Espionage Campaign Targets Government Linux Servers With SysGoRAT Malware
THREAT ACTORPalo Alto Networksredteam/daily · 1 source
- Severity
- High
- Sources
- 1
What happened
Unit 42 at Palo Alto Networks reports a cyber espionage campaign against Linux infrastructure associated with government and state-affiliated entities, observed between October 2025 and April 2026. The activity is tracked as cluster CL-UNK-1211 and involves the SysGoRAT malware and suspected AI-generated scripts. The article gives no CVE identifiers, affected versions or indicators of compromise, so defenders should consult the full Unit 42 report for detection guidance.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- No action needed.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
The Hacker News
Who and what is in it
Companies