AI-Augmented Campaigns Target Government and Financial Organizations in Latin America
Summary
Trend Micro details two campaigns using agentic AI to support intrusions against government and financial organizations in Latin America, including reconnaissance, lateral movement, backdoor deployment, and data exfiltration.
Key points
- SHADOW-AETHER-040 targeted government and private-sector organizations in Latin America from late 2025; exposed command-and-control data revealed its operations and AI-agent conversations.
- SHADOW-AETHER-064 targeted Brazilian financial organizations from April 2026 and sought to exfiltrate financial data.
- Both campaigns used webshells, SOCKS5 tunnels, ProxyChains, and SSH to operate within victims’ internal networks; their operators appear distinct, with Spanish- and Portuguese-language artifacts respectively.
- AI agents helped generate scripts and commands, inspect configurations and logs for credentials, scan networks, move laterally, and exfiltrate data.
- SHADOW-AETHER-040 deployed the Python backdoor implante_http; SHADOW-AETHER-064 used custom tunneling tools including POW and SOCKTZ.
- The researchers observed cases where strong security configurations prevented further attacker progress; they recommend timely patching, zero-trust access controls, and comprehensive monitoring.
Article Details
- Attack Vectors
- SHADOW-AETHER-040 exploited vulnerabilities on targeted servers and deployed webshells, including Neo-reGeorg, for initial access.
- SHADOW-AETHER-064 compromised vulnerable JBoss AS servers and deployed webshells.
- Both campaigns used SOCKS5 tunnels, ProxyChains, and SSH to operate against systems inside victim networks.
- Reported activity included internal network scanning, password spraying, credential collection, privilege escalation, and data exfiltration.
- SHADOW-AETHER-064 created unauthorized service accounts and modified Group Policy settings to expand access.
- Both campaigns used agentic AI to assist intrusion tasks and generate scripts or tools during operations.
- Defensive Notes
- Apply timely security patches and maintain strong security configurations to reduce exploitable vulnerabilities and misconfigurations.
- Implement zero-trust access controls and comprehensively monitor environmental activity.
- Trend Micro notes that strong security configurations prevented further compromise in some observed cases.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | cloudservbr[.]com | Domain listed for C&C communications associated with SHADOW-AETHER-064. |
| DOMAIN | infra-telemetry[.]com | Domain listed for C&C communications associated with SHADOW-AETHER-064. |
| IPV4 | 155[.]133[.]27[.]198 | C&C server address associated with SHADOW-AETHER-040. |
| IPV4 | 159[.]65[.]202[.]204 | C&C server address associated with SHADOW-AETHER-040. |
| IPV4 | 165[.]22[.]184[.]26 | C&C server address associated with SHADOW-AETHER-040. |
| IPV4 | 167[.]148[.]195[.]53 | C&C server address associated with SHADOW-AETHER-064. |
| IPV4 | 167[.]172[.]38[.]123 | C&C server address associated with SHADOW-AETHER-040. |
| IPV4 | 209[.]99[.]185[.]221 | C&C server address associated with SHADOW-AETHER-064. |
| IPV4 | 209[.]99[.]185[.]223 | C&C server address associated with SHADOW-AETHER-064. |
| IPV4 | 62[.]171[.]185[.]97 | C&C server address associated with SHADOW-AETHER-040. |
MITRE ATT&CK
T1003 · OS Credential DumpingListed in the report's SHADOW-AETHER-040 ATT&CK mapping; the article does not detail a specific credential-dumping procedure for this mapping.T1018 · Remote System DiscoveryThe campaigns scanned internal networks to identify systems for further operations.T1020 · Automated ExfiltrationThe implante_http backdoor supported automated uploads, including uploading all files in a directory.T1021.002 · SMB/Windows Admin SharesSHADOW-AETHER-064 used SMB with stolen NTLM hashes to deploy a backdoor.T1021.004 · SSHThe campaigns used SSH through SOCKS5 tunnels to operate on internal systems.T1036 · MasqueradingSHADOW-AETHER-040 renamed a backdoor binary to pg_stat_worker.T1041 · Exfiltration Over C2 ChannelThe implante_http backdoor uploaded files to the C&C server, including large files in chunks.T1046 · Network Service DiscoveryThe campaigns generated scripts to scan internal networks and identify exposed services.T1053 · Scheduled Task/JobSHADOW-AETHER-040 created cron jobs to maintain backdoor persistence.T1057 · Process DiscoverySHADOW-AETHER-040 ran ps -fade to inspect processes and identify possible EDR or antivirus services.T1059 · Command and Scripting InterpreterThe campaigns used AI-assisted commands and generated shell scripts to perform attack tasks.T1068 · Exploitation for Privilege EscalationSHADOW-AETHER-040 attempted privilege escalation by exploiting vulnerabilities including Dirty COW and PwnKit.T1071 · Application Layer ProtocolThe implante_http backdoor used HTTP for C&C communication and WebSocket to relay traffic.T1082 · System Information DiscoveryListed in the report's SHADOW-AETHER-040 ATT&CK mapping; no specific system-information discovery command is described.T1087 · Account DiscoveryListed in the report's SHADOW-AETHER-040 ATT&CK mapping; no more specific account-discovery activity is described.T1090 · ProxyBoth campaigns used ProxyChains and SOCKS5 tunnels to route operations through compromised systems.T1110.003 · Password SprayingThe campaigns used collected credentials for password spraying against domain controllers or over SSH.T1136.001 · Local AccountSHADOW-AETHER-064 created unauthorized service accounts on victim servers, including svcbackup or svcmon.T1136.002 · Domain AccountSHADOW-AETHER-064 created unauthorized accounts in the victim Active Directory environment.T1187 · Forced