CL-UNK-1211 targets government Linux servers with SysGoRAT

Palo Alto Networks Unit 42 disclosed a cyber espionage campaign targeting Linux infrastructure at government and state-affiliated entities between October 2025 and April 2026. The threat group, tracked as CL-UNK-1211, deployed SysGoRAT malware and suspected AI-generated attack scripts. Defenders should review logs for SysGoRAT indicators and patch exposed Linux systems immediately.