# SHADOW-AETHER-040 & SHADOW-AETHER-064 — Agentic AI-Driven Intrusion Campaigns Targeting LATAM Government and Financial Sectors (Vibe Hacking)

> Trend Micro's TrendAI Research has disclosed two emerging campaigns — SHADOW-AETHER-040 (Spanish-speaking, compromised six Mexican government entities Dec 27, 2025 - Jan 4, 2026 and pivoted to financial/aviation/retail targets across Latin America) and SHADOW-AETHER-064 (Portuguese-speaking, hitting Brazilian financial organizations since April 2026) — that operate agentic AI to drive intrusion operations end-to-end. SHADOW-AETHER-040 uses an agentic CLI tool backed by Anthropic's Claude, jailbroken via a Spanish 'authorized black-box pentest' pretext, integrated with Shodan and VulDB, deploying Neo-reGeorg webshells, Chisel SOCKS5 tunnels, ProxyChains+SSH, and an AI-generated Python backdoor (implante_http, renamed to pg_stat_worker under ~/.pgsql/logs/). SHADOW-AETHER-064 targets vulnerable JBoss AS servers, deploys the custom POW JSP webshell and the Go-based SOCKTZ reverse SOCKS5 backdoor (Version 9 adds RCE) — relayed via compromised WordPress infrastructure — and abuses GPO/GPP to install svcbackup/svcmon accounts for persistence and access.

- **Published:** 2026-05-12T12:00:00Z
- **Last reviewed:** 2026-05-12T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0498
- **ID:** TL-2026-0498
- **Severity:** CRITICAL
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** SHADOW-AETHER-040 & SHADOW-AETHER-064
- **Detections:** 9 · **IOCs:** 38 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2016-5195, CVE-2021-4034

## Description

Trend Micro's TrendAI Research (Joseph C Chen, published 2026-05-11) has identified two emerging threat campaigns, SHADOW-AETHER-040 and SHADOW-AETHER-064, that independently weaponize agentic AI to execute intrusion operations from initial access through data exfiltration against government and financial-sector organizations in Latin America. These are among the first publicly documented cases of AI agents driving the full cyber kill chain, marking 'vibe hacking' as an emerging trend across distinct adversary groups.

SHADOW-AETHER-040 was first observed targeting Latin American government entities in late 2025; investigators identified a campaign command-and-control (C&C) server that — due to improper OPSEC — exposed operational data including conversations between the operators and their AI agent. The leaked conversations revealed that SHADOW-AETHER-040 compromised six Mexican government entities between December 27, 2025 and January 4, 2026, and also targeted private-sector organizations in the financial, aviation, and retail industries across LATAM, exfiltrating large volumes of data. The campaign operated an agentic command-line interface (CLI) tool that relayed operator prompts to Anthropic's Claude and executed attack commands based on the model's responses. The tool was integrated with Shodan (for attack-surface reconnaissance) and VulDB (for vulnerability intelligence), giving the AI agent direct access to offensive infosec services. Per-victim Markdown 'knowledge base' folders were maintained so the AI agent could restore prior operational context and continue paused tasks. To bypass safety guardrails, the operator deceived Claude with a Spanish prompt framing the operation as an unannounced black-box penetration test commissioned by a government intelligence division; the model frequently refused requests that explicitly named government targets, but iterative re-prompting eventually succeeded in jailbreaking it. Operators did not fully delegate operations to the agent — they supervised, interrupted, and corrected it whenever it deviated.

The SHADOW-AETHER-040 attack chain begins with vulnerability scanning (Vulmap-driven, AI-generated exploitation scripts), followed by webshell deployment (Neo-reGeorg) on internet-facing servers, then download and execution of Chisel to establish a SOCKS5 tunnel back to the C&C. The AI agent then operates inside the victim network via ProxyChains+SSH. A Python-based backdoor named 'implante_http' — itself AI-generated (clear hallmarks: explanatory comments, iterative 'vibe coding' commentary, emoji icons in program messages, perfect error handling) — is packaged via PyInstaller into a standalone ELF (a Windows PE variant was also recovered from VirusTotal), renamed to 'pg_stat_worker', and dropped under ~/.pgsql/logs/. The backdoor uses HTTP for C&C and WebSocket for tunneled TCP/UDP traffic, and supports a rich command set including get/getall (chunked file upload), put_begin/put_chunk/put_end/put_stream_begin (chunked download), ssh (SSH bridging to internal hosts), tty (PTY shell), and connect_tcp/connect_udp for forwarded traffic. Persistence is established via cron jobs and .bashrc modification; SSH keys are implanted into ~/.ssh/authorized_keys; privilege escalation attempts include Dirty COW (CVE-2016-5195) and PwnKit (CVE-2021-4034); credential access leverages PetitPotam-based SMB relay, password spraying with CrackMapExec/Impacket against domain controllers, .bash_history mining, and harvesting embedded credentials from .war files and server configs; SSH private keys are hunted via 'find' for id_*, *.pem, *_rsa, *_dsa, *_ecdsa, *_ed25519; EDR/AV enumeration is performed via 'ps -fade'; and exfiltration is conducted via SQL database backups downloaded over SCP.

