Executive Summary
A cyber espionage campaign tracked as CL-UNK-1211 has been observed targeting Linux-based government and state-affiliated infrastructure between October 2025 and April 2026. The attackers demonstrate a sophisticated yet novel workflow by leveraging Large Language Models (LLMs) and AI agents to generate operational PHP and shell scripts. These scripts often contain conversational, step-by-step reasoning notes, indicating they were directly copied from AI outputs or deployed by automated agents.
The campaign utilizes a mix of open-source tools, custom web shells, and a new multi-platform Remote Access Trojan (RAT) named SysGoRAT. The primary objectives appear to be long-term persistence, extensive reconnaissance, and the exfiltration of sensitive government mailboxes and database contents. The attackers also attempt to mask their activity by planting red-team markers to simulate legitimate security assessments.
The increasing adoption of AI-driven frameworks like ARTEX and PentAGI by various state-sponsored actors, including Storm-0940, Onyx Sleet, and Pearl Sleet, signifies a shift toward machine-speed attack cycles. While these frameworks currently trade stealth for velocity—leaving behind distinct forensic traces—their ability to rapidly adapt and scale poses a significant challenge to traditional defense timelines.