Unit 42 tracks a cluster it calls CL-UNK-1211, with no nation-state or crime attribution yet. It went after government and state-affiliated Linux and database servers from October 2025 to April 2026. Several PHP and shell payloads carried conversational, step-by-step reasoning comments, section headers built for parsing output, heavy Base64, and quick switching between PHP, JavaScript, Bash and Python. Unit 42 reads these as signs the code came from an LLM or was run by an automated agent. The tradecraft itself was conventional: web shells, a custom Go RAT (SysGoRAT), credential theft, mailbox searches to take over social-media accounts tied to government email, database dumps and heavy log wiping. Some AI-written scripts were buggy. One mailbox-zipping script had a syntax error that would have stopped it from running. The takeaway is that AI sped up the operators, but they didn't need new techniques, and normal Linux EDR telemetry still caught them. Hunt details are in Threat Hunting.