AI-Powered Espionage Campaign Targets Government Linux Infrastructure
2026-10-16T08:51:32Z•bc7f4629a49af8ba7d495aad2b13ed1d176e20b79723c75a9543541b2b95435b
CVE-2024-47575CVE-2026-88771CVE-2026-88772AMOS-stealerAWSFortiGateFortiManagerIran-nexusKubernetesLinuxNetScalerPEERSTITCHRBACUnit 42cloud-securitycredential-theftcritical-infrastructureespionageexploitation-in-the-wildgovernment-infrastructureidentity-abusemacOSmalware-campaignphishingsupply-chain-attackthreat-intelligenceweb-shellzero-day
What happened
Unit 42 reporting covers active and emerging threats across government Linux infrastructure, FortiGate and NetScaler appliances, cloud and Kubernetes environments, macOS systems, identity platforms, and enterprise supply chains. Key risks include exploitation of CVE-2024-47575 against FortiGate infrastructure with deployment of the memory-resident PEERSTITCH implant, in-the-wild exploitation of NetScaler zero-days CVE-2026-88771 and CVE-2026-88772, AI-assisted espionage, credential theft, web shells, cloud identity abuse, prompt injection, and malware campaigns targeting critical and corporate
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- paloalto_unit42
- Record identifier
- bc7f4629a49af8ba7d495aad2b13ed1d176e20b79723c75a9543541b2b95435b
- Enrichment time
- 2026-10-16T08:51:32Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.