New SysGoRAT malware targets government Linux servers with likely AI-generated scripts

Palo Alto Networks' Unit 42 says it tracked a campaign against government-linked Linux infrastructure that used a custom remote access trojan called SysGoRAT along with malicious scripts that appear to have been generated with AI, according to a report by researchers Roey Porat and Tom Fakterman covered by The Hacker News.

What happened

Unit 42 tracks the activity as CL-UNK-1211, where "CL" denotes a cluster and "UNK" means the motivation is unknown, The Hacker News reported. The firm observed the activity between October 2025 and April 2026 and said it targeted Linux infrastructure linked to government entities and state-affiliated organizations. The report does not name specific governments or organizations. Unit 42 said the attackers aimed to dump sensitive databases and access government mailboxes in order to reach social media accounts.

Technical details

SysGoRAT is described as a custom, multi-platform remote access trojan written in Go that runs on both Windows and Linux and supports several persistence methods, Unit 42 said. It connects over WebSocket to a hard-coded IP address (104.194.158[.]65 on port 443) and accepts seven command types, including command execution, control functions such as shells, screenshots, file download and persistence, directory listing, shell input, and three proxy-related commands for opening, relaying, and closing TCP connections.

Unit 42 also found malicious PHP and shell scripts it believes were likely generated with AI. Many contained conversational, step-by-step reasoning notes explaining the code to the operator, which the researchers said suggests the code was copied from AI output or deployed by an automated agent; one script, named zip_mails.sh, failed on execution because of syntax errors. The reported tradecraft included open-source tools, PHP web shells, credential harvesting by replacing .bashrc with a password-stealing version and injecting code into PHP login pages, disabling endpoint protections, wiping system logs, and planting fake red-team markers to pass the activity off as a legitimate assessment. The attackers also used in-memory reverse shells to avoid leaving files on disk and ran reconnaissance scripts, including one (search_social.php) that searched email headers for social-media-related messages.

Who is affected

Unit 42 did not attribute the campaign to a named group and listed its motivation as unknown. The targeting of government and state-affiliated Linux systems, combined with mailbox and database access goals, points to an espionage-oriented operation. The Hacker News notes that Google Threat Intelligence Group, Mandiant, and Microsoft have separately documented threat actors abusing open-source agentic penetration-testing frameworks such as ARTEX, PentAGI, Hexstrike, and CAIRN, with GTIG and Mandiant observing that such frameworks speed up attacks but tend to leave forensic traces that increase detection risk.

What to do

Organizations running internet-facing Linux services should watch for the reported behaviors: unexpected modifications to .bashrc, injected code in PHP login pages, cleared system logs, and outbound WebSocket connections to unfamiliar hard-coded IP addresses. Defenders can treat the presence of "red-team" markers without a corresponding authorized engagement as a warning sign, and should review PHP web shells and reconnaissance scripts that enumerate mail directories. Monitoring for in-memory reverse shells and restricting outbound connections from server infrastructure further reduce exposure.