The malware still had the AI's comments in it

Unit 42 has published a campaign against government entities and state-affiliated infrastructure, with activity observed from October 2025 to April 2026, which it tracks as CL-UNK-1211. The detail that gives the report its character is in the code: multiple artefacts deployed through the intrusion contained AI-made conversational annotations and developer reasoning comments, which the researchers read as a sign that the code was generated using large language models or executed by an automated agent.

The focus was Linux environments, used for extensive reconnaissance and to maintain persistent network access in support of intelligence gathering. The operators attempted to dump sensitive databases and to exfiltrate government mailboxes in order to reach social media accounts.

The toolkit combined open-source tools, custom cross-platform backdoors and web shells deployed widely. The evasion is the part worth reading twice. Alongside attempts to disable endpoint protections and erase system logs, the operators planted deceptive red-team markers so that the activity would look like a legitimate security assessment.

The shape of the operation deserves separating from the detail about generated code. Unit 42 describes a versatile playbook tailored to enterprise Linux and database environments, in which persistence came from the combination of those three elements rather than from any single implant, and lists reverse shells, remote access trojans and Python payloads among the activity it indexes. An intrusion built this way does not fall over when one component is found.

Unit 42 is explicit about the limits of what it knows. The UNK designation in its attribution framework marks a cluster whose affiliation, nation-state or criminal, has not been determined. The report sets out the defining tools, techniques and attack patterns of the cluster rather than naming a sponsor.