OTX Threat: AI-Powered Espionage Campaign Targets Government Linux Infrastructure

An espionage campaign tracked as CL-UNK-1211 targeted government entities and state-affiliated infrastructure between October 2025 and April 2026, utilizing AI-generated payloads containing conversational annotations suggesting LLM or automated AI agent involvement. Attackers focused on Linux environments deploying web shells, custom cross-platform backdoors including SysGoRAT malware, and open-so CVEs: CVE-2021-4034, CVE-2025-55182 Sectors: Government