX by financially motivated threat actors to facilitate data theft extortion, including the targeting of the financial sector in Asia.
- Use of ARTEX by North Korean state-sponsored hacking groups like Onyx Sleet (aka Andariel) and Pearl Sleet (aka Lawrencium) in operations.
- Use of PentAGI for WHOIS asset mapping and systematic reconnaissance and vulnerability scanning against organizations in Asia.
“The emergence of ARTEX and similar agentic offensive intrusion frameworks underscores a broader shift toward threat actor adoption of open source multi-agent offensive frameworks, as well as potentially custom agentic harnesses,” GTIG and Mandiant said.
“Frameworks such as ARTEX compress attack timelines to machine speed; however, they currently trade stealth for velocity. Unrestricted autonomous execution generates forensic traffic, relies on recognizable identifiers, and leaves behind distinct code-level traces, increasing the likelihood of detection and mitigation.”