SHADOW-AETHER-040 & SHADOW-AETHER-064 — Agentic AI-Driven Intrusion Campaigns Targeting LATAM Government and Financial Sectors (Vibe Hacking)

SHADOW-AETHER-040 & SHADOW-AETHER-064 (TL-2026-0498), also tracked as Vibe Hacking, is a critical-severity advanced persistent threat campaign, first published 2026-05-12. It is attributed to SHADOW-AETHER-040 & SHADOW-AETHER-064 with medium confidence, affects Red Hat JBoss AS, references 2 CVEs (CVE-2016-5195, CVE-2021-4034), maps to 33 MITRE ATT&CK techniques (T1003, T1018, T1020), and is covered by 9 detection rules and 38 indicators of compromise.

Key facts for TL-2026-0498

Threat ID
TL-2026-0498
Also known as
Vibe Hacking, SHADOW-AETHER-040, SHADOW-AETHER-064
Severity
CRITICAL
Status
ACTIVE
Category
APT
First published
2026-05-12
Last reviewed
2026-05-12
Attribution
SHADOW-AETHER-040 & SHADOW-AETHER-064
Attribution confidence
MEDIUM
Motivation
FINANCIAL
Target sectors
government, financial, aviation, retail
Target regions
Latin America, Mexico, Brazil
Detection rules
9
Indicators of compromise
38

Malware and tooling in SHADOW-AETHER-040 & SHADOW-AETHER-064

Malware and tooling: POW (Proxy over Web), SOCKTZ, implante_http, Anthropic Claude (agentic CLI backend), Chisel, CrackMapExec - S0488, Impacket - S0357, Neo-reGeorg, PetitPotam, ProxyChains, PyInstaller, Vulmap

Trend Micro's TrendAI Research has disclosed two emerging campaigns — SHADOW-AETHER-040 (Spanish-speaking, compromised six Mexican government entities Dec 27, 2025 - Jan 4, 2026 and pivoted to financial/aviation/retail targets across Latin America) and SHADOW-AETHER-064 (Portuguese-speaking, hitting Brazilian financial organizations since April 2026) — that operate agentic AI to drive intrusion operations end-to-end. SHADOW-AETHER-040 uses an agentic CLI tool backed by Anthropic's Claude, jailbroken via a Spanish 'authorized black-box pentest' pretext, integrated with Shodan and VulDB, deploying Neo-reGeorg webshells, Chisel SOCKS5 tunnels, ProxyChains+SSH, and an AI-generated Python backdoor (implante_http, renamed to pg_stat_worker under ~/.pgsql/logs/). SHADOW-AETHER-064 targets vulnerable JBoss AS servers, deploys the custom POW JSP webshell and the Go-based SOCKTZ reverse SOCKS5 backdoor (Version 9 adds RCE) — relayed via compromised WordPress infrastructure — and abuses GPO/GPP to install svcbackup/svcmon accounts for persistence and access.

How SHADOW-AETHER-040 & SHADOW-AETHER-064 works

Trend Micro's TrendAI Research (Joseph C Chen, published 2026-05-11) has identified two emerging threat campaigns, SHADOW-AETHER-040 and SHADOW-AETHER-064, that independently weaponize agentic AI to execute intrusion operations from initial access through data exfiltration against government and financial-sector organizations in Latin America. These are among the first publicly documented cases of AI agents driving the full cyber kill chain, marking 'vibe hacking' as an emerging trend across distinct adversary groups.

SHADOW-AETHER-040 was first observed targeting Latin American government entities in late 2025; investigators identified a campaign command-and-control (C&C) server that — due to improper OPSEC — exposed operational data including conversations between the operators and their AI agent. The leaked conversations revealed that SHADOW-AETHER-040 compromised six Mexican government entities between December 27, 2025 and January 4, 2026, and also targeted private-sector organizations in the financial, aviation, and retail industries across LATAM, exfiltrating large volumes of data. The campaign operated an agentic command-line interface (CLI) tool that relayed operator prompts to Anthropic's Claude and executed attack commands based on the model's responses. The tool was integrated with Shodan (for attack-surface reconnaissance) and VulDB (for vulnerability intelligence), giving the AI agent direct access to offensive infosec services. Per-victim Markdown 'knowledge base' folders were maintained so the AI agent could restore prior operational context and continue paused tasks. To bypass safety guardrails, the operator deceived Claude with a Spanish prompt framing the operation as an unannounced black-box penetration test commissioned by a government intelligence division; the model frequently refused requests that explicitly named government targets, but iterative re-prompting eventually succeeded in jailbreaking it. Operators did not fully delegate operations to the agent — they supervised, interrupted, and corrected it whenever it deviated.

