Government and state-affiliated Linux servers spent five months under an espionage campaign whose tooling bears the fingerprints of machine generation.
Palo Alto Networks Unit 42 tracked the cluster as CL-UNK-1211. The activity ran from October 2025 through April 2026 against Linux infrastructure tied to public-sector bodies, with attackers after mail stores, credentials and social media access.
The tell was in the margins
Several PHP and shell scripts carried conversational, step-by-step reasoning notes explaining the code’s logic to the person who issued the original instruction. Developers do not write comments like that. The researchers read it as output copied straight from a model prompt or pushed out by an autonomous agent.
One exfiltration helper, zip_mails.sh, carried syntax errors and simply failed when run. Speed came at the cost of care.
What defenders should look for
Persistence rested on a mix of open-source and custom PHP web shells. From there the crew pulled credentials three ways: overwriting .bashrc with a password-stealing version, injecting code into PHP login pages, and grepping configuration files and shell history for cleartext mail, SMTP and database passwords.
A Go-based trojan dubbed SysGoRAT kept access open on both Linux and Windows, calling home over WebSocket to a hard-coded address and accepting seven command types spanning arbitrary execution, screenshots, file theft, an interactive shell and TCP proxying.
Operators also tried to launder the intrusion as authorized work by disabling endpoint protections, wiping logs and planting red-team markers.
Unit 42 advises auditing script authorship, watching for reasoning-style comments in production tooling, and treating unexplained red-team artifacts as a possible disguise rather than reassurance.
