Government Linux Servers Targeted With SysGoRAT and Suspected AIGenerated Scripts

Cybersecurity researchers have disclosed details of a cyber espionage campaign specifically targeting Linux infrastructure associated with government entities and stateaffiliated infrastructure The activity observed by Palo Alto Networks Unit 42 between October 2025 and April 2026 has been tracked under the moniker CLUNK1211 where CL refers to cluster and UNK stands for unknown