# Researchers detail SysGoRAT campaign targeting government Linux systems

_Published Monday, November 2, 2026 at 7:50 AM EST · Security · Latest · Tier 2 — Notable_

![Researchers detail SysGoRAT campaign targeting government Linux systems — Primary](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiYHKbP_7yOsvpwAldBMCL3QkCJ9SbUVrJz1Tr_RB6m3O99Gj73H0fX20hIbzKujRWB-1qkBCWv1UEJEbrTe1NFYpPkTm0OoNqJe7OdJoZa1HcZDT2On3mUT0igQeCOsMnWw_ZfT-HsLx6B8R84XYHHg4mUI2hPzM15ggddQCFAAmzChzC5Of90LInW8RB8/s1700-nu-rw-lo-l85-e365/artex.jpg)

Palo Alto Networks Unit 42 has disclosed a campaign targeting government and state-affiliated Linux infrastructure, observed between October 2025 and April 2026. Researchers said attackers sought persistent access, attempted database theft and searched government mailboxes for information linked to social media accounts.

The campaign used credential-stealing scripts, web shells and SysGoRAT, a custom tool that supports remote commands, file theft and proxy connections on Windows and Linux. Conversational notes in scripts suggest AI involvement, but one script intended to archive emails failed because of syntax errors.

## Sources

- [The Hacker News](https://thehackernews.com/2026/11/government-linux-servers-targeted-with.html)

---
Canonical: https://techandbusiness.org/newswire/V_PCnWPnfeM8jCj7iu8Px9
Published: 2026-11-02T12:50:59.921Z
Story chronology: 2026-11-02T10:49:00.000Z
Retrieved: 2026-11-02T15:30:36.258Z
Publisher: Tech & Business (techandbusiness.org)