Actor Profile

CL-UNK-1211 is a cyber espionage cluster tracked by Palo Alto Networks Unit 42, where "CL" denotes cluster and "UNK" indicates unknown motivation. Active between October 2025 and April 2026, this activity set targeted Linux infrastructure associated with government entities and state-affiliated organizations. The actor's motivation appears to be intelligence gathering, with operations focused on extensive reconnaissance, persistent network access, database dumping, government mailbox exfiltration, and social media account compromise. A distinguishing characteristic is the suspected use of large language models (LLMs) and automated AI agents to generate payloads and operational scripts, evidenced by conversational step-by-step reasoning notes within code suggesting direct copying from AI prompt outputs or deployment by automated AI agents.

TTPs (Tactics, Techniques, Procedures)

The campaign employs a versatile operational playbook combining open-source tools, custom cross-platform backdoors, and web shells. Key TTPs include: deployment of SysGoRAT, a custom Go-based multi-platform RAT with WebSocket C2 (104.194.158[.]65:443) supporting arbitrary command execution, interactive shells, screenshots, file exfiltration, and persistence installation; credential harvesting via malicious .bashrc replacement, PHP login page injection, and scanning configuration files for cleartext passwords; use of PHP and shell web shells for persistent backdoor access; in-memory reverse shells to evade disk-based forensics; email enumeration targeting /var/qmail/mailnames/ directories with social media-focused keyword searches; attempted email compression and exfiltration via zip_mails.sh script; defensive evasion through endpoint protection disabling, system log wiping, and planting deceptive red-team markers to masquerade as legitimate security assessments.

Targets & Patterns

CL-UNK-1211 specifically targets Linux server infrastructure within government entities and state-affiliated organizations. The targeting pattern demonstrates a clear focus on intelligence collection objectives, particularly seeking access to sensitive government databases, official email communications, and social media account credentials. The actor's operational focus on Linux environments suggests deliberate selection of government backend infrastructure rather than end-user systems. The email exfiltration attempts and social media account targeting indicate interest in both official communications and potential access to public-facing government social media presence, likely for intelligence gathering or influence operations. The systematic approach to credential harvesting and persistent access maintenance suggests long-term strategic intelligence requirements rather than opportunistic targeting.

Historical Context

This campaign represents an emerging trend in threat actor adoption of AI-assisted tooling for operational acceleration. Google Threat Intelligence Group, Mandiant, and Microsoft have documented parallel abuse of open-source agentic penetration testing frameworks including ARTEX, PentAGI, Hexstrike, and CAIRN by multiple threat actors. Notable concurrent activity includes Storm-0940 (UNC7228) using ARTEX for data theft campaigns targeting U.S. and European enterprise software, industrial automation, semiconductor, and telecommunications sectors; financially motivated actors leveraging ARTEX for data theft extortion against Asian financial institutions; North Korean state-sponsored groups Onyx Sleet (Andariel) and Pearl Sleet (Lawrencium) incorporating ARTEX into operations; and use of PentAGI for WHOIS mapping and reconnaissance against Asian organizations. ARTEX spawned commercial variant ARTEX PRO and localized version ScopeWeaver after the original was taken down due to widespread misuse, indicating ecosystem evolution around AI-accelerated attack frameworks.

Defensive Recommendations

  • Monitor for PHP and shell scripts containing conversational reasoning notes or step-by-step explanations characteristic of LLM-generated code, particularly in web directories and temporary file locations
  • Detect SysGoRAT C2 activity by monitoring for WebSocket connections to suspicious IP addresses on port 443, specifically watching for connections to 104.194.158[.]65:443 and similar non-standard WebSocket C2 patterns
  • Implement file integrity monitoring on critical system files including .bashrc and PHP login pages to detect unauthorized modifications used for credential harvesting
  • Enable comprehensive logging of /var/qmail/mailnames/ directory access and email file enumeration activities, alerting on bulk email file access or keyword-based searches
  • Deploy detection rules for in-memory execution techniques and reverse shell spawning, monitoring for /bin/sh -c execution patterns and suspicious process ancestry chains indicative of web shell activity