AI-Assisted Espionage Campaign Hit Government Linux Servers, Researchers Say

Cybersecurity researchers have uncovered a cyber espionage operation aimed at Linux systems tied to government bodies and state-affiliated infrastructure. Palo Alto Networks Unit 42 observed the activity between October 2025 and April 2026, tracking it as CL-UNK-1211 - a label meaning cluster with unknown motivation.

A standout feature of the campaign was the apparent use of large language models or automated AI agents to produce payloads and run malicious code. Researchers Roey Porat and Tom Fakterman said the attackers focused on Linux environments to conduct extensive reconnaissance and keep persistent network access for intelligence-gathering, attempting to dump sensitive databases and exfiltrate government mailboxes to reach social media accounts.

The group used open-source tools, custom cross-platform backdoors and web shells, and tried to disable endpoint protections, wipe system logs and plant deceptive red-team markers to pass the activity off as a legitimate security assessment. Multiple malicious PHP and shell scripts contained conversational, step-by-step reasoning notes explaining the code's logic to the operator - a sign, Unit 42 said, that the code was copied from AI prompt output or deployed by an automated AI agent.

Credential theft came through three methods: replacing the .bashrc file with a malicious version containing a password-stealing command, injecting code into PHP login pages to harvest admin credentials, and scanning configuration and command history files for cleartext email, SMTP and database passwords. The attackers also deployed SysGoRAT, a custom Go-based remote access trojan supporting persistence on Windows and Linux, which opens a command-and-control connection over WebSocket to a hard-coded IP address.

They used in-memory reverse shells to avoid disk artifacts and searched /var/qmail/mailnames/ directories to count stored emails, deploying a PHP script named search_social.php to find social media-related emails in headers. An attempt to compress emails of interest into ZIP archives via a script called zip_mails.sh failed due to syntax errors.

Unit 42 said the campaign shows attackers blending traditional post-exploitation techniques with AI-accelerated workflows against governmental Linux server infrastructure, letting them generate, adapt and deploy operational scripts quickly while cutting manual developer effort.

Separately, Google Threat Intelligence Group, Mandiant and Microsoft documented threat actors abusing open-source agentic penetration testing frameworks such as ARTEX, PentAGI, Hexstrike and CAIRN at unprecedented speed and scale. ARTEX was taken down by its author after reports of widespread misuse but spawned versions including a commercial offering, ARTEX PRO, and a localized variation called ScopeWeaver. GTIG and Mandiant said such frameworks compress attack timelines to machine speed but currently trade stealth for velocity, generating forensic traffic and leaving distinct code-level traces that raise detection odds.

Source: The Hackers News