Cybersecurity researchers have disclosed details of a cyber espionage campaign specifically targeting Linux infrastructure associated with government entities and state-affiliated infrastructure.

The activity, observed by Palo Alto Networks Unit 42 between October 2025 and April 2026, has been tracked under the moniker CL-UNK-1211 , where "CL" refers to cluster and "UNK" stands for unknown motivation.

A notable aspect of the campaign concerns the use of large language models (LLMs) and/or automated artificial intelligence (AI) agents to generate payloads and execute malicious code.

"The attackers behind this cluster of activity focused on Linux environments to conduct extensive reconnaissance and maintain persistent network access to support intelligence-gathering," researchers Roey Porat and Tom Fakterman said .

"The attackers attempted to dump sensitive databases and exfiltrate government mailboxes to access social media accounts." The campaign employs a "versatile operational playbook," leveraging a combination of open-source tools, custom cross-platform backdoors, and web shells to maintain access.

Another hallmark involves attempts to disable endpoint protections, wipe system logs, and plant deceptive red-team markers so as to disguise the activity as a legitimate security assessment.

The threat actor has also been observed using malicious PHP and shell scripts, likely generated using AI, to maintain persistence, perform reconnaissance, and exfiltrate data. "Rather than standard developer documentation, multiple scripts contained conversational, step-by-step reasoning notes.

These notes explained the code's logic to the operator who provided the initial instructions," the cybersecurity company said. "Their presence suggests that the code was either copied directly from an AI prompt output or deployed by an automated AI agent."

A mix of open-source and bespoke PHP web shells is used as a way to maintain a persistent backdoor into the host networks.

The access is then abused to gather credentials from the targeted environment using three different methods - Also deployed as part of the attacks is a custom, multi-platform remote access trojan written in Go that supports various persistence methods to maintain long-term access on Windows and Linux systems.

Called SysGoRAT, it establishes a command-and-control (C2) connection over WebSocket to a hard-coded IP address ("104. 194. 158[.]

65:443") and fetches seven types of commands - Furthermore, the attacks make use of in-memory reverse shells to avoid leaving forensic artifacts on disk, as well as enumerate "/var/qmail/mailnames/" directories to count the number of emails stored in specific folders.

"The script then parsed the response and displayed the exact file path, social media account email sender, recipient and subject." The attackers have also been found attempting to generate a bash script named "zip_mails. sh" in a bid to compress emails of interest into ZIP archives and exfiltrate the information.

However, syntax errors present in the script meant that the program failed upon execution. "This campaign demonstrates how attackers are combining traditional post-exploitation techniques with AI-accelerated workflows to target governmental Linux server infrastructure," Unit 42 said.

"By leveraging AI to rapidly generate, adapt and deploy operational scripts, the attackers behind CL-UNK-1211 maintained a fast pace of operation while minimizing manual developer overhead."

The development comes as Google Threat Intelligence Group (GTIG) and Mandiant, along with Microsoft, documented threat actors' abuse of open-source agentic penetration testing frameworks like ARTEX , PentAGI , Hexstrike , and CAIRN to carry out a "broad range of actions" across various stages of the attack life cycle at an unprecedented speed and scale.

Although ARTEX was taken down by its author after reports of widespread misuse emerged, it has spawned multiple versions, including a commercial offering dubbed ARTEX PRO and a localized variation called ScopeWeaver.

Some of the cases are listed below - "The emergence of ARTEX and similar agentic offensive intrusion frameworks underscores a broader shift toward threat actor adoption of open source multi-agent offensive frameworks, as well as potentially custom agentic harnesses," GTIG and Mandiant said .

"Frameworks such as ARTEX compress attack timelines to machine speed; however, they currently trade stealth for velocity.

Unrestricted autonomous execution generates forensic traffic, relies on recognizable identifiers, and leaves behind distinct code-level traces, increasing the likelihood of detection and mitigation."

Learn how to close critical identity visibility gaps in your SOC, detect hidden threats, and accelerate incident response across human, machine, and AI identities.

Learn how to assess AI threat readiness, strengthen attack surface visibility, and prepare security operations for emerging threats in this practical webinar.