CSIRT warns of CL-UNK-1211 on Linux servers

Asobancaria’s Financial CSIRT said the CL-UNK-1211 campaign is compromising Linux servers used by government organizations and state-affiliated infrastructure through SysGoRAT, web shells and reverse shells. The advisory describes remote access, command execution and information-gathering capabilities, and says there is no confirmed attribution to any specific APT group or state actor.

What did Asobancaria report about CL-UNK-1211?

Asobancaria said the campaign relies on SysGoRAT, along with web shells and reverse shells, to gain control of Linux servers linked to state entities or associated infrastructure. The report focuses on the malware’s capabilities and the scope of access obtained, not on a conclusive attribution.

What capabilities does SysGoRAT have, according to technical coverage?

Technical reports cited in the coverage describe SysGoRAT as a tool compatible with Linux and Windows, with WebSocket-based communication and functions to run commands, list directories, transfer files, capture screenshots, open an interactive shell and act as a TCP proxy. GBHackers also said the malware had a command structure with seven instruction types and subactions such as shell_start, screenshot, download and persist.

What was the scope of the campaign?

According to coverage citing Unit 42, activity linked to CL-UNK-1211 was observed for months, from October 2025 through April 2026. SecurityLab said the names of the affected entities were not disclosed, so the known scope remains incomplete.

The technical coverage also says the campaign likely included reconnaissance, database theft and attempts to obtain government email accounts tied to social media accounts, along with the deployment of the RAT and reverse shells. GBHackers said SysGoRAT used 104.194.158[.]65:443 by default for its WebSocket communications, although that destination could be overwritten.

NeoTeo, meanwhile, reported that the analysis described several persistence mechanisms in Windows and Linux. Taken together, the coverage places CL-UNK-1211 as an espionage and remote-access operation focused on Linux servers, but Asobancaria’s Financial CSIRT did not confirm who is behind the campaign.