Cybersecurity researchers have disclosed details of a cyber espionage campaign specifically targeting Linux infrastructure associated with government entities and state-affiliated infrastructure.
The activity, observed by Palo Alto Networks Unit 42 between October 2025 and April 2026, has been tracked under the moniker CL-UNK-1211, where "CL" refers to cluster and "UNK" stands for unknown motivation.
A notable aspect of the campaign concerns the use of large language models (LLMs) and/or automated artificial intelligence (AI) agents to generate payloads and execute malicious code.
"The attackers behind this cluster of activity focused on Linux environments to conduct extensive reconnaissance and maintain persistent network access to support intelligence-gathering," researchers Roey Porat and Tom Fakterman said. "The attackers attempted to dump sensitive databases and exfiltrate government mailboxes to access social media accounts."
The campaign employs a "versatile operational playbook," leveraging a combination of open-source tools, custom cross-platform backdoors, and web shells to maintain access. Another hallmark involves attempts to disable endpoint protections, wipe system logs, and plant deceptive red-team markers so as to disguise the activity as a legitimate security assessment.
The threat actor has also been observed using malicious PHP and shell scripts, likely generated using AI, to maintain persistence, perform reconnaissance, and exfiltrate data.
"Rather than standard developer documentation, multiple scripts contained conversational, step-by-step reasoning notes. These notes explained the code's logic to the operator who provided the initial instructions," the cybersecurity company said. "Their presence suggests that the code was either copied directly from an AI prompt output or deployed by an automated AI agent."
A mix of open-source and bespoke PHP web shells is used as a way to maintain a persistent backdoor into the host networks. The access is then abused to gather credentials from the targeted environment using three different methods -
- Replacing the .bashrc file with a malicious version containing a command to steal passwords.
- Injecting code into PHP login pages to harvest admin credentials.
- Scanning for cleartext email, SMTP, and database passwords within configuration files and command history files.
Also deployed as part of the attacks is a custom, multi-platform remote access trojan written in Go that supports various persistence methods to maintain long-term access on Windows and Linux systems. Called SysGoRAT, it establishes a command-and-control (C2) connection over WebSocket to a hard-coded IP address ("104.194.158[.]65:443") and fetches seven types of commands -
- command, to execute arbitrary commands via /bin/sh -c (Linux) or cmd /C (Windows)
- control, to spawn via sub-commands an interactive shell (shell_start), screenshots (screenshot), exfiltrate files to the C2 server (download), and install persistence (persist)
- list_dir, to list directory content
- shell_input, to create an interactive shell session
- proxy_connect, to establish a TCP connection to an arbitrary target
- proxy_data, to relay data bidirectionally to an established proxy connection
- proxy_close, to terminate and remove a proxy session
Furthermore, the attacks make use of in-memory reverse shells to avoid leaving forensic artifacts on disk, as well as enumerate "/var/qmail/mailnames/" directories to count the number of emails stored in specific folders.
"Next, the attackers searched for social media-related emails," Unit 42 explained. "They deployed a PHP script, named search_social.php, that searched for specific keywords in email headers and displayed the results in a user-friendly format."
"The script then parsed the response and displayed the exact file path, social media account email sender, recipient and subject."
The attackers have also been found attempting to generate a bash script named "zip_mails.sh" in a bid to compress emails of interest into ZIP archives and exfiltrate the information. However, syntax errors present in the script meant that the program failed upon execution.
"This campaign demonstrates how attackers are combining traditional post-exploitation techniques with AI-accelerated workflows to target governmental Linux server infrastructure," Unit 42 said. "By leveraging AI to rapidly generate, adapt and deploy operational scripts, the attackers behind CL-UNK-1211 maintained a fast pace of operation while minimizing manual developer overhead."
The development comes as Google Threat Intelligence Group (GTIG) and Mandiant, along with Microsoft, documented threat actors' abuse of open-source agentic penetration testing frameworks like ARTEX, PentAGI, Hexstrike, and CAIRN to carry out a "broad range of actions" across various stages of the attack life cycle at an unprecedented speed and scale.