AuthenticationSHADOW-AETHER-040 performed an SMB Relay attack using PetitPotam.T1190 · Exploit Public-Facing ApplicationSHADOW-AETHER-040 scanned for vulnerabilities on targeted servers and deployed webshells for initial access.T1203 · Exploitation for Client ExecutionListed in the report's SHADOW-AETHER-040 ATT&CK mapping; no specific client-side exploitation instance is detailed.T1210 · Exploitation of Remote ServicesSHADOW-AETHER-040 exploited identified vulnerabilities during its operations; the report lists exploitation of remote services in its mapping.T1213 · Data from Information RepositoriesThe campaigns queried victim databases to find sensitive information and credentials.T1482 · Domain Trust DiscoveryListed in the report's SHADOW-AETHER-040 ATT&CK mapping; no specific domain-trust discovery activity is described.T1484.001 · Group Policy ModificationSHADOW-AETHER-064 modified Group Policy Preferences and Group Policy Objects to grant access and remove restrictions.T1550.002 · Pass the HashSHADOW-AETHER-064 used stolen NTLM hashes to perform Pass-the-Hash over SMB.T1552.001 · Credentials In FilesThe AI agent searched server configuration files and application code for embedded credentials.T1572 · Protocol TunnelingThe campaigns used Chisel and custom tools to establish traffic tunnels into victim networks.T1588.007 · Artificial IntelligenceThe report lists AI capabilities among SHADOW-AETHER-040's ATT&CK techniques; the campaign used an agentic AI tool with Claude.T1590 · Gather Victim Network InformationSHADOW-AETHER-040 used Shodan to identify targeted organizations' attack surfaces.T1595 · Active ScanningSHADOW-AETHER-064 scanned ports 443 and 8443 across target network ranges.T1654 · Log EnumerationSHADOW-AETHER-040 inspected shell history and logs while investigating compromised servers.
People
Threat Actors
SHADOW-AETHER-040Campaign tracked by Trend Micro; operators were observed to be Spanish-speaking and targeted government and other organizations in Latin America.SHADOW-AETHER-064Campaign tracked by Trend Micro; Portuguese-language artifacts suggested Portuguese-speaking operators, and the campaign targeted financial organizations in Brazil.
Malware
Vendors
Products
Active DirectoryCreated unauthorized service accounts, specifically identified as svcbackup or svcmon, within both victim servers and the Active Directory environment.ClaudeThe CLI tool sent the attacker's prompts to a large language model (LLM) service, Anthropic's Claude in this case, and executed attack commands based on the AI model's responses.JBoss ASIn the cases we observed, SHADOW-AETHER-064 targeted vulnerable JBoss AS servers, successfully compromised them, and deployed webshells.TrendAI Vision OneTrendAI Vision One™ customers are protected from the IoCs listed in the table below.WordPressThe SOCKTZ backdoor used a compromised WordPress site to relay C&C
Tools
ChiselDespite sharing tools and tactics, including Chisel, Neo-reGeorg, CrackMapExec, and Impacket, SHADOW-AETHER-040 and SHADOW-AETHER-064 appear to be distinct groups, separated primarily by language: Spanish and PortugueseCrackMapExecDespite sharing tools and tactics, including Chisel, Neo-reGeorg, CrackMapExec, and Impacket, SHADOW-AETHER-040 and SHADOW-AETHER-064 appear to be distinct groups, separated primarily by language: Spanish and PortugueseImpacketDespite sharing tools and tactics, including Chisel, Neo-reGeorg, CrackMapExec, and Impacket, SHADOW-AETHER-040 and SHADOW-AETHER-064 appear to be distinct groups, separated primarily by language: Spanish and PortugueseNeo-reGeorgDespite sharing tools and tactics, including Chisel, Neo-reGeorg, CrackMapExec, and Impacket, SHADOW-AETHER-040 and SHADOW-AETHER-064 appear to be distinct groups, separated primarily by language: Spanish and PortuguesePetitPotamPerformed an SMB Relay attack using PetitPotam.POWThe first tool, referred to as “POW” (likely an abbreviation for “Proxy over Web”), enabled the actor to forward SOCKS5 traffic from C&C servers into the internal network by encapsulating the malicious traffic withinproxychainsBoth campaigns established traffic tunnels to victim systems, enabling AI agent to conduct malicious attacks directly into victim internal network environments via ProxyChains and SSH.PyInstallerThe threat actor instructed the AI agent to package this Python backdoor using PyInstaller into a standalone ELF binary and deploy it to victim servers.ShodanBesides the use of the foundational AI model, SHADOW-AETHER-040 enabled their AI agent to access other infosec services, such as Shodan and VulDB.SOCKTZThe second tool, “SOCKTZ, “ is a reverse SOCKS5 tunneling tool written in Go.VulDBBesides the use of the foundational AI model, SHADOW-AETHER-040 enabled their AI agent to access other infosec services, such as Shodan and VulDB.VulmapGenerated exploitation scripts to execute commands based on the vulnerabilities identified by Vulmap.
Countries
BrazilMeanwhile, since this April, we identified another threat campaign targeting financial organizations in Brazil that also employed agentic AI to conduct attacks.MexicoAccording to the leaked conversations, SHADOW-AETHER-040 compromised six government entities in Mexico between December 27, 2025, and January 4, 2026.
Industries
AviationPrimary targets were government entities but also private-sector organizations in the financial, aviation, and retail industries.financialVibe Hacking: Two AI-Augmented Campaigns Target Government and Financial Sectors in Latin AmericaGovernmentVibe Hacking: Two AI-Augmented Campaigns Target Government and Financial Sectors in Latin AmericaRetailPrimary targets were government entities but also private-sector organizations in the financial, aviation, and retail industries.