News
cybersecurity Over 1,000 GitLab servers vulnerable to ongoing RCE attacks - BleepingComputer cybersecurity iPhone Jailbreak Vulnerabilities Put Crypto Wallet Seed Phrases at Risk on Older Devices - CyberPress threat-intel Unpatchable Hardware Flaws in Older iPhones Allow Attackers to Steal Crypto Wallet Recovery Phrases - GBHackers threat-intel New ChatGPT Phishing Kit Uses Rotating WordPress Websites to Steal Payment Details and OTPs - GBHackers cybersecurity Hackers Compromise Ukraine and Russia’s Emergency Alert Apps to Spread Fake Nuclear Warnings - CyberPress cybersecurity Malicious Claude Code Extension Served in Cursor Supply Chain Attack - SecurityWeek cybersecurity Synology warns of C3RB3R ransomware attacks targeting NAS devices - BleepingComputer threat-intel Hackers Target Emergency Alert Apps in Ukraine and Russia, Sending Fake Nuclear Attack Warnings - GBHackers cybersecurity Attackers Pose as IT Support on Microsoft Teams, Abuse AD CS to Steal Company Data - The Hacker News threat-intel Hackers Target Supermarket Refrigeration Systems Across Sweden, Raising Freezer Temperatures to 55°C - GBHackers cybersecurity Hackers Use Fake ChatGPT Plus Billing Emails to Steal Credit Card Details and OTP Codes - CyberPress cybersecurity Hackers Target Supermarket Refrigeration Systems in Sweden, Raising Temperatures to 50°C - CyberPress threat-intel Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527) - Rapid7 Emergent Threat Response cybersecurity My Journey to the Center of America’s Political Spam Text Hell - Wired Security threat-intel Researchers Discover High-Severity ChatGPT Flaw That Exposed Private Conversations to Attackers - GBHackers
1 / 15
All news ›
Cybersecurity

Government Linux Servers Targeted With SysGoRAT and Suspected AI-Generated Scripts

The Hacker News ·

Cybersecurity researchers have disclosed details of a cyber espionage campaign specifically targeting Linux infrastructure associated with government entities and state-affiliated infrastructure. The activity, observed by Palo Alto Networks Unit 42 between October 2025 and April 2026, has been tracked under the moniker CL-UNK-1211, where "CL" refers to cluster and "UNK" stands for unknown

Continue on The Hacker News ↗ ‹ All news Get the newsletter

The summary and image come from The Hacker News; the image is shown from their website.