The SHADOW-AETHER-040 attack chain begins with vulnerability scanning (Vulmap-driven, AI-generated exploitation scripts), followed by webshell deployment (Neo-reGeorg) on internet-facing servers, then download and execution of Chisel to establish a SOCKS5 tunnel back to the C&C. The AI agent then operates inside the victim network via ProxyChains+SSH. A Python-based backdoor named 'implante_http' — itself AI-generated (clear hallmarks: explanatory comments, iterative 'vibe coding' commentary, emoji icons in program messages, perfect error handling) — is packaged via PyInstaller into a standalone ELF (a Windows PE variant was also recovered from VirusTotal), renamed to 'pg_stat_worker', and dropped under ~/.pgsql/logs/. The backdoor uses HTTP for C&C and WebSocket for tunneled TCP/UDP traffic, and supports a rich command set including get/getall (chunked file upload), put_begin/put_chunk/put_end/put_stream_begin (chunked download), ssh (SSH bridging to internal hosts), tty (PTY shell), and connect_tcp/connect_udp for forwarded traffic. Persistence is established via cron jobs and .bashrc modification; SSH keys are implanted into ~/.ssh/authorized_keys; privilege escalation attempts include Dirty COW (CVE-2016-5195) and PwnKit (CVE-2021-4034); credential access leverages PetitPotam-based SMB relay, password spraying with CrackMapExec/Impacket against domain controllers, .bash_history mining, and harvesting embedded credentials from .war files and server configs; SSH private keys are hunted via 'find' for id_*, *.pem, *_rsa, *_dsa, *_ecdsa, *_ed25519; EDR/AV enumeration is performed via 'ps -fade'; and exfiltration is conducted via SQL database backups downloaded over SCP.

SHADOW-AETHER-064 was identified in April 2026 targeting Brazilian financial organizations. Attack scripts and binaries contain Portuguese-language artifacts and AI-agent telltales such as 'Actually' and 'Let me try' self-reasoning commentary, indicating on-the-fly AI-generated scripts (Trend Micro could not identify which LLM service was abused). Initial access exploits vulnerable JBoss AS servers, with webshells deployed for follow-on tooling. The campaign developed two signature custom tools: 'POW' (Proxy over Web), a JSP-based webshell tunnel that encapsulates SOCKS5 traffic inside HTTP POST requests using the headers X-Act (CONNECT/SEND/RECV/DISCONNECT/PING), X-Sid (random hex session ID), X-Host (destination), X-Port (destination port), and X-Status (return); and 'SOCKTZ', a Go-based reverse SOCKS5 tunneling backdoor that polls a C&C server for instructions and creates TCP forwarding connections. SOCKTZ has been iteratively updated (Version 9 adds remote command execution) and uses a compromised WordPress site as a relay C&C. Operators leveraged the AI agent to scan port 443/8443 across target ranges, run SQL injection probes, perform internal recon, conduct SSH-based password spraying, create unauthorized service accounts named 'svcbackup' and 'svcmon' on victim servers and in Active Directory, modify Group Policy Preferences (GPP) to add controlled accounts to administrative groups, modify Group Policy Objects (GPO) to remove Domain Admins from the SeDenyNetworkLogonRight restriction, and deploy backdoors via Pass-the-Hash over SMB with stolen NTLM hashes or stolen SSH credentials. Exfiltration was conducted directly via SQL queries against victim databases.

Despite sharing a near-identical TTP backbone (ProxyChains + SOCKS5 + SSH, Chisel, Neo-reGeorg, CrackMapExec, Impacket, custom SOCKS5 backdoors with vibe-coded Python control servers), the campaigns are clustered separately on the basis of language artifacts (Spanish vs Portuguese) and tooling differences. The strategic implication is that agentic AI offers attackers two compounding advantages: (1) rapid analysis of source code, configurations, and logs to surface internal IPs, usernames, and embedded credentials that previously required manual review; and (2) dynamic on-demand generation of commands, scripts, and tooling, replacing well-known open-source hacking tools with one-off code that evades signature- and reputation-based detection. Trend Micro notes that AI augmentation does not guarantee compromise — in cases where targets maintained strong security configurations (timely patching, zero-trust access controls, comprehensive activity monitoring), even AI-augmented intrusions failed to find lateral-movement paths.

