An espionage campaign named CL-UNK-1211 targeted government and state-affiliated Linux infrastructure from October 2025 to April 2026. The attackers used AI-generated payloads with conversational annotations indicating involvement of large language models or automated AI agents. They deployed web shells, custom cross-platform backdoors including SysGoRAT malware, and open-source tools to maintain persistent access. The campaign involved extensive reconnaissance, database dumping, mailbox enumeration targeting social media accounts linked to government emails, and advanced defense evasion techniques such as disabling endpoint protections, erasing system logs, and planting deceptive red-team markers to disguise malicious activity as legitimate security assessments.