Researchers detail SysGoRAT campaign targeting government Linux systems

Palo Alto Networks Unit 42 has disclosed a campaign targeting government and state-affiliated Linux infrastructure, observed between October 2025 and April 2026. Researchers said attackers sought persistent access, attempted database theft and searched government mailboxes for information linked to social media accounts. The campaign used credential-stealing scripts, web shells and SysGoRAT, a custom tool that supports remote commands, file theft and proxy connections on Windows and Linux. Conversational notes in scripts suggest AI involvement, but one script intended to archive emails failed because of syntax errors.