ThreatsDay Bulletin: Linux Rootkits, Router 0-Day, AI Intrusions, Scam Kits and 25 New Stories

A token leak, a malicious package, a login trick, and a resurfaced old tool illustrate how small failures can combine into a larger intrusion pattern. Two campaigns, SHADOW-AETHER-040 and SHADOW-AETHER-064, use agentic AI with similar tactics to target governments and financial organizations in Latin America. The campaigns establish traffic tunnels to victim systems and use ProxyChains and SSH to let AI agents operate inside internal network environments. AI agents dynamically generate multiple hacking tools and scripts instead of relying on known, pre-built tools, reducing detection by signature-based security controls. The attackers bypass AI safety controls by presenting requests as authorized penetration testing and red teaming. SHADOW-AETHER-040 compromised six Mexican government entities between late December 2025 and early January 2026.

"Two emerging campaigns, dubbed SHADOW-AETHER-040 and SHADOW-AETHER-064, have independently deployed agentic AI with "strikingly similar tactics" to facilitate intrusion operations against governments and financial organizations in Latin America. "Both campaigns established traffic tunnels to victim systems, enabling AI agents to conduct malicious attacks directly into victim internal network environments via ProxyChains and SSH," Trend Micro said."

""The AI agents dynamically generated multiple hacking tools and scripts, rather than relying on pre-built hacking tools. This reduced the likelihood of detection by traditional security solutions that rely on known tool signatures." The two activity clusters are said to be the work of separate entities."

"The attackers bypassed AI safety controls by framing their requests as authorized penetration testing and red teaming exercises. Undertaken by a Spanish-speaking threat actor, SHADOW-AETHER-040 has compromised six government entities in Mexico between December 27, 2025, and January 4, 2026."

"At first, it feels like the usual mess. Then you see the pattern: attackers are not always breaking in. They are using the parts we already trust. That is what makes it worrying. The danger is in normal things now - updates, apps, cloud buttons, support chats, trusted accounts."

Read at The Hacker News