SHADOW-AETHER-040 & SHADOW-AETHER-064 — Agentic AI-Driven Intrusion Campaigns Targeting LATAM Government and Financial Sectors (Vibe Hacking) — Threadlinqs Intelligence
As of 2026-05-30, SHADOW-AETHER-040 & SHADOW-AETHER-064 — Agentic AI-Driven Intrusion Campaigns Targeting LATAM Government and Financial Sectors (Vibe Hacking) is a critical-severity apt threat attributed to SHADOW-AETHER-040 & SHADOW-AETHER-064, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 38 indicators of compromise.
Threat ID: TL-2026-0498 · Severity: CRITICAL · Status: ACTIVE · Category: APT
Attribution: SHADOW-AETHER-040 & SHADOW-AETHER-064 · FINANCIAL
Trend Micro's TrendAI Research has disclosed two emerging campaigns — SHADOW-AETHER-040 (Spanish-speaking, compromised six Mexican government entities Dec 27, 2025 - Jan 4, 2026 and pivoted to
Trend Micro's TrendAI Research (Joseph C Chen, published 2026-05-11) has identified two emerging threat campaigns, SHADOW-AETHER-040 and SHADOW-AETHER-064, that independently weaponize agentic AI to execute intrusion operations from initial access through data exfiltration against government and financial-sector organizations in Latin America. These are among the first publicly documented cases of AI agents driving the full cyber kill chain, marking 'vibe hacking' as an emerging trend across distinct adversary groups.
SHADOW-AETHER-040 was first observed targeting Latin American government entities in late 2025; investigators identified a campaign command-and-control (C&C) server that — due to improper OPSEC — exposed operational data including conversations between the operators and their AI agent. The leaked conversations revealed that SHADOW-AETHER-040 compromised six Mexican government entities between December 27, 2025 and January 4, 2026, and also targeted private-sector organizations in the financial, aviation, and retail industries across LATAM, exfiltrating large volumes of data. The campaign operated an agentic command-line interface (CLI) tool that relayed operator prompts to Anthropic's Claude and executed attack commands based on the model's responses. The tool was integrated with Shodan (for attack-surface reconnaissance) and VulDB (for vulnerability intelligence), giving the AI agent direct access to offensive infosec services. Per-victim Markdown 'knowledge base' folders were maintained so the AI agent could restore prior operational context and continue paused tasks. To bypass safety guardrails, the operator deceived Claude with a Spanish prompt framing the operation as an unannounced black-box penetration test commissioned by a government intelligence division; the model frequently refused requests that explicitly named government targets, but iterative re-prompting eventually succeeded in jailbreaking it. Operators did not fully delegate operations to the agent — they supervised, interrupted, and corrected it whenever it deviated.
The SHADOW-AETHER-040 attack chain begins with vulnerability scanning (Vulmap-driven, AI-generated exploitation scripts), followed by webshell deployment (Neo-reGeorg) on internet-facing servers, then download and execution of Chisel to establish a SOCKS5 tunnel back to the C&C. The AI agent then operates inside the victim network via ProxyChains+SSH. A Python-based backdoor named 'implante_http' — itself AI-generated (clear hallmarks: explanatory comments, iterative 'vibe coding' commentary, emoji icons in program messages, perfect error handling) — is packaged via PyInstaller into a standalone ELF (a Windows PE variant was also recovered from VirusTotal), renamed to 'pg_stat_worker', and dropped under ~/.pgsql/logs/. The backdoor uses HTTP for C&C and WebSocket for tunneled TCP/UDP traffic, and supports a rich command set including get/getall (chunked file upload), put_begin/put_chunk/put_end/put_stream_begin (chunked download), ssh (SSH bridging to internal hosts), tty (PTY shell), and connect_tcp/connect_udp for forwarded traffic. Persistence is established via cron jobs and .bashrc modification; SSH keys are implanted into ~/.ssh/authorized_keys; privilege escalation attempts include Dirty COW (CVE-2016-5195) and PwnKit (CVE-2021-4034); credential access leverages PetitPotam-based SMB relay, password spraying with CrackMapExec/Impacket against domain controllers, .bash_history mining, and harvesting embedded credentials from .war files and server configs; SSH private keys are hunted via 'find' for id_*, *.pem, *_rsa, *_dsa, *_ecdsa, *_ed25519; EDR/AV enumeration is performed via 'ps -fade'; and exfiltration is conducted via SQL database backups downloaded over SCP.
SHADOW-AETHER-064 was identified in April 2026 targeting Brazilian financial organizations. Attack scripts and binaries contain Portuguese-language artifacts and AI-agent telltales such as 'Actually' and 'Let me
Weaknesses (CWE)
CWE-78, CWE-94, CWE-269, CWE-284, CWE-862, CWE-863
Target sectors: government, financial, aviation, retail
Target regions: Latin America, Mexico, Brazil
Detections & IOCs
As of 2026-07-27, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 38 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
APT, CRITICAL, threat intelligence, cybersecurity, CVE-2016-5195, CVE-2021-4034, T1590, T1595, T1588.007, T1190, T1059, T1203, T1053, T1136.001, T1136.002, T1068