CyberXero Wields Claude Code to Steal Over 628,000 Ukrainian Records

Researchers at SOCRadar have detailed an AI-augmented initial-access campaign aimed at WordPress sites, e-commerce platforms, and critical infrastructure in Ukraine. The activity is attributed to a Russian-speaking, financially motivated access broker codenamed CyberXero, assessed to have been active since at least July 2026.

Two parallel pipelines

The operation ran along two tracks at once. The first was global and automated: mass attacks on WordPress and online-commerce platforms through known flaws, including wp2shell (CVE-2026-63030 and CVE-2026-60137) and the SQL injection CVE-2026-4815 in the Support Board plugin. The second was manual and selective: deep reconnaissance and hands-on exploitation against Ukrainian energy and utilities, including a heating provider in Kharkiv.

Data theft was confirmed at four Ukrainian organizations, yielding more than 628,000 records tied to Ukrainian individuals. Victims were also confirmed in Poland, China, and the Netherlands. The campaign remains ongoing.

SOCRadar found the operators via an exposed open directory on 46.21.250[.]135, which leaked the attacker's working directory from a Linux workstation: AI session logs, scripts with plaintext tokens, exploitation toolkits, recon output, and exfiltrated victim data. One automated run, the logs show, scanned 4,708 targets, confirmed access to 429 WordPress admin panels, and deployed 32 web shells in a 61-second window.

AI at two stages

CyberXero used AI twice. On the primary workstation, Claude Code ran with a cluster of 51 specialized agents for scanning, exploit chaining, reconnaissance, and post-exploitation. Separately, PentAGI — an open-source, self-hosted autonomous pentest agent — was wired into Cobalt Strike through a provider API for payload generation.

To get past refusals, the operator leaned on context engineering and session resets, telling the agent it was running an "authorized pentest on my own infrastructure." As SOCRadar notes, safety controls act on session context rather than model weights, so a refusal in one session does not carry into the next.

Tellingly, the logs also record refusals that held. Across four iterations the model declined to install a backdoor, disable a firewall, move laterally, and deploy a web shell; in another episode it refused a scan four times running and correctly rejected a forged ownership token.

The campaign also hit exposed Redis servers, breaching two Chinese entities through them. Operators of WordPress, Magento, and PrestaShop, and anyone exposing Redis to the internet, are advised to check for rogue administrators, WSO web shells, and unexpected entries in ~/.ssh/authorized_keys.

Source: The Hacker News