SHADOW-AETHER-015Threat actor
SHADOW-AETHER-015 is a highly adaptable cybercriminal group known for identity abuse and cloud compromise, primarily targeting identity and access management systems like Okta and Azure AD/Entra ID. They employ sophisticated social engineering techniques, including vishing and help-desk impersonation, to gain access to legitimate credentials.From MISP Galaxy
Last reported 4 months ago, by Trend Micro Research3 reports
ATT&CK techniques
6 techniques · each with the sentence it comes from- T1684Social Engineering
“…or a particular group of activities with modern TTPs characterized by AI-generated attacks, sophisticated phishing attacks, and/or social engineering).”
- T1053.005Scheduled Task
“Persistence is then established through registry run keys and scheduled tasks to maintain access.”
- T1187Forced Authentication
“T1187”
- T1190Exploit Public-Facing Application
“T1190”
- T1505Server Software Component
“Server software component: web shell”
- T1505.003Web Shell
“T1505.003”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
3 reports, newest first · the exact sentence from each-
PeopleSoft PeopleTools Pre-Authentication RCE: A PSIGW SSRF Chain That Executes Inside the JVM“One day later, Mandiant published a report attributing in-the-wild exploitation to SHADOW-AETHER-015 (ShinyHunters), documenting a campaign that ran from May 27 through June 9, 2026, two weeks before the vendor advisory and targeted over 100 organizations, predominantly in higher…”
-
What Is the Instructure Canvas Breach? Impact, Risks, and What Institutions Should Do“In May 2026, SHADOW-AETHER-015 exposed data from 8,809 Canvas customers across 50 countries in what appears to be a backend compromise of parent company Instructure’s platform.”
-
Key Insights on SHADOW-AETHER-015 and Earth Preta from the 2025 MITRE ATT&CK Evaluation with TrendAI Vision One™“Key Insights on SHADOW-AETHER-015 and Earth Preta from the 2025 MITRE ATT&CK Evaluation with TrendAI Vision One™”
Thanks — we review every report.