SHADOW-AETHER-015
- Primary motivation
- financial-gain
- Sophistication
- advanced
- Resource level
- organization
- Actor type
- criminal
- Profile updated
- 2026-07-07 12:26:38
Targeted industries: financial-services government-and-public-sector technology-and-telecommunications healthcare-and-pharmaceutical professional-services
Targeted regions: country_code:us country_code:gb country_code:au country_code:ca
Context
SHADOW-AETHER-015 is a highly adaptable cybercriminal group known for identity abuse and cloud compromise, primarily targeting identity and access management systems like Okta and Azure AD/Entra ID. They employ sophisticated social engineering techniques, including vishing and help-desk impersonation, to gain access to legitimate credentials. Their operations involve multi-pressure extortion tactics, such as data theft, ransomware, and employee intimidation, while leveraging MFA fatigue and token theft to bypass authentication controls. The group has been linked to the "0ktapus" phishing campaign and is most active in English-speaking countries, with a focus on sectors rich in sensitive data.
Reports & references
- Trend Micro — Shadow Aether 015 Earth Preta Mitre (report)