Although ARTEX was taken down by its author after reports of widespread misuse emerged, it has spawned multiple versions, including a commercial offering dubbed ARTEX PRO and a localized variation called ScopeWeaver.
Some of the cases are listed below -
- Use of ARTEX by Storm-0940 (aka UNC7228) to orchestrate data theft campaigns targeting entities in the U.S. and Europe across the enterprise software, industrial automation, semiconductor manufacturing and design, and telecommunications industry verticals.
- Use of ARTEX by financially motivated threat actors to facilitate data theft extortion, including the targeting of the financial sector in Asia.
- Use of ARTEX by North Korean state-sponsored hacking groups like Onyx Sleet (aka Andariel) and Pearl Sleet (aka Lawrencium) in operations.
- Use of PentAGI for WHOIS asset mapping and systematic reconnaissance and vulnerability scanning against organizations in Asia.
"The emergence of ARTEX and similar agentic offensive intrusion frameworks underscores a broader shift toward threat actor adoption of open source multi-agent offensive frameworks, as well as potentially custom agentic harnesses," GTIG and Mandiant said.
"Frameworks such as ARTEX compress attack timelines to machine speed; however, they currently trade stealth for velocity. Unrestricted autonomous execution generates forensic traffic, relies on recognizable identifiers, and leaves behind distinct code-level traces, increasing the likelihood of detection and mitigation."
Update
Palo Alto Networks Unit 42 has revealed that it observed intrusion attempts against multiple targets between September 24 and October 27, 2026, that likely used ARTEX, or an ARTEX-derived framework. Every attack has been observed following the same playbook, beginning with broad reconnaissance -
- Map the target application by harvesting JavaScript source maps, bundles, runtime configuration, and OpenAPI specifications.
- Probe identity providers and their OAuth flows.
- Fall back to exposed API surface when identity attacks fail.
The intrusions have led to self-registration of accounts in a production web application, bulk approval and user record changes accepted from those self-registered accounts, and several unauthenticated write operations.
According to an update shared on October 30, 2026, ARTEX was also put to use in the attack targeting the Dutch Institute for Vulnerability Disclosure (DIVD), which involved the exploitation of two zero-day flaws in the open-source Zammad ticketing system (CVE-2026-102489 and CVE-2026-102490). That said, there is no clarity on whether ARTEX found the flaws by itself over the course of the attack.
"All of this led to the result that it went from initial access to root in twelve minutes, by chaining a zero-day in Zammad with a second zero-day for local privilege escalation," DIVD said. "The privilege escalation itself took about a minute."
AI-powered cyber attacks have also been observed relying on CyberStrikeAI as a crucial post-exploitation tool as part of a campaign targeting organizations in the education sector in several countries across Africa and Latin America, Kaspersky said. The campaign has not been linked to a known group, but source code comments point to a Chinese-speaking operator.
The activity uses compromised SQL servers as an entry point to conduct initial local reconnaissance and network discovery, drop tools like GodPotato for Windows privilege escalation, and ultimately deliver CyberStrikeAI to handle domain reconnaissance, data exfiltration, persistence via scheduled tasks, lateral movement, and mass credential dumping.
"Until recently, language models were used primarily during preparatory stages – for writing phishing emails, debugging code, or searching for vulnerabilities," the Russian cybersecurity company said. "Now, however, they are being embedded into the very core of the attack, automating actions at every stage: payload execution, persistence on the host, discovery, lateral movement, and, finally, data collection and exfiltration."
"If HexStrike AI and similar tools cover the 'find and break' phase, and Sliver/Mythic/Havoc cover the 'establish a foothold and control' phase, CyberStrikeAI completes the kill chain: a single server-side process written in Go executes utilities via MCP, handles web shell connections, and assigns tasks to the implant, while the model analyzes the results and decides what to do next."
(The story was updated after publication to include additional insights from Kaspersky and Palo Alto Networks Unit 42.)
