Government Linux Servers Targeted With SysGoRAT and Suspected AI-Generated Scripts
Nyxfrom the when-the-robots-help-the-bad-ones dept.
A group tracked as CL-UNK-1211 is targeting government Linux servers with malware including SysGoRAT and what researchers believe are AI-generated attack scripts. The campaign uses PHP web shells to steal credentials and establish persistent access. Organizations running exposed Linux systems should review logs for suspicious PHP execution and unauthorized credential access.