Vibe Hacking: Two AI-Augmented Campaigns Target Government and Financial Sectors in Latin America
Trend Micro (US), Monday, May 11th, 2026
Two threat campaigns use agentic AI to conduct intrusion operations against government and financial organizations in Latin America.
Trend Micro's TrendAI Research identified two emerging threat campaigns, SHADOW-AETHER-040 and SHADOW-AETHER-064, that leverage agentic AI to drive intrusion operations against government and financial organizations in Latin America. Both campaigns independently deployed similar tactics, including establishing traffic tunnels via ProxyChains and SSH, dynamically generating hacking tools and scripts to evade detection, and exfiltrating large volumes of data.
Although the campaigns share overlapping tools and techniques such as Chisel, Neo-reGeorg, and CrackMapExec, evidence suggests they are distinct groups separated primarily by language-Spanish and Portuguese respectively.