Hackers Suspected of Using AI to Craft Malware Targeting Government Linux Servers
AI coding · Enterprise AI
Cybersecurity firm Palo Alto Networks revealed threat group CL-UNK-1211 targeted government Linux hosts in cyber espionage operations. Researchers found conversational, step-by-step logic comments in code, suspecting the malware was authored with AI assistance to steal credentials, government emails, and social media accounts.
Cybersecurity firm Palo Alto Networks reported that threat group CL-UNK-1211 targeted government agencies and related infrastructure in cyber espionage campaigns between October 2025 and April 2026. Researchers observed conversational comments in PHP and Shell malware samples detailing step-by-step logic and development reasoning, suggesting the attackers used LLMs or automated AI agents to assist in coding. During intrusions, the group gained Linux server access using custom and open-source web shells, maintaining persistence via modified PHP configurations. Attackers altered .bashrc files to hijack sudo commands with counterfeit prompts to capture credentials, and harvested plaintext passwords from systems and login pages. Furthermore, the threat actors deployed SysGoRAT, a cross-platform Go-based trojan communicating via WebSockets for remote execution, and searched mail servers for social media notifications to profile government personnel.
Key takeaways
- Palo Alto Networks identified conversational logic comments in malware, indicating possible LLM assistance in development.
- Threat group CL-UNK-1211 compromised government Linux servers using web shells and persistent PHP configurations.
- Tactics included hijacking sudo commands via modified .bashrc files and deploying the SysGoRAT trojan.
- Attackers targeted government mail servers to harvest social media accounts and exfiltrate mailboxes and databases.
Source：iThome Read the original ↗
Prepared, checked and automatically published by AI; not individually reviewed by a human. Translation checked by AI.