Key Insights on SHADOW-AETHER-015 and Earth Preta from the 2025 MITRE ATT&CK Evaluation with Trend Vision One™

Trend Research™ highlights from the 2025 MITRE ATT&CK Evaluation show SHADOW-AETHER-015 and Earth Preta testing Trend Vision One™ in ER7, with the blog noting that Demeter and Hermes emulations reveal sophisticated cloud and phishing-based attack chains.

In Scenario 1, Demeter, inspired by SHADOW-AETHER-015, demonstrates how attackers can pivot from compromised endpoints into cloud infrastructure, using stolen credentials and tokens to persist, move laterally across hybrid environments, and exfiltrate data at scale. Scenario 2, Hermes, based on Earth Preta, centres on phishing-led initial access, with loaders and anti-analysis techniques enabling lateral movement, credential harvesting, and data exfiltration before careful cleanup to reduce forensic traces.

The piece states that Trend Vision One™ detects and blocks IoCs related to the threat actors discussed, and that TrendAI™ provides hunting queries and intelligence reports to aid proactive defence, while MITRE ATT&CK Evaluations offer a benchmark to identify gaps and improve detection and response.

Earth Preta is described as a China-based APT active since at least 2012, focused on political and military intelligence with activity concentrated in Asia and Southeast Asia but extending to Europe and beyond, and SHADOW-AETHER-015 is pictured as an English-language social‑engineering‑driven group targeting identity and access management systems to move laterally in SaaS and cloud environments.

The article also notes a timeline of Earth Preta’s developments, including USB-based propagation and air-gapped intrusion capabilities in 2025 via SnakeDisk and ToneShell, and underscores Trend Vision One’s role in mapping detection coverage across major attack steps and cloud layers.