Palo Alto Networks Identifies Hacker Group CL-UNK-1211 Suspected of Using AI-Generated Code to Target Government Infrastructure
Palo Alto Networks reports that hacker group CL-UNK-1211 allegedly used large language models to generate malicious code for cyberespionage against government Linux servers between October 2025 and April 2026.
According to a report by iThome, cybersecurity firm Palo Alto Networks identified a hacker group named CL-UNK-1211 that allegedly utilized Large Language Models (LLMs) or automated AI agents to assist in writing attack tools. From October 2025 to April 2026, the group targeted government agencies and related infrastructure for cyberespionage activities, aiming to steal credentials, collect government emails and database contents, and uncover government personnel's social media platform accounts.
Analysis revealed that multiple PHP and Shell malicious programs contained conversational comments resembling AI-generated output, which step-by-step explained program logic and development reasoning. This differs from typical developer-written comments. Additionally, the attack programs exhibited characteristics such as extensive Base64 encoded instructions and alternating usage of languages like PHP, JavaScript, Bash, and Python.
During the intrusion phase, CL-UNK-1211 gained access to Linux servers by deploying self-developed and GitHub-sourced open-source Web Shells, modifying the auto_prepend_file parameter in PHP settings to maintain long-term access. One malicious PHP file was named plesk_sys_driver.php, attempting to disguise itself as a legitimate system file. Subsequently, the group tampered with .bashrc files to hijack sudo commands, displaying fake password prompts to steal user credentials before passing them to the original sudo command.
Researchers also discovered SysGoRAT, a cross-platform remote access trojan developed in Go, capable of running on both Linux and Windows environments and communicating with C2 servers via WebSocket. Its functions include executing remote commands, establishing interactive shells, listing directories, creating TCP proxy connections, and downloading files. Persistence was established through methods such as systemd, cron, and Windows registry keys.