May 11, 2026
TrendAI Research reports two Latin American intrusion campaigns that ran much of their attack work through AI agents
TrendAI Research (Trend Micro) reports two campaigns, SHADOW-AETHER-040 and SHADOW-AETHER-064, that used AI agents in intrusions against government and financial organizations in Latin America. For SHADOW-AETHER-040, operator–agent conversations exposed on a misconfigured command-and-control server show the actor directing an agentic command-line tool backed by Anthropic's Claude through tunnels into victim networks, including compromises of six Mexican government entities between 2025-12-27 and 2026-01-04. For SHADOW-AETHER-064, which targeted Brazilian financial organizations and which TrendAI identified in April 2026, TrendAI infers agent use from reasoning-style text left in attack scripts and could not identify the model.