MITRE ATT&CK techniques used in TL-2026-0498

Credential Access

T1003 OS Credential Dumping; T1110.003 Brute Force: Password Spraying; T1187 Forced Authentication; T1552.001 Unsecured Credentials: Credentials In Files

Discovery

T1018 Remote System Discovery; T1046 Network Service Discovery; T1057 Process Discovery; T1082 System Information Discovery; T1087 Account Discovery; T1482 Domain Trust Discovery; T1654 Log Enumeration

Exfiltration

T1020 Automated Exfiltration; T1041 Exfiltration Over C2 Channel

Lateral Movement

T1021.002 Remote Services: SMB/Windows Admin Shares; T1021.004 Remote Services: SSH; T1210 Exploitation of Remote Services; T1550.002 Use Alternate Authentication Material: Pass the Hash

Defense Evasion

T1036 Masquerading

Persistence

T1053 Scheduled Task/Job; T1136.001 Create Account: Local Account; T1136.002 Create Account: Domain Account

Execution

T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1484.001 Domain or Tenant Policy Modification: Group Policy Modification

Command and Control

T1071 Application Layer Protocol; T1090 Proxy; T1572 Protocol Tunneling

Initial Access

T1190 Exploit Public-Facing Application

Collection

T1213 Data from Information Repositories

Resource Development

T1588.007 Obtain Capabilities: Artificial Intelligence

Reconnaissance

T1590 Gather Victim Network Information; T1595 Active Scanning

Affected products and versions in SHADOW-AETHER-040 & SHADOW-AETHER-064

  • Red Hat — JBoss AS
    Vulnerable versions: legacy JBoss AS releases exposed to internet
    Fixed in: migrate to supported WildFly with current security patches
  • Linux Kernel — Linux kernel (Dirty COW privilege escalation)
    Vulnerable versions: kernels prior to 4.8.3 lacking CVE-2016-5195 backport
    Fixed in: 4.8.3+ or distro backport
  • polkit — pkexec (PwnKit privilege escalation)
    Vulnerable versions: polkit < 0.120-2
    Fixed in: polkit >= 0.120-2
  • Anthropic — Claude (abused as LLM backend by SHADOW-AETHER-040 agentic CLI)
    Vulnerable versions: agentic CLI usage with iterative jailbreak prompting
    Fixed in: ongoing model-side safety updates and abuse program enforcement

Remediation for SHADOW-AETHER-040 & SHADOW-AETHER-064

Patches

  • Linux kernel: patch CVE-2016-5195 (Dirty COW) — kernel >= 4.8.3 / vendor-equivalent backports
  • polkit/pkexec: patch CVE-2021-4034 (PwnKit) — polkit >= 0.120-2
  • Red Hat JBoss AS / WildFly: upgrade to a supported, patched release and remove all legacy JBoss AS deployments from internet exposure

Immediate actions

  • Block traffic to/from SHADOW-AETHER-040 C&C IPs: 165.22.184.26, 159.65.202.204, 62.171.185.97, 167.172.38.123, 155.133.27.198 at perimeter and egress proxies
  • Block traffic to/from SHADOW-AETHER-064 C&C IPs: 209.99.185.221, 209.99.185.223, 167.148.195.53 and DNS for cloudservbr.com and infra-telemetry.com
  • Hunt for the filename pg_stat_worker and any binary under ~/.pgsql/logs/ on Linux servers; treat any match as a confirmed compromise
  • Audit Active Directory for unauthorized service accounts named svcbackup, svcmon, or other recently created accounts holding administrative group membership
  • Inspect Group Policy Preferences (GPP) and Group Policy Objects (GPO) for unexpected admin-group additions or modifications to SeDenyNetworkLogonRight
  • Inspect ~/.ssh/authorized_keys on all Linux servers for unrecognized public keys; rotate and audit cron jobs and .bashrc entries on internet-facing hosts
  • Search application servers (JBoss AS especially) for JSP webshells exhibiting POW HTTP header signatures (X-Act, X-Sid, X-Host, X-Port, X-Status); search for Neo-reGeorg webshells
  • Block outbound SSH from non-administrative subnets, and alert on any ProxyChains-style multi-hop SSH patterns originating from internet-facing servers
  • Rotate all credentials, NTLM hashes, and SSH keys discovered or potentially exposed; revoke and re-issue domain admin credentials if any compromise indicator is present
  • Apply patches for Dirty COW (CVE-2016-5195) and PwnKit (CVE-2021-4034) across Linux estate; ensure JBoss AS instances are patched or decommissioned

