highCyber Attacks
Government Linux Servers Targeted in Cyber Espionage Campaign Using SysGoRAT and Exploited Vulnerabilities
Researchers from Palo Alto Networks Unit 42 have detailed a cyber espionage campaign tracked as CL-UNK-1211 that specifically targeted Linux servers associated with government entities and state-affiliated infrastructure. The activity, observed from October 2025 to April 2026, involved the deployment of SysGoRAT malware and the use of suspected AI-generated scripts. Initial access was achieved through exploitation of CVE-2024-6385 in Oracle WebLogic Server and CVE-2025-2783 in WireGuard VPN appliances.
The Hacker News2 min read