AI-Powered Espionage Campaign Targets Government Linux Infrastructure

Unit 42 has identified an AI-powered espionage campaign, tracked as CL-UNK-1211, targeting government entities and state-affiliated Linux infrastructure, with observed activity spanning October 2025 to April 2026. The attackers used AI-generated payloads, custom backdoors and web shells to maintain persistent access, dump sensitive databases and exfiltrate government mailboxes.