SysGoRAT Used Against Government Linux Systems in Espionage Campaign
Palo Alto Networks Unit 42 has detailed a cyber-espionage campaign, tracked as CL-UNK-1211, that targeted Linux infrastructure linked to government entities and state-affiliated organisations between October 2025 and April 2026. The operators used web shells, open-source tooling and a custom Go remote-access trojan called SysGoRAT to conduct reconnaissance and retain access.
Unit 42 said the cluster focused on Linux environments to support intelligence gathering. Its observed objectives included dumping sensitive databases, exfiltrating government mailboxes and obtaining access to social-media accounts. The activity also included attempts to disable endpoint protections, erase system logs and leave deceptive red-team markers intended to make the intrusion resemble an authorised security assessment.
Credential collection and persistent access
The attackers used both open-source and bespoke PHP web shells as persistent backdoors. From that foothold, they attempted to collect credentials in three ways: replacing .bashrc with a malicious version designed to steal passwords, injecting credential-harvesting code into PHP login pages, and searching configuration and command-history files for cleartext email, SMTP and database credentials.
SysGoRAT is a cross-platform remote-access trojan written in Go that supports persistence on Windows and Linux. It connects over WebSocket to a hard-coded command-and-control address and can execute commands through /bin/sh -c on Linux or cmd /C on Windows. Its command set also supports interactive shells, screenshots, file exfiltration, directory listings, persistence installation and TCP proxying.
The campaign further used in-memory reverse shells, reducing the on-disk evidence available to investigators. Operators enumerated /var/qmail/mailnames/ directories to count stored email and deployed a PHP script named search_social.php to identify social-media-related messages by searching email headers. The script displayed file paths and message sender, recipient and subject details. An attempted zip_mails.sh script to archive selected mail for exfiltration contained syntax errors and failed to run.
Possible AI-assisted operational scripts
Unit 42 identified malicious PHP and shell scripts that were likely generated with AI. Several included conversational, step-by-step reasoning notes rather than conventional developer documentation, explaining the code's logic to an operator. Unit 42 said those notes suggest the material may have been copied from an AI prompt response or deployed through an automated AI agent.
The finding does not replace established post-exploitation tradecraft: the operation combined conventional credential theft, web-shell persistence, log removal and custom malware. It does, however, show how generated scripts can be used to adapt and deploy operational components with less manual development effort. The broader pattern is visible in AI-enabled attacks and Linux rootkits through reporting on AI-enabled attacks and Linux rootkits.
What defenders should examine
For organisations operating sensitive Linux services, the practical implication is to investigate unexpected changes to shell initialisation files and PHP authentication pages, hunt for web shells and review access to configuration and history files that may contain cleartext secrets. Teams should also monitor unusual outbound WebSocket activity, preserve logs before remediation and examine memory-resident activity where their tooling permits. These controls address the observed techniques even when suspicious scripts carry AI-style explanatory notes.