Attack
Unit 42 found conversational notes in scripts targeting government Linux infrastructures.
Unit 42 considers these artifacts as clues of AI-assisted development.
The public report does not say whether an AI agent also carried out the operation.
CL-UNK-1211's activity extended from October 2025 to April 2026 and is not attributed to any known group.
A Trojan in Go, named SysGoRAT, supports Linux and Windows and communicates via WebSocket.