Unit 42: LLM-Written Malware Targets Government Credentials

Unit 42 has documented the CL-UNK-1211 campaign, which targeted government agencies and state-linked infrastructure from October 2025 to April 2026, using payloads full of chat-style comments and reasoning notes typical of a language model. The group used open-source tools, custom backdoors and web shells for reconnaissance and persistence, and went after databases, email and social media accounts. For defenders, those notes are now a signal to hunt for, along with protected logs, a register of red-team engagements and alerts whenever someone disables the EDR.