Government Linux Servers Targeted in Cyber Espionage Campaign Using SysGoRAT and Exploited Vulnerabilities

Cybersecurity researchers from Palo Alto Networks Unit 42 have disclosed details of a cyber espionage campaign targeting Linux infrastructure associated with government entities and state-affiliated entities. The activity, tracked under the moniker CL-UNK-1211 (where "CL" refers to cluster and "UNK" stands for unknown), was observed between October 2025 and April 2026.

The campaign involved the deployment of SysGoRAT, a remote access trojan targeting Linux systems. Researchers noted the use of suspected AI-generated scripts as part of the attack infrastructure. Initial access to targeted systems was achieved by exploiting two known vulnerabilities: CVE-2024-6385, a deserialization vulnerability in Oracle WebLogic Server, and CVE-2025-2783, a remote code execution vulnerability in WireGuard VPN appliances.

The exploitation of these vulnerabilities allowed the threat actor to gain unauthorized access to government and state-affiliated Linux servers. Once inside, the deployment of SysGoRAT facilitated persistent remote access and command-and-control operations. The scope of data exfiltrated and the specific attribution of the threat actor remain under investigation.

Palo Alto Networks has attributed the activity to a cluster designated CL-UNK-1211, though definitive attribution to a known state-affiliated group has not been confirmed. The timing of the campaign overlaps with regional geopolitical tensions, though the exact motivation is yet to be determined.

The report highlights the evolving nature of cyber espionage campaigns targeting critical government infrastructure and the increasing complexity of attack chains involving both exploited vulnerabilities and novel scripting techniques.