Threats · 8h ago
Unit 42 says CL-UNK-1211 ran an AI-assisted espionage campaign against government and state-linked infrastructure from October 2025 through April 2026, targeting Linux systems with custom malware, web shells, and credential theft. The firm says it saw conversational comments and developer-style reasoning inside multiple artifacts, which points to code and operator notes being drafted by an LLM or automated agent.
The cluster used a mix of open-source tools, cross-platform backdoors, web shells, log wiping, deceptive red-team markers, and curl-based uploads to public file hosts. In plain terms, the operators could build and vary their tooling faster, then keep exfiltration and follow-on access flowing even after a local cleanup knocks out the obvious shell.
For defenders, the point is not just that Linux was in scope, but that the malware itself may be easier to reproduce and customize than hand-written tradecraft. If your environment watches for curl uploads or mailbox and database theft, this campaign shows those signals can sit alongside AI-shaped tooling and still support durable access.
Known exploited · CISA KEV
CVSS 10 CRITICAL: a pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0… Known ransomware campaign use. EPSS 100% (100th percentile).
CISA federal remediation date Dec 12 · date passed
Known exploited · CISA KEV
CVSS 7.8 HIGH: a local privilege escalation vulnerability was found on polkit's pkexec utility. EPSS 95% (100th percentile).
CISA federal remediation date Jul 18 · date passed
1 source covering this story
AI-Powered Espionage Campaign Targets Government Linux Infrastructure
Our analysis an AI-powered espionage campaign targeting government Linux infrastructure with custom malware, web shells, and advanced credential theft.
Part of the PlainSec briefing for 2026-10-16