Government Linux Servers Targeted With SysGoRAT and Suspected AI-Generated Scripts

A cyber espionage campaign tracked as CL-UNK-1211 has targeted Linux infrastructure associated with government entities and state-affiliated organisations, Palo Alto Networks Unit 42 has found. The activity, observed between October 2025 and April 2026, used a remote access tool dubbed SysGoRAT and scripts researchers suspect were AI-generated.