CyberXero (Threat actor): news timeline & CVEs

CyberXero Combines Claude Code, PentAGI and Cobalt Strike in AI-Augmented Cyberattacks

CyberXero used Claude Code, PentAGI and Cobalt Strike to breach sites and steal Ukrainian data.

SOCRadar says Russian-speaking initial-access broker CyberXero combined Claude Code agents, PentAGI and Cobalt Strike against WordPress and e-commerce sites and Ukrainian energy and utility organizations. An exposed directory of more than 90,000 files showed one run scanning 4,708 targets, finding 429 WordPress admin panels and deploying 32 shells. Confirmed stolen data included more than 628,000 Ukrainian residents and 564,073 records from a Kharkiv heating provider. The actor exploited Support Board CVE-2026-4815 within 30 days of disclosure and tried to bypass Claude refusals by claiming targets were authorized test systems.

Cyber Security NewsOct 7, 14:45 UTC · 1d agoThreat actor in the wild 3 sources CVE-2026-4815

Russian-Speaking CyberXero Uses AI Agent Swarm to Attack Ukrainian Energy Infrastructure

CyberXero used WordPress exploits and Claude agents against Ukrainian energy targets, stealing hundreds of thousands of records.

SOCRadar says CyberXero, a Russian-speaking initial access broker, combined WordPress exploitation, Cobalt Strike, and Claude Code agents while targeting Ukrainian energy organizations. An exposed server held more than 90,000 files, including reconnaissance data, tokens, and victim exports. Confirmed theft included 564,073 subscriber records from a Kharkiv heating provider, with stolen data tied to more than 628,000 Ukrainians across four organizations. Researchers reported Support Board exploitation via CVE-2026-4815 but no confirmed electricity disruption or completed access sale.

GBHackersupdated Oct 7, 14:45 UTC · 1d agofirst Oct 7, 12:49 UTC · 1d agoThreat actor in the wild 3 sources CVE-2026-4815

CyberXero: An AI-Augmented Initial Access Broker Targeting Ukrainian Critical Infrastructure

SOCRadar documents CyberXero, an AI-augmented initial access broker targeting Ukrainian critical infrastructure.

SOCRadar's Threat Research Unit documented CyberXero, a Russian-speaking, financially motivated initial access broker. The group is described as AI-augmented and is targeting Ukrainian critical infrastructure. The available report does not name specific victims, malware, or CVEs.

SOCRadarupdated Oct 7, 14:45 UTC · 1d agofirst Oct 6, 14:28 UTC · 2d agoThreat actor in the wild 3 sources

CyberXero

Timeline3 articles

Related CVEsby mentions

Appears with

CyberXero Combines Claude Code, PentAGI and Cobalt Strike in AI-Augmented Cyberattacks

Russian-Speaking CyberXero Uses AI Agent Swarm to Attack Ukrainian Energy Infrastructure

CyberXero: An AI-Augmented Initial Access Broker Targeting Ukrainian Critical Infrastructure