SHADOW-AETHER-015

Also known as ShinyHunters

Reports

First seen

Jan 13

Last seen

Jun 18

Motivation

Financial crime, extortion, data theft, , data exfiltration, extortion

Targeting

Sectors

education ×2

Victim regions

United States ×1

Top ATT&CK techniques

T1190 Exploit Public-Facing Application ×2T1199 Trusted Relationship ×1T1570 Lateral Tool Transfer ×1T1110.004 Brute Force: Credential Stuffing ×1T1021.004 Remote Services: SSH ×1T1528 Steal Application Access Token ×1T1078 Valid Accounts ×1T1041 Exfiltration Over C2 Channel ×1T1555 Credentials from Password Stores ×1T1598 Phishing for Information ×1T1021.001 Remote Services: Remote Desktop Protocol ×1T1036 Masquerading ×1

Indicators

cve ×1

Indicator values are available on Pro and via the API.

Associated CVEs

CVE-2026-35273 (exploited)

Recent reports

Critical

PeopleSoft PeopleTools Pre-Authentication RCE via PSIGW SSRF and XMLDecoder Deserialization

Trend Micro ResearchJun 18 Critical

Instructure Canvas Breach: 8,809 Institutions Exposed Globally via Backend Compromise

Trend Micro ResearchMay 10 Info

Key Insights on SHADOW-AETHER-015 and Earth Preta from 2025 MITRE ATT&CK Evaluation

Trend Micro ResearchJan 13

This page shows data on a 7-day delay. Free accounts get the full delayed feed; real-time reports, indicators, and the API start at $29/mo.