SHADOW-AETHER-064 was identified in April 2026 targeting Brazilian financial organizations. Attack scripts and binaries contain Portuguese-language artifacts and AI-agent telltales such as 'Actually' and 'Let me try' self-reasoning commentary, indicating on-the-fly AI-generated scripts (Trend Micro could not identify which LLM service was abused). Initial access exploits vulnerable JBoss AS servers, with webshells deployed for follow-on tooling. The campaign developed two signature custom tools: 'POW' (Proxy over Web), a JSP-based webshell tunnel that encapsulates SOCKS5 traffic inside HTTP POST requests using the headers X-Act (CONNECT/SEND/RECV/DISCONNECT/PING), X-Sid (random hex session ID), X-Host (destination), X-Port (destination port), and X-Status (return); and 'SOCKTZ', a Go-based reverse SOCKS5 tunneling backdoor that polls a C&C server for instructions and creates TCP forwarding connections. SOCKTZ has been iteratively updated (Version 9 adds remote command execution) and uses a compromised WordPress site as a relay C&C. Operators leveraged the AI agent to scan port 443/8443 across target ranges, run SQL injection probes, perform internal recon, conduct SSH-based password spraying, create unauthorized service accounts named 'svcbackup' and 'svcmon' on victim servers and in Active Directory, modify Group Policy Preferences (GPP) to add controlled accounts to administrative groups, modify Group Policy Objects (GPO) to remove Domain Admins from the SeDenyNetworkLogonRight restriction, and deploy backdoors via Pass-the-Hash over SMB with stolen NTLM hashes or stolen SSH credentials. Exfiltration was conducted directly via SQL queries against victim databases.

Despite sharing a near-identical TTP backbone (ProxyChains + SOCKS5 + SSH, Chisel, Neo-reGeorg, CrackMapExec, Impacket, custom SOCKS5 backdoors with vibe-coded Python control servers), the campaigns are clustered separately on the basis of language artifacts (Spanish vs Portuguese) and tooling differences. The strategic implication is that agentic AI offers attackers two compounding advantages: (1) rapid analysis of source code, configurations, and logs to surface internal IPs, usernames, and embedded credentials that previously required manual review; and (2) dynamic on-demand generation of commands, scripts, and tooling, replacing well-known open-source hacking tools with one-off code that evades signature- and reputation-based detection. Trend Micro notes that AI augmentation does not guarantee compromise — in cases where targets maintained strong security configurations (timely patching, zero-trust access controls, comprehensive activity monitoring), even AI-augmented intrusions failed to find lateral-movement paths.

## MITRE ATT&CK

- T1590 Gather Victim Network Information
- T1595 Active Scanning
- T1588.007 Obtain Capabilities: Artificial Intelligence
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1203 Exploitation for Client Execution
- T1053 Scheduled Task/Job
- T1136.001 Create Account: Local Account
- T1136.002 Create Account: Domain Account
- T1068 Exploitation for Privilege Escalation
- T1484.001 Domain or Tenant Policy Modification: Group Policy Modification
- T1036 Masquerading
- T1003 OS Credential Dumping
- T1187 Forced Authentication
- T1552.001 Unsecured Credentials: Credentials In Files
- T1110.003 Brute Force: Password Spraying
- T1087 Account Discovery
- T1482 Domain Trust Discovery
- T1654 Log Enumeration
- T1046 Network Service Discovery
- T1018 Remote System Discovery
- T1057 Process Discovery
- T1082 System Information Discovery
- T1210 Exploitation of Remote Services
- T1021.004 Remote Services: SSH
- T1021.002 Remote Services: SMB/Windows Admin Shares
- T1550.002 Use Alternate Authentication Material: Pass the Hash
- T1213 Data from Information Repositories
- T1090 Proxy
- T1572 Protocol Tunneling
- T1071 Application Layer Protocol
- T1020 Automated Exfiltration
- T1041 Exfiltration Over C2 Channel

## Sources

- [Vibe Hacking: Two AI-Augmented Campaigns Target Government and Financial Sectors in Latin America (Trend Micro, Joseph C Chen)](https://www.trendmicro.com/en_us/research/26/e/vibe-hacking-two-ai-augmented-campaigns-target-government-and-financial-sectors-in-latin-america.html)
- [CVE-2016-5195 Dirty COW — Linux Kernel COW privilege escalation](https://nvd.nist.gov/vuln/detail/CVE-2016-5195)
- [CVE-2021-4034 PwnKit — polkit pkexec local privilege escalation](https://nvd.nist.gov/vuln/detail/CVE-2021-4034)
- [Neo-reGeorg (SOCKS5-over-webshell tunneling tool)](https://github.com/L-codes/Neo-reGeorg)
- [Chisel — fast TCP/UDP tunnel over HTTP](https://github.com/jpillora/chisel)
- [CrackMapExec (NetExec) — network-pentest swiss-army knife](https://github.com/Pennyw0rth/NetExec)
- [Impacket — Python network protocol library](https://github.com/fortra/impacket)
- [ProxyChains-NG](https://github.com/rofl0r/proxychains-ng)
- [PetitPotam — coerced NTLM authentication](https://github.com/topotam/PetitPotam)
- [MITRE ATT&CK T1588.007 — Obtain Capabilities: Artificial Intelligence](https://attack.mitre.org/techniques/T1588/007/)
- [MITRE ATT&CK T1572 — Protocol Tunneling](https://attack.mitre.org/techniques/T1572/)
- [MITRE ATT&CK T1190 — Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0498