Security researchers have detailed a cyber espionage campaign tracked as CL-UNK-1211 targeting Linux government infrastructure.
The activity, observed between October 2025 and April 2026, utilized LLMs and automated AI agents to generate payloads, deploy custom cross-platform backdoors like SysGoRAT, and execute malicious scripts.
This activity was detected by security researchers and recorded from October 2025 to April 2026. The perpetrators focused on computers with the Linux operating system connected to government agencies, with the aim of collecting information, stealing data from databases, and accessing government mailboxes.
The use of artificial intelligence in attacks
Researchers were particularly struck by the fact that some of the programs used by the attackers appeared to have been created with the help of artificial intelligence systems. Instead of pure code, the files contained explanatory notes and thought steps that showed how the commands were generated.
To maintain access to compromised systems, the attackers used various methods, such as modifying configuration files, interfering with login pages to steal credentials, and searching for passwords stored in plain text.
Actions on compromised systems
At the same time, the perpetrators used a special remote access program, which constantly communicates with an external address to execute commands. In one case, they attempted to locate emails related to social media by using a special command script to search for specific keywords.
↳
READ ALSO
HACKS.GR / RELATED
Cyber Attacks & Data Breaches
New Windows program uses artificial intelligence to evaluate victims' stolen data
↗
They also attempted to compress these messages into files to remove them, although ultimately the program failed to execute due to syntax errors in the code.
The broader trend of utilizing automated tools
This case adds to a broader trend, where various groups of attackers are leveraging automated tools and open source software to carry out digital attacks.
>Stay connected with Hacks.gr
Set us as a preferred source on Google and find us on social media.
Preferred source
↗
end of article
Top comments (0)