CL-UNK-1211 targets government Linux servers with apparently AI-generated scripts and the SysGoRAT Go RAT
Unit 42 (unit42.paloaltonetworks.com) tracks a campaign, CL-UNK-1211, that compromised government entities and state-affiliated Linux infrastructure between October 2025 and April 2026. Unit 42 published the research on October 15, and gbhackers.com covered it on October 22. The operators carried out reconnaissance, persistence and intell…