Government Linux Servers Targeted With SysGoRAT and Suspected AI-Generated Scripts

The campaign, observed by Palo Alto Networks Unit 42 between October 2025 and April 2026, employs a "versatile operational playbook" combining open-source tools, custom cross-platform backdoors, and web shells to maintain access. Attackers have been observed using AI-generated PHP and shell scripts to maintain persistence, perform reconnaissance, and exfiltrate data from targeted government systems.

Researchers noted that rather than standard developer documentation, multiple scripts contained conversational, step-by-step reasoning notes explaining the code's logic to the operator. "Their presence suggests that the code was either copied directly from an AI prompt output or deployed by an automated AI agent," the cybersecurity company explained.

SysGoRAT Backdoor

A key component of the attacks is a custom, multi-platform remote access trojan written in Go called SysGoRAT. It supports various persistence methods to maintain long-term access on both Windows and Linux systems, establishing a command-and-control connection over WebSocket to a hard-coded IP address (104.194.158[.]65:443).

SysGoRAT fetches seven types of commands, including arbitrary command execution, interactive shells, file exfiltration, directory listing, proxy connections, and session termination. The attackers also used in-memory reverse shells to avoid leaving forensic artifacts on disk.

Data Theft Attempts

The campaign involves multiple methods to steal credentials from targeted environments, including replacing the .bashrc file with a malicious version, injecting code into PHP login pages, and scanning for cleartext passwords in configuration files. Attackers specifically targeted email systems, enumerating "/var/qmail/mailnames/" directories and searching for social media-related emails.

A PHP script named search_social.php was deployed to search for specific keywords in email headers, displaying results in a user-friendly format with file paths, sender information, and subjects. The attackers also attempted to create a bash script called "zip_mails.sh" to compress and exfiltrate emails of interest, though syntax errors prevented its successful execution.

AI-Driven Threat Landscape

This campaign reflects a broader shift toward threat actors adopting open-source agentic penetration testing frameworks like ARTEX, PentAGI, Hexstrike, and CAIRN. These frameworks enable "a broad range of actions" across various attack stages at unprecedented speed and scale, though they currently trade stealth for velocity.

Google Threat Intelligence Group and Mandiant documented multiple cases of ARTEX misuse, including by Storm-0940 for data theft, financially motivated actors targeting Asian financial institutions, and North Korean state-sponsored groups like Onyx Sleet and Pearl Sleet. "Frameworks such as ARTEX compress attack timelines to machine speed," the researchers noted, "however, they currently trade stealth for velocity."

The emergence of these agentic offensive frameworks underscores how attackers are combining traditional post-exploitation techniques with AI-accelerated workflows to target critical infrastructure. By leveraging AI to rapidly generate, adapt and deploy operational scripts, threat actors maintain a fast pace of operation while minimizing manual developer overhead.