"The attackers behind this cluster of activity focused on Linux environments to conduct extensive reconnaissance and maintain persistent network access to support intelligence-gathering," researchers Roey Porat and Tom Fakterman said.
CL-UNK-1211: timeline, target set, and posture
Palo Alto Networks Unit 42 tracked a campaign it labeled CL-UNK-1211 between October 2025 and April 2026 that specifically targeted Linux infrastructure associated with government entities and state-affiliated infrastructure. Unit 42 said the cluster—whose name encodes "cluster" and "unknown motivation"—used a "versatile operational playbook" combining open-source tools, bespoke backdoors and web shells to maintain access, gather intelligence and exfiltrate data.
SysGoRAT: a cross-platform Go remote access trojan
Central to the campaign was a custom, multi-platform remote access trojan written in Go called SysGoRAT. Unit 42 said SysGoRAT supports persistence on both Windows and Linux and establishes a command-and-control (C2) channel over WebSocket to a hard-coded address at 104.194.158[.]65:443. The trojan can receive seven command types from its C2 server:
- command — execute arbitrary commands via /bin/sh -c (Linux) or cmd /C (Windows)
- control — spawn sub-commands for an interactive shell (shell_start), screenshots (screenshot), exfiltrate files (download), and install persistence (persist)
- list_dir — list directory content
- shell_input — create an interactive shell session
- proxy_connect — establish a TCP connection to an arbitrary target
- proxy_data — relay data bidirectionally to an established proxy connection
- proxy_close — terminate and remove a proxy session
Unit 42 also observed in-memory reverse shells used to avoid leaving forensic artifacts on disk and scanning behavior such as enumerating /var/qmail/mailnames/ directories to count stored emails.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleCredential theft, web shells and exfiltration techniques
Unit 42 documented multiple credential-harvesting approaches abused by the actor: replacing the .bashrc file with a malicious version that issues a password-stealing command; injecting code into PHP login pages to harvest administrative credentials; and scanning configuration and command history files for cleartext email, SMTP and database passwords. A mix of open-source and bespoke PHP web shells provided persistent backdoors.
The attackers also deployed PHP and shell scripts to locate and compress mailbox content. Unit 42 described a PHP script named search_social.php that searched email headers for social-media–related keywords and presented exact file paths, sender, recipient and subject. An attempted bash script called zip_mails.sh aimed to compress emails for exfiltration but failed at runtime because of syntax errors.
AI, conversational code comments, and agentic frameworks
Unit 42 highlighted the likely role of large language models and automated AI agents in script generation. Multiple scripts contained "conversational, step-by-step reasoning notes" explaining code logic to the operator who issued the initial instructions—an artifact Unit 42 said suggests code was copied directly from an AI prompt output or deployed by an automated AI agent. The campaign's use of "malicious PHP and shell scripts, likely generated using AI," was paired with operational behavior to disable endpoint protections, wipe system logs, and plant deceptive red-team markers to masquerade as legitimate security assessments.
Separately, Google Threat Intelligence Group (GTIG) and Mandiant, with Microsoft, have documented the abuse of open-source agentic penetration-testing frameworks such as ARTEX, PentAGI, Hexstrike and CAIRN to accelerate actions across attack lifecycles. Unit 42 noted that ARTEX was taken down by its author after widespread misuse, but had spawned multiple versions including a commercial ARTEX PRO and a localized variation called ScopeWeaver.
GTIG and Mandiant warned that "frameworks such as ARTEX compress attack timelines to machine speed; however, they currently trade stealth for velocity. Unrestricted autonomous execution generates forensic traffic, relies on recognizable identifiers, and leaves behind distinct code-level traces, increasing the likelihood of detection and mitigation."
What this means for technologists, policymakers, and affected governments
- Technologists and security teams should watch for AI-style artifacts in scripts—conversational reasoning notes, atypical prompt-like structure—and hard-coded C2 indicators such as WebSocket connections to 104.194.158[.]65:443, as well as in-memory reverse shells and unusual enumeration of mail storage paths like /var/qmail/mailnames/.
- Policymakers and takedown coordinators are confronted with the proliferation of agentic offensive frameworks: ARTEX's removal did not prevent forks and commercial iterations, a dynamic GTIG and Mandiant identified as compressing attack timelines and altering the trade-offs between speed and stealth.
- Affected governments and state-affiliated operators must prioritize detecting web-shell persistence, integrity of login pages and .bashrc files, and the presence of scripts designed to locate and package email archives—Unit 42 found specific tooling such as search_social.php and attempted use of zip_mails.sh in this campaign.
Unit 42's account of CL-UNK-1211 draws a clear line between traditional post‑exploitation tradecraft and AI-accelerated workflows: bespoke backdoors like SysGoRAT and familiar web-shell techniques are being combined with scripts that bear the fingerprints of large language models and agentic frameworks. The cluster's name itself—CL-UNK-1211—underscores that motivation remains officially unspecified even as operational tempo and tooling leave traceable signatures; defenders will be left to decide whether the next winning detection strategy is focused on code-level artefacts, network indicators like the hard-coded C2 address, or signs of automated script provenance.
