Government Linux Servers Targeted With SysGoRAT and Suspected AI-Generated Scripts

Cybersecurity researchers from Palo Alto Networks Unit 42 have uncovered a cyber espionage campaign targeting Linux infrastructure belonging to government entities and state-affiliated organizations. The campaign, tracked as CL-UNK-1211, was observed between October 2025 and April 2026. Attackers deployed a remote access trojan called SysGoRAT alongside scripts suspected to be AI-generated. The threat cluster remains unattributed ('UNK' denoting unknown origin). The campaign specifically focuses on government Linux servers, suggesting a strategic interest in sensitive government data and systems. The use of AI-generated scripts represents an emerging trend in threat actor tooling sophistication.