Cybersecurity researchers have disclosed details of a cyber espionage campaign specifically targeting Linux infrastructure associated with government entities and state-affiliated infrastructure.
The activity, observed by Palo Alto Networks Unit 42 between October 2025 and April 2026, has been tracked under the moniker CL-UNK-1211, where "CL" refers to cluster and "UNK" stands for unknown motivation.
CL-UNK-1211 with suspected AI-generated scripts targeting gov Linux infra - this is the trend now. AI lowering the barrier for bespoke malware. SysGoRAT isn't new but AI-assisted obfuscation makes attribution and detection way harder. The "unknown motivation" tag is telling.