TrendAI Research (Trend Micro) reports two campaigns, SHADOW-AETHER-040 and SHADOW-AETHER-064, that used AI agents in intrusions against government and financial organizations in Latin America. For SHADOW-AETHER-040, operator–agent conversations exposed on a misconfigured command-and-control server show the actor directing an agentic command-line tool backed by Anthropic's Claude through tunnels into victim networks, including compromises of six Mexican government entities between 2025-12-27 and 2026-01-04. For SHADOW-AETHER-064, which targeted Brazilian financial organizations and which TrendAI identified in April 2026, TrendAI infers agent use from reasoning-style text left in attack scripts and could not identify the model.
It adds a security vendor's account, drawn partly from leaked attacker logs rather than a model provider's own platform data, of agent-driven intrusions by two groups using similar methods, one documented as closely supervised.
Key facts
As stated in the sources, with where to find them.
- TrendAI says data exposed through poor operational security on a SHADOW-AETHER-040 command-and-control server included the actor's conversations with its AI agent. According to those conversations, the group compromised six government entities in Mexico between December 27, 2025 and January 4, 2026, in some cases stealing targeted data. TrendAI describes the two campaigns as among the first cases it has observed of AI agents executing attacks from initial access to data exfiltration.Introduction; The first campaign
- TrendAI says earlier public reporting on a group that compromised Mexican government entities with an AI agent matched SHADOW-AETHER-040, and that indicators of compromise in a subsequent, more detailed report let it confirm they are the same group. TrendAI’s page does not name those reports, and this record does not cite them.The first campaign
- TrendAI reports that the model often refused when a prompt identified the target as a government entity, and that the actor got past its safeguards after repeated attempts by framing the work as an authorized, unannounced red-team test.The AI agent-augmented attacks of SHADOW-AETHER-040
- TrendAI says SHADOW-AETHER-040 did not fully delegate operations: the operator used the agent as an assistant and interrupted and corrected it when it strayed. Delegated tasks it lists include tunneling, persistence, credential collection, internal network scanning, privilege-escalation attempts, password spraying and database exfiltration. The agent also had access to Shodan and VulDB, and kept per-victim Markdown notes so it could restore context and resume unfinished work.The AI agent-augmented attacks of SHADOW-AETHER-040; Table 1
- SHADOW-AETHER-064 compromised vulnerable JBoss application servers at Brazilian financial organizations and, per TrendAI, used the agent for scanning, SQL injection testing, credential gathering, rogue account creation, Group Policy changes, lateral movement and database exfiltration. TrendAI infers agent use from self-reasoning text in on-the-fly scripts and could not identify which LLM service was used.Another emerging campaign: SHADOW-AETHER-064; Table 3
- TrendAI assesses that a Python backdoor deployed by SHADOW-AETHER-040, and the server-side controllers of SHADOW-AETHER-064's tunneling tools, were likely written with AI assistance. This rests on code-style indicators such as explanatory comments, emoji in program messages and signs of iterative edits, not on observed generation.AI-generated backdoor; Another emerging campaign: SHADOW-AETHER-064
- TrendAI treats the campaigns as distinct groups, separated mainly by language (Spanish for SHADOW-AETHER-040, Portuguese for SHADOW-AETHER-064), despite shared public tools such as Chisel, Neo-reGeorg, CrackMapExec and Impacket and the same tunneling approach. It says the true relationship is unknown and the overlap may be coincidental.Key takeaways; The second campaign
- TrendAI reports cases in which the actors failed despite the agent because it found no feasible path for lateral movement in well-configured environments. The report gives no victim count for SHADOW-AETHER-064 and no count of failed attempts.Conclusion
Findings that cite this record
Key questions this bears on
- How are attackers using AI agents in real operations?To run parts of intrusions at scale: vendors report a state-aligned actor and criminal groups using open-source agent frameworks and commercial models.