Latest
  1. Ireland’s government will not oppose Labour bill on AI sexual abuse images
  2. METR estimates Anthropic’s capabilities now improve at about twice its 2024 to 2025 pace
  3. Anthropic rolls out Personal Finance beta in Claude, with read-only bank access
  4. Baidu releases ERNIE-5.5-Flash-Base pre-training checkpoint on Hugging Face
  5. Parents sue Google, saying Gemini on a school Chromebook helped their daughter plan suicide
  6. Visa benchmark finds AI shopping agents fail 42.8% of runs
  7. OpenAI releases GPT-6 Cyber for approved security customers
  8. Google releases Gemini Omni 1.2 Flash with 15-second video clips

Latest / Government and geopolitics

IncidentGovernmentMediaDefenceInternationalConfirmed

Government Linux servers targeted with SysGoRAT and suspected AI-generated scripts

See how this story connects

Source: The Hacker News

Palo Alto Networks Unit 42 disclosed a cyber espionage campaign, tracked as CL-UNK-1211, that targeted Linux infrastructure associated with government entities between October 2025 and April 2026. The attackers deployed SysGoRAT, a custom remote access trojan written in Go, and PHP and shell scripts that Unit 42 says were likely generated using AI. They attempted to dump sensitive databases and exfiltrate government mailboxes to access social media accounts. One script meant to compress emails into ZIP archives failed because of syntax errors.

Why it matters

Unit 42 says the CL-UNK-1211 attackers combined traditional post-exploitation techniques with AI-accelerated workflows, which let them keep a fast pace of operation with minimal manual developer overhead.

When
2 Nov 2026
ID
WTA-N-2026-0617
Who
Palo Alto Networks Unit 42; Roey Porat, Tom Fakterman

Summary written with AI by wheresthe.ai, from The Hacker News. Checked against the source on 2 Nov 2026.

Read the original at The Hacker News

Source copy: saved on 2 Nov 2026 to check this story and not republished, because the text belongs to its publisher. Also held by the Internet Archive.

Next stop on this Storyline: What happened nextChainstack says an AI-powered attack campaign reached its customer account data

Cite this story

WTA-N-2026-0617: “Government Linux servers targeted with SysGoRAT and suspected AI-generated scripts.” wheresthe.ai, 2 Nov 2026. https://wheresthe.ai/d/intl-government-linux-servers-targeted-with-sysgorat-and-sus-2026-11/ (source: The Hacker News).

Spotted an error? Email [email protected].