Government Linux servers were targeted in an espionage campaign that stole credentials and attempted to extract sensitive databases and government mailboxes, The Hacker News reported, citing Palo Alto Networks Unit 42. Researchers found signs that the attackers used AI-generated scripts while building persistent access, with mailbox searches aimed at accessing social media accounts.
Unit 42 observed the activity between October 2025 and April 2026 and tracked it as CL-UNK-1211. The November Hacker News report describes targeting of government entities and state-affiliated infrastructure, making the findings particularly relevant to teams responsible for Linux web servers, application credentials and government email systems.
Persistent access and credential theft
The Hacker News report describes a combination of open-source tools, custom backdoors and web shells—scripts that let attackers control a server through web requests. Unit 42 researchers Roey Porat and Tom Fakterman said the operators conducted extensive reconnaissance and maintained network access to support intelligence gathering.
The attackers also attempted to disable endpoint protections, erase system logs and plant markers suggesting a legitimate red-team security assessment. These efforts accompanied malicious PHP and shell scripts used for persistence, reconnaissance and data theft.
Credential collection took three forms. Attackers replaced .bashrc, a shell startup file, with a malicious version containing a password-stealing command; inserted credential-harvesting code into PHP administrator login pages; and searched configuration files and command histories for cleartext email, SMTP mail-server and database passwords.
Unit 42 also identified SysGoRAT, a custom remote access trojan written in Go that supports long-term access on both Linux and Windows. It connects over WebSocket, a two-way communications protocol, to the hard-coded command-and-control address 104.194.158[.]65:443.
The malware accepts seven command types. command runs instructions through /bin/sh -c on Linux or cmd /C on Windows. control supports an interactive shell through shell_start, screenshots through screenshot, file exfiltration through download, and persistence through persist. The remaining types are list_dir for directory listings, shell_input for interactive shell sessions, and proxy_connect, proxy_data and proxy_close for establishing, relaying and terminating connections to other targets.
The operators also used reverse shells running in memory, which allow remote command execution while avoiding forensic artifacts on disk. They enumerated /var/qmail/mailnames/ directories to count messages in selected folders.
A PHP script named search_social.php searched email headers for social media-related keywords. It presented matching messages with their exact file paths, senders, recipients and subjects, giving the operators a way to locate particular account-related emails.
An attempted follow-on step failed: a Bash script named zip_mails.sh, intended to package selected emails into ZIP archives for exfiltration, contained syntax errors and did not execute successfully.
Signs of AI assistance
Unit 42 assessed that several malicious PHP and shell scripts were likely generated using large language models or automated AI agents. The evidence included conversational, step-by-step notes explaining code logic to the operator who had supplied the instructions, rather than conventional developer documentation.
Those notes suggested the code had been copied directly from AI output or deployed by an automated agent. Unit 42 characterized the operation as combining established post-compromise techniques with AI-assisted script generation and adaptation, reducing manual development work.
The broader use of offensive AI frameworks provides context, without assigning CL-UNK-1211 to another actor. The Hacker News also reported findings from Google Threat Intelligence Group, Mandiant and Microsoft concerning abuse of ARTEX, PentAGI, Hexstrike and CAIRN—frameworks that use AI agents to coordinate penetration-testing tasks.
Reported cases included Storm-0940, also called UNC7228, using ARTEX for data theft against enterprise software, industrial automation, semiconductor manufacturing and design, and telecommunications organizations in the United States and Europe. Financially motivated actors also used ARTEX for data theft extortion, including against Asia’s financial sector. PentAGI was used for WHOIS registration-data mapping, reconnaissance and vulnerability scanning against organizations in Asia.
ARTEX’s author took it down following reports of widespread misuse, but variants emerged, including the commercial ARTEX PRO and a localized version called ScopeWeaver. GTIG and Mandiant said such frameworks accelerate attacks while sacrificing stealth: autonomous execution produces forensic traffic, recognizable identifiers and code traces that can aid detection.
Microsoft describes broader North Korean adoption
In its separate October 29 assessment, Microsoft said North Korean groups Onyx Sleet, also known as Andariel, and Pearl Sleet, also known as Lawrencium, were using ARTEX operationally. Microsoft assessed that North Korean AI-enabled operations remained human-directed rather than fully autonomous.
The company described AI as accelerating existing objectives: revenue generation, strategic intelligence collection and, in some cases, politically motivated disruption or destruction. Common targets include cryptocurrency and financial organizations, technology companies, software supply chains, government and education.
Microsoft placed actors across four adoption stages—emerging, expanding, accelerating and operationalized—and assessed overall adoption as high. Jade Sleet, Coral Sleet and Jasper Sleet had established AI use across operational workflows. Examples included Jade Sleet launching campaigns through three front companies in one week, Onyx Sleet producing dozens of tailored lures in minutes, Coral Sleet rapidly developing a capability to trojanize private source repositories, and Diamond Sleet using AI for targeting, personas and front-company creation.
Protective steps for administrators
Microsoft’s guidance addresses that broader North Korean activity. It recommends identifying exposed assets and vulnerabilities, correcting security misconfigurations and automating patching where possible. Administrators should place web-facing systems behind a secure boundary and use VPN access; servers that must remain publicly accessible can use a web application firewall, reverse proxy or perimeter network to reduce exploitation risk in some cases. Microsoft names Defender Vulnerability Management, External Attack Surface Management and Azure Update Manager as supporting tools.
For email and identity defenses, Microsoft recommends user training, phishing simulations, Safe Links and Safe Attachments, reviewing Exchange Online Protection settings, and investigating and removing malicious messages. Zero-hour auto purge can quarantine messages after new threat intelligence arrives. Responders can also search for similar malicious URLs and subject lines. Microsoft recommends blocking device code authentication wherever possible and controlling necessary use through Entra Conditional Access policies.
Its hiring guidance calls for closer scrutiny of staffing-company employees, duplicated profiles and phone numbers, inconsistent resumes, references and concurrent employment under one persona. It also recommends multiple video sessions and checking for a verifiable digital footprint, including a residential address and a real, non-VoIP phone number.
For endpoints, Microsoft recommends current antivirus definitions, cloud-delivered and real-time protection, endpoint detection and response in block mode, automated investigation and remediation, network protection and automatic attack disruption. It says that, in observed attacks, Microsoft customers with the specified rules enabled could mitigate attacks in the initial stages and prevent hands-on-keyboard activity. Those rules block executable email content, untrusted executables and potentially obfuscated scripts, and provide advanced ransomware protection.
Microsoft lists actor-specific Defender alerts, AI-tool and secret-reconnaissance alerts, suspicious sign-in and email detections, and ProcmacSteal antivirus detections across Linux, PowerShell, macOS and Cargo. It also describes its Security Dashboard for AI as aggregating security, identity and data risks across Defender, Entra and Purview, and Agent 365 as providing management and security controls for enterprise AI agents. Administrators following that guidance can use the listed detections alongside the recommended email, identity and endpoint controls.
