Unit 42 identified a campaign targeting government entities and state-affiliated infrastructure, with observed activity spanning from October 2025–April 2026. We track this activity as CL-UNK-1211.
In the operations we witnessed, the attackers relied on AI-generated payloads. Multiple artifacts deployed throughout the intrusion contained AI-made conversational annotations and developer reasoning comments, suggesting that the code was either generated using large language models (LLMs) or executed by an automated AI agent.
The attackers behind this cluster of activity focused on Linux environments to conduct extensive reconnaissance and maintain persistent network access to support intelligence-gathering. The attackers attempted to dump sensitive databases and exfiltrate government mailboxes to access social media accounts.
Read more…
Source: Palo Alto Unit 42
Sign up for the Cyber Security Review Newsletter
The latest cyber security news and insights delivered right to your inbox
Related:
- Hundreds of Artex AI hacking tools found publicly exposed to the web
November 6, 2026
Security researchers have discovered hundreds of copies of a Chinese-made AI hacking tool publicly exposed to the internet for anyone to access, potentially allowing outsiders to launch cyberattacks against unsuspecting targets. The hacking software, called Artex, is an open source autonomous penetration testing tool, meaning software that automatically probes computer systems for weaknesses, and it’s been ...
- FBI agent steals $2.47 million in crypto tied to 35 investigations and plans Portugal escape
November 6, 2026
A former FBI agent stole $2.47 million in crypto using classified investigative records, compromising federal investigations into criminal organizations and foreign adversaries. The US Department of Justice disclosed on Nov. 5 that Patrick Steven Yaroch, 37, pleaded guilty to wire fraud and money laundering after exploiting his access to crypto wallet credentials collected during FBI investigations. His ...
- French bank hit by cyberattack, losses estimated at €118 million
November 5, 2026
French regional bank Crédit Mutuel Arkéa said on Wednesday, November 4, that it had been the victim of a cyberattack that allowed fraudulent transactions, which reports claim amounted to €100 million. The bank, an arm of French financial services giant Crédit Mutuel in western France, said the attack was “under control” and there would be ...
- Norway’s aid agency pwned and all users’ data is stolen
November 5, 2026
Norway’s national aid agency, Norad, has confirmed that cyber criminals broke into its systems, stealing information about each and every registered user of its grant portal. Norad, which coordinates Norway’s assistance for foreign development, said that 20,614 registered individuals had their names and email addresses swiped, and information from at least three organizations’ applications was “misdirected.” The ...
- Cyberattack targets French blood banks
November 4, 2026
A cyberattack on several French blood banks sought to raise temperatures to extremely high levels but was thwarted before it could do any damage to blood products or samples, authorities said. The incident comes after supermarkets in a number of European countries reported this week that their fridges and freezers warmed up after they were ...
- Chrome 157 fixes 213 security issues, including 7 critical flaws
November 4, 2026
On November 3, Google issued Chrome 157 to the stable channel for Windows, Mac and Linux. The update is rolling out over the coming days and weeks. Most users are on Chrome’s Stable channel. The desktop update brings Chrome to versions 157.0.8103.38/.39 for Windows and Mac and 157.0.8103.38 for Linux. It includes 213 security fixes, including seven vulnerabilities rated Critical by ...