SOCRadar: CyberXero used 51 Claude Code agents in a campaign that stole 628,000 Ukrainian records

What is CyberXero?

SOCRadar’s Threat Research Unit published “CyberXero: An AI-Augmented Initial Access Broker Targeting Ukrainian Critical Infrastructure” on 6 October 2026. The Hacker News covered the same findings on 12 October. SOCRadar says the alias appears on Dread, HackForums and Exploit.in, that the operator works mainly in Russian on Moscow time, and that infrastructure first appeared in July 2026.

What sets the case apart, in SOCRadar’s account, is architecture. Commodity tools such as Cobalt Strike, Impacket and Mimikatz sit behind an AI orchestration layer that lets one person run campaigns at a scale that would usually need a team. The public blog is a summary; a longer PDF holds the node-by-node walkthrough, Chinese-cluster Cobalt Strike detail and the full indicator set.

The timing matters because labs are already under pressure over agent misuse. We have covered Anthropic’s Cyber Mission for critical infrastructure and its three-tier Cyber Verification Program. CyberXero is a different kind of story: not a lab evaluation, but an alleged live criminal use of a commercial coding agent.

How was the operation found?

The break was an open directory. An HTTP server at 46.21.250.135, on Zomro in the Netherlands, served the working directory of a Linux workstation with no access control: more than 90,000 files across 3,000 folders, including engagement folders named after targets, exploitation toolkits, AI agent configurations, session logs and exported victim databases. SOCRadar calls that an OPSEC failure operators rarely make.

From that seed, a provisioning token in installation URLs, an internal hostname in an SSH key and staging logs tied eight nodes together across three ASNs and two regions: European workstations, a provisioning server and a cryptocurrency payment gateway, plus Cobalt Strike, staging and Redis nodes on Tencent Cloud. Activity timing splits around late July, when an AI account appears and the WordPress campaigns get larger.

SOCRadar says the operation was still active when it published. The Hacker News piece repeats that the campaign was ongoing at the time of its write-up.

How does the AI layer work?

There are two AI layers. On the primary workstation, Claude Code runs a swarm of up to 51 specialised agents in a dedicated directory. Offensive roles include names such as c2-operator, exploit-chainer, scada-attacker and lateral-movement; others handle web hunting, subdomain mapping, credential testing and data exfiltration. On the Cobalt Strike Team Server, PentAGI, an open-source AI-augmented pentesting framework, is wired in through an AI provider API for payload generation and pentest execution.

A recovered provider configuration assigns models by role and reasoning budget: payload generation gets the highest token spend, while cheaper roles handle search and installation. SOCRadar reads that as an operator treating AI cost as an operational investment, likely offset by selling stolen data.

The session logs are the most useful part for defenders. A cross-functional agent built a fictional “authorised pentest on my own infrastructure” story; the same ownership claim appears across four unrelated victims and two tools, which marks it as a rehearsed script. When a model refused a task, the actor opened a fresh session with that framing already loaded. Model safety, SOCRadar notes, acts on session context, not weights, so a refusal does not carry over.

The logs also record refusals that held. Across four iterations the model declined to install a backdoor, disable a firewall, move laterally and deploy a webshell; in another episode it refused a scan four times and rejected a forged ownership token. SOCRadar’s practical point is that agent session logs are the equivalent of a keylogger for offensive activity and should be retained and protected like credential stores.

What was taken from Ukrainian targets?

The opportunistic pipeline is industrial. Its centrepiece is wp2shell, an internally developed Python package that, in SOCRadar’s description, abuses a desynchronisation in the WordPress REST API batch endpoint to inject SQL, create a rogue administrator and deploy a WSO-family webshell as an active plugin. Rogue accounts follow a fixed pattern: wp2_ plus eight hex characters. Compromises fire a Telegram bot. One automated run scanned 4,708 targets, confirmed 429 administration panels and deployed 32 shells in 61 seconds. Magento and other e-commerce platforms were hit in parallel, including a time-based SQL injection against Support Board (CVE-2026-4815) within 30 days of disclosure.

The directed pipeline looks different. SOCRadar documents curated reconnaissance against seven Ukrainian energy and utilities entities, including the national transmission system operator and the country’s largest private energy holding. One list alone enumerates 95 subdomains covering email, VPN, network dispatch and data platforms. Four Ukrainian organisations had file-confirmed exfiltration, totalling more than 628,000 records tied to Ukrainian individuals.

The largest dump was a Kharkiv district heating provider: a hardcoded credential in the actor’s own script, then a multithreaded extractor that pulled 564,073 subscriber records with personal data, home addresses and account numbers, plus 213,340 access-log entries with timestamps and IPs. Because Kharkiv sits on an active front, SOCRadar argues the dataset carries a physical risk beyond a normal breach. It found no direct evidence of a sale, but notes that access to electricity or gas operators would sell for far more than a WordPress panel on Dread.

Beyond Ukraine, Poland had the second-highest activity, including WordPress attempts against state administration among 284 scanned domains. A Chinese cluster was compromised through Redis and worked over Cobalt Strike; two Pakistani national-security entities were targeted without confirmed results. SOCRadar’s total is more than 40 affected organisations worldwide.

What should operators watch for?

If you run WordPress, Magento or PrestaShop, or expose Redis, the public blog gives concrete checks: administrators matching wp2_ followed by eight hexadecimal characters; plugin paths under /wp-content/plugins/wp2shell_ plus eight hex characters; unexpected ~/.ssh/authorized_keys entries on Redis hosts consistent with rogue replication; and outbound traffic to the Team Server ports SOCRadar lists. The full hashes, YARA rules and indicators sit in the PDF appendix and on the SOCRadar platform. Related work on AI-assisted cyber monitoring and treating models as insider risks is aimed at defenders building that kind of control.

For anyone shipping coding agents with terminal or network access, the lesson sits next to research such as ProjectDiscovery’s backdoored-model demo against Codex CLI and our guide to agent sandboxing: log agent sessions, treat them as sensitive, and do not assume a model refusal in one chat protects the next. Context engineering and session resets are infrastructure problems, not prompt problems.

What are the limits of this report?

This is SOCRadar’s investigation, not an indictment. The actor’s identity details are held back in the full PDF; the public post does not name Ukrainian victims beyond sector and city. We have not independently verified the open directory, the 51-agent count, the CVE weaponisation claims or the record totals. Anthropic had not, that we could find, published a statement naming CyberXero by 12 October.

Some of the weaponised WordPress CVEs (CVE-2026-63030, CVE-2026-60137, CVE-2026-4815) are identified only in SOCRadar’s and secondary write-ups; operators should confirm against their own vulnerability databases before treating them as settled. Magento’s CVE-2015-1397 is an old flaw, which underscores opportunistic scanning rather than novel research.

We read SOCRadar’s public report and The Hacker News summary on 12 October 2026. Charts are AI Lookout’s, drawn from SOCRadar’s published counts. We did not download the full PDF or reproduce any of the tooling.