SysGoRAT Targets Government Linux Servers With Suspected AI-Generated Scripts

Government and state-affiliated Linux infrastructure was targeted in a cyber espionage campaign that combined custom malware, web shells and suspected AI-generated scripts to maintain access, steal credentials and exfiltrate sensitive data, according to researchers at Palo Alto Networks Unit 42.

The campaign, tracked as CL-UNK-1211, was observed between October 2025 and April 2026. Researchers said the attackers focused on Linux environments and used a mix of open-source tools, custom backdoors and persistence techniques to support intelligence-gathering operations.

A notable feature of the campaign was the suspected use of large language models or automated AI agents to generate malicious PHP and shell scripts.

Attackers Targeted Government Linux Infrastructure

Unit 42 said the threat actor concentrated on Linux systems associated with government entities and state-linked infrastructure.

The attackers conducted reconnaissance, maintained persistent access and attempted to collect sensitive information from compromised environments.

According to the researchers, the campaign included efforts to dump databases and exfiltrate government mailboxes, including messages that could help identify or access social media accounts.

The attackers also attempted to disable endpoint protections, remove system logs and plant misleading red-team artefacts that could make malicious activity appear to be part of an authorised security assessment.

These techniques suggest an effort to both extend access and complicate forensic analysis.

Suspected AI-Generated Scripts Found in Campaign

Researchers said several PHP and shell scripts used in the operation appeared to have been generated with the help of AI.

Rather than containing only conventional developer comments, some scripts included conversational, step-by-step reasoning notes explaining what the code was intended to do.

Unit 42 said this pattern suggested that the code may have been copied directly from an AI-generated response or deployed through an automated AI agent.

The scripts were used for tasks including persistence, reconnaissance and data exfiltration.

The finding does not establish which AI system may have been used, but it points to growing use of generative AI in post-exploitation workflows.

SysGoRAT Used for Long-Term Remote Access

The campaign also deployed a custom remote access trojan written in Go and tracked as SysGoRAT.

The malware is designed to work across both Linux and Windows systems and supports several persistence mechanisms intended to maintain long-term access.

SysGoRAT connects to a command-and-control server over WebSocket using the hard-coded address 104.194.158[.]65:443.

The malware supports multiple commands, including arbitrary command execution, interactive shell access, file exfiltration, directory listing, screenshots, persistence installation and proxy functionality.

On Linux, arbitrary commands can be executed through /bin/sh -c, while Windows systems use cmd /C.

The malware can also create proxy connections and relay traffic through compromised systems.

Credentials Harvested Through Multiple Methods

The attackers used several techniques to steal credentials from targeted systems.

One involved replacing the .bashrc file with a malicious version containing commands designed to capture passwords.

Another method involved injecting code into PHP login pages to collect administrator credentials.

The attackers also searched configuration files and command histories for plaintext email, SMTP and database passwords.

This combination allowed the threat actor to collect credentials from both user activity and system configuration files.

The stolen information could then be used to maintain access or move deeper into compromised networks.

Mailboxes and Social Media Data Targeted

Researchers also observed attempts to collect email from compromised systems.

The attackers examined /var/qmail/mailnames/ directories to identify the number of emails stored in particular folders.

They then deployed a PHP script named search_social.php to search email headers for terms associated with social media services.

The script extracted information including file paths, sender addresses, recipients and email subjects.

The attackers also attempted to generate a bash script called zip_mails.sh to compress selected messages into ZIP archives for exfiltration.

However, syntax errors in the script caused it to fail during execution.

The coding mistakes are notable because they appeared alongside other scripts that researchers suspected were AI-generated, showing that automated code generation did not necessarily produce reliable results.

In-Memory Shells Used to Reduce Forensic Traces

The campaign also made use of in-memory reverse shells.

By running malicious code directly in memory instead of writing it to disk, attackers can reduce the number of forensic artefacts left behind on compromised systems.

The threat actor combined these techniques with log deletion and attempts to disable endpoint protections.

Researchers also observed deceptive red-team markers placed on systems, apparently intended to mislead defenders into believing the activity was part of a legitimate security exercise.

AI-Driven Offensive Frameworks Gain Ground

The CL-UNK-1211 campaign comes amid growing evidence that threat actors are adopting AI-assisted and agentic offensive security frameworks.

Google Threat Intelligence Group, Mandiant and Microsoft have separately documented malicious use of tools such as ARTEX, PentAGI, Hexstrike and CAIRN.

These frameworks can automate reconnaissance, vulnerability discovery and post-exploitation tasks across different stages of an intrusion.

ARTEX, for example, has reportedly been used by multiple threat actors, including groups linked to China and North Korea, as well as financially motivated operators.

Threat actors have also used these frameworks for asset mapping, vulnerability scanning, data theft and extortion campaigns.

AI Speeds Attacks but Can Leave Detectable Traces

Researchers said offensive AI frameworks can compress attack timelines by automating tasks that would otherwise require significant manual effort.

However, that speed can come at a cost.

Automated systems may generate recognisable code patterns, repeat identifiable behaviours and create a larger volume of network activity.

In the CL-UNK-1211 campaign, the conversational notes embedded in scripts provided defenders with clues that AI may have been used in the attackers’ workflow.

The failed zip_mails.sh script also showed that AI-generated or rapidly assembled code can contain mistakes that disrupt malicious operations.

Government Networks Face New AI-Assisted Threats

The campaign highlights how attackers are combining traditional cyber espionage techniques with AI-assisted development to target sensitive Linux infrastructure.

Rather than replacing established tactics, AI appears to be helping operators generate, modify and deploy malicious code more quickly.

For government and state-linked organisations, the findings underscore the importance of monitoring Linux servers for unusual scripts, web shells, credential-harvesting activity, suspicious persistence mechanisms and unauthorised access to mail infrastructure.

The use of SysGoRAT and suspected AI-generated tooling also shows that AI-assisted cyber operations are moving beyond experimentation and becoming part of real-world intrusion campaigns.