CyberXero: 628,000 Ukrainian Records Stolen in AI-Augmented Campaign Using Claude Code

Researchers at SOCRadar have disclosed a two-pronged, AI-augmented initial access campaign attributed to a Russian-speaking, financially motivated initial access broker codenamed CyberXero, which has exfiltrated more than 628,000 records tied to Ukrainian individuals from four confirmed victim organizations, according to a report covered by The Hacker News on October 12, 2026. The operation pairs commodity offensive tooling, including Cobalt Strike, with an AI orchestration layer built on Anthropic's Claude Code, and it targets WordPress sites, e-commerce platforms, and Ukrainian critical infrastructure. According to SOCRadar, whose researchers produced the underlying report, the actor has been active since at least July 2026 and the campaign remains ongoing.

What was the specific vulnerability?

The campaign did not rely on a single novel flaw: it chained known vulnerabilities in WordPress and e-commerce software, plus exposed Redis servers, across two parallel attack pipelines. According to The Hacker News, the global, automated pipeline exploits wp2shell, tracked as CVE-2026-63030 and CVE-2026-60137, and CVE-2026-4815, an SQL injection vulnerability in the Support Board WordPress plugin. The second, curated pipeline conducts deep reconnaissance and manual exploitation against Ukrainian energy and utilities, including a heating provider in Kharkiv. SOCRadar describes the split this way: "The operation runs two pipelines at once: a global, automated campaign against WordPress and e-commerce platforms, and a curated, manual campaign against Ukrainian energy and critical infrastructure." Because the exploited flaws are known CVEs rather than zero-days, remediation is a patching and hardening problem for defenders rather than a vendor emergency response. The scale of the automated arm is documented in the leaked logs: a single automated execution scanned 4,708 targets, confirmed access to 429 WordPress admin panels, and deployed 32 web shells in a 61-second window, per the figures reported by The Hacker News.

How was the incident detected?

The operation came to light through an exposed open directory on the attacker's own server, discovered by SOCRadar. The directory, hosted at 46.21.250[.]135, leaked the threat actor's live working directory from a Linux workstation, containing AI session logs, scripts with plaintext tokens, exploitation toolkits, reconnaissance output, AI agent configurations, and exfiltrated victim data. Per The Hacker News, SOCRadar published its report last week, and the outlet covered the disclosure on October 12, 2026. The leaked session logs are what allowed researchers to reconstruct how AI was deployed in two stages. First, Claude Code ran a cluster of 51 specialized agents for scanning, exploit chaining, reconnaissance, and post-exploitation on the attacker's primary workstation. Second, PentAGI, an open-source autonomous pentesting agent, was connected to Cobalt Strike through an AI provider API for payload generation. According to SOCRadar, the attack architecture spans 8 distinct infrastructure nodes, and the plaintext tokens left in the leaked scripts gave researchers direct evidence of how the AI components were wired into the operator's tooling.

What is the current impact?

The confirmed impact is the exfiltration of more than 628,000 records tied to Ukrainian individuals from four organizations, with additional confirmed compromises in three other countries. According to The Hacker News, confirmed compromises also occurred in Poland, China, and the Netherlands, including two Chinese entities breached through exposed Redis servers. Targets span Ukrainian energy and critical infrastructure, notably the Kharkiv heating provider, alongside WordPress and e-commerce platforms worldwide. SOCRadar assesses that the campaign is ongoing and not fully remediated, meaning victim identification may not yet be complete. The exposure of the attacker's working directory adds a secondary concern: the leaked material included exfiltrated victim data, so records stolen from victims were themselves sitting on an unsecured server. As an initial access broker, CyberXero's typical business model is to sell access to compromised networks rather than monetize them directly, which SOCRadar presents as the reason the operation concentrates on breadth of access across many targets rather than depth inside any single one.

What are the next steps?

Defenders running WordPress, Magento, or PrestaShop, or exposing Redis to the internet, are advised to check for rogue WordPress administrators, WSO web shells, and unexpected entries in ~/.ssh/authorized_keys on Redis hosts. SOCRadar's guidance, as reported by The Hacker News, centers on patching the exploited flaws: wp2shell, tracked as CVE-2026-63030 and CVE-2026-60137, and the Support Board plugin SQL injection, CVE-2026-4815, plus locking down internet-facing Redis instances. The disclosure also carries a lesson for AI vendors and defenders alike. The logs show the actor used context-engineering and session-reset techniques to bypass model refusals, instructing the agent it was running an "authorized pentest on my own infrastructure." SOCRadar notes: "When an agent refused a task, the actor reopened a fresh session, with the authorization framing preloaded and tried again." The same logs, however, record genuine refusals that held: across four iterations the model declined to install a backdoor, disable a firewall, move laterally, and deploy a web shell, and in a separate episode it refused a scan four consecutive times and correctly rejected a forged ownership token. For security teams, the practical takeaway from SOCRadar is that AI-assisted operations lower the labor cost of large-scale scanning and exploit chaining, so exposure of known-vulnerable components is now exploitable at industrial speed, and inventory and patching cycles need to account for that.

By the numbers