Cybersecurity
Unit 42 links Linux campaign to SysGoRAT and AI scripts
Palo Alto Networks Unit 42 said a campaign targeting government-linked Linux systems used AI-generated scripts, web shells and a custom Go trojan, while related research described abuse of agentic penetration-testing frameworks.
- Unit 42 said it tracked the activity as CL-UNK-1211 and observed it between October 2025 and April 2026.
- The attackers targeted Linux infrastructure associated with government entities and state-linked systems.
- Unit 42 said the operators used open-source tools, web shells, custom backdoors and anti-forensic steps such as log wiping and planting false red-team markers.
- The campaign used SysGoRAT, which connected to a hard-coded address over WebSocket and supported remote commands on Windows and Linux.
- Google Threat Intelligence Group, Mandiant and Microsoft separately reported abuse of frameworks including ARTEX, PentAGI, Hexstrike and CAIRN.
Unit 42 said the campaign it tracked as CL-UNK-1211 targeted Linux systems linked to government and state-affiliated entities. It said the operators worked from October 2025 to April 2026 and tried to support intelligence collection, database theft and access to mailboxes and social media accounts.
The researchers said the attackers used open-source utilities, bespoke backdoors and web shells to keep access. They also said the operators tried to disable endpoint defences, remove logs and leave markers that might make the activity look like a legitimate security assessment.
Unit 42 said some PHP and shell scripts in the campaign were likely generated with AI because they contained conversational reasoning notes. It also said the attackers used several methods to collect credentials, including tampering with login files, harvesting passwords from configuration material and searching mailbox data.
The same report said the campaign deployed SysGoRAT, a Go-based remote access trojan that reached out to a fixed address over WebSocket and could run commands, open shells, take screenshots, move files and relay proxy traffic. Unit 42 also said the operators used in-memory reverse shells and a failed script intended to compress selected email into ZIP files.
In a separate section, Google Threat Intelligence Group, Mandiant and Microsoft said threat actors had abused agentic offensive frameworks such as ARTEX, PentAGI, Hexstrike and CAIRN. They said ARTEX had been taken down by its author and had since appeared in forms including ARTEX PRO and ScopeWeaver.
Named in this story
People
- Roey Porat
- helped describe the attackers’ activity
- Tom Fakterman
- helped describe the attackers’ activity
Companies
- Mandiant
- co-reported abuse of agentic offensive frameworks
- Microsoft
- also documented the framework abuse
Organisations
- Palo Alto Networks Unit 42
- disclosed and tracked the Linux campaign
- Google Threat Intelligence Group
- reported abuse of agentic offensive frameworks
Products and systems
- SysGoRAT
- was the Go-based remote access trojan used in the attacks
- ARTEX
- was an open-source framework abused in attacks and later taken down
- ARTEX PRO
- was a commercial version that followed ARTEX
- ScopeWeaver
- was a localised version that followed ARTEX
- PentAGI
- was cited in reconnaissance and scanning abuse
- Hexstrike
- was cited among the abused frameworks
- CAIRN
- was cited among the abused frameworks
How the source tells it
The piece was mostly a straight incident report, but it used the researchers’ own language to stress stealth, AI use and a broader shift towards agentic attack tooling.
- threat and urgency framing the activity as cyber espionage against government-linked Linux systems and highlighting reconnaissance, exfiltration and evasion
- novelty repeated emphasis on AI-generated scripts and agentic frameworks as a shift in attacker workflows