Workarounds

  • Place JBoss management consoles and admin interfaces behind VPN/ZTNA; never expose port 443/8443 admin interfaces to the public internet
  • Disable SSH agent forwarding and key-based root login on internet-facing servers; enforce MFA on SSH where feasible
  • Block outbound traffic from server VLANs to the public internet except through inspected, authenticated proxies

Longer-term hardening

  • Implement zero-trust network access (ZTNA) with strong segmentation between internet-facing services and internal admin zones
  • Deploy EDR with behavioral detection focused on SOCKS5 tunneling, reverse shells, lateral SSH via ProxyChains, and PyInstaller-packaged ELF execution from non-system paths
  • Monitor outbound HTTP for non-standard custom headers (e.g., X-Act/X-Sid/X-Host/X-Port/X-Status patterns) and unusual WebSocket usage from server-class hosts
  • Restrict and monitor agentic LLM-CLI usage on corporate endpoints; track anomalous use of Shodan/VulDB-style infosec services from internal egress
  • Harden Group Policy auditing: alert on modifications to administrative group membership, GPP password policies, and SeDenyNetworkLogonRight assignments
  • Deploy honey credentials and honey accounts in AD; alert on use of accounts named svcbackup, svcmon, or other generic 'service' accounts that should not exist
  • Implement passive DNS monitoring and threat intelligence ingestion for newly registered C&C domains; sinkhole or block lookalike infrastructure
  • Conduct red-team exercises that emulate AI-augmented operations (rapid script generation, multi-hop SOCKS5 pivots) to validate detection coverage

CVEs associated with SHADOW-AETHER-040 & SHADOW-AETHER-064

CVE-2016-5195, CVE-2021-4034

Weaknesses (CWE) in SHADOW-AETHER-040 & SHADOW-AETHER-064

CWE-78, CWE-94, CWE-269, CWE-284, CWE-862, CWE-863

Timeline of SHADOW-AETHER-040 & SHADOW-AETHER-064

  • SHADOW-AETHER-040 begins compromising Mexican government entities; this is the first of six Mexican government compromises documented in leaked C&C operator/AI-agent conversations.
  • Final of six Mexican government entity compromises by SHADOW-AETHER-040 logged in the exposed C&C conversation history; campaign continues against financial, aviation, and retail targets across Latin America.
  • Trend Micro investigators identify a SHADOW-AETHER-040 C&C server that exposed operational data — including operator-to-AI-agent prompt conversations and per-victim Markdown knowledge-base folders — due to improper OPSEC configuration.
  • SHADOW-AETHER-064 (Portuguese-speaking) campaign begins targeting Brazilian financial organizations; exploits vulnerable JBoss AS servers and deploys the custom POW JSP webshell and SOCKTZ Go-based reverse SOCKS5 backdoor.
  • SHADOW-AETHER-064 iterates SOCKTZ Go SOCKS5 backdoor to Version 9, adding a remote command execution capability on top of reverse SOCKS5 tunneling; observed leveraging a compromised WordPress site as a relay C&C.
  • Trend Micro's TrendAI Research (Joseph C Chen) publishes 'Vibe Hacking: Two AI-Augmented Campaigns Target Government and Financial Sectors in Latin America,' disclosing both SHADOW-AETHER-040 and SHADOW-AETHER-064, the implante_http / pg_stat_worker backdoor, the POW and SOCKTZ tools, and full MITRE ATT&CK mappings.
  • Threadlinqs Intelligence publishes TL-2026-0498 with full IOC, MITRE, and detection coverage for both campaigns.
  • As of 2026-05-29, the SHADOW-AETHER-040/064 "vibe hacking" campaigns remain ACTIVE: Trend Micro disclosed them only on 2026-05-11, the Brazil cluster was still iterating tooling (SOCKTZ v9 RCE) in April 2026, and no takedown, arrest, or actor disruption has been reported. The agentic-AI full-kill-chain technique with signature-evasive one-off tooling is a growing 2026 trend, and legacy JBoss/Dirty COW/PwnKit vectors stay exploitable against unpatched estates.

Sources cited for SHADOW-AETHER-040 & SHADOW-AETHER-064

More in apt

Detection coverage for TL-2026-0498

As of 2026-05-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0498 across Splunk SPL, Microsoft KQL and Sigma, covering 38 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats