CL-UNK-1211 targets government Linux servers using AI-assisted scripts, PHP web shells, and SysGoRAT to steal credentials and maintain access.

CL-UNK-1211 targets government Linux servers using AI-assisted scripts, PHP web shells, and SysGoRAT to steal credentials and maintain access.

Unit 42 documenta CL-UNK-1211, una campaña de espionaje contra servidores Linux de gobiernos que usa scripts generados por IA y borra sus registros.

CL-UNK-1211 targets government Linux servers using AI-assisted scripts, PHP web shells, and SysGoRAT to steal credentials and maintain access.

like a legitimate penetration test read more about Government Linux Servers Targeted With SysGoRAT and Suspected AI-Generated Scripts

Cybersecurity researchers have disclosed details of a cyber espionage campaign specifically targeting Linux infrastructure associated with government entities and state-affiliated infrastructure. The activity, observed by Palo Alto Networks Unit 42 between October 2025 and April 2026, has been tracked under the moniker CL-UNK-1211, where CL refers to cluster and UNK stands for unknown motivation. A notable aspect of the campaign concerns the use of large language models (LLMs) and/or automated a...

Haz clic para acceder al contenido completo.

Unit 42 reported that CL-UNK-1211 targeted government-linked Linux infrastructure from October 2025 to April 2026, using web shells, scripts suspected of AI…

CL-UNK-1211 targets government Linux servers using AI-assisted scripts, PHP web shells, and SysGoRAT to steal credentials and maintain access.

Cybersecurity researchers have disclosed details of a cyber espionage campaign specifically targeting Linux infrastructure associated with government entities and state-affiliated infrastructure. The activity, observed by Palo Alto Networks Unit 42 between October 2025 and April 2026, has been tracked under the moniker CL-UNK-1211, where "CL" refers to cluster and "UNK" stands for unknown

Cybersecurity researchers have disclosed details of a cyber espionage campaign specifically targeting Linux infrastructure associated with government entities and state-affiliated infrastructure. The activity, observed by Palo Alto Networks Unit 42 between October 2025 and April 2026, has been tracked under the moniker CL-UNK-1211, where "CL" refers to cluster and "UNK" stands for unknown

Cyber Threat Intelligence Linux Intrusion November 2, 2026 Introduction: A Persistent Threat Against Government-Linked Linux Systems A months-long cyber intrusion campaign targeting government-linked Linux infrastructure has highlighted the growing sophistication of threat actors operating against sensitive environments. According to research published by Palo Alto Networks' Unit 42, a threat cluster tracked as CL-UNK-1211 conducted targeted operations between October 2025 and April 2026.

Cybersecurity researchers have disclosed details of a cyber espionage campaign specifically targeting Linux infrastructure associated with government entities and state-affiliated infrastructure. The activity, observed by Palo Alto Networks Unit 42 between October 2025 and April 2026, has been tracked under the moniker CL-UNK-1211, where "CL" refers to cluster and "UNK" stands for unknown

At a Glance Malware Family SysGoRAT malware (cross-platform Go remote access trojan), PHP web shells, and AI-generated bash and PHP scripts Threat Actor Confirmed as cluster CL-UNK-1211; nation-state versus cybercrime affiliation remains undetermined Target / Victims Government entities and state-affiliated Linux, mail, and database infrastructure (active from October 2025 to April 2026) Delivery Vector