CyberXero Uses Claude Code in Campaign That Stole Over 628,000 Ukrainian Records
Russian-speaking broker 'CyberXero' used Claude Code agents and Cobalt Strike to steal 628,000+ Ukrainian records via WordPress and critical infrastructure attacks.
SOCRadar attributed a two-pronged AI-augmented campaign to a Russian-speaking initial access broker codenamed CyberXero, active since at least July 2026. The automated pipeline exploited WordPress flaws including CVE-2026-63030, CVE-2026-60137, and CVE-2026-4815 (Support Board SQL injection), scanning 4,708 targets and confirming 429 WordPress admin compromises with 32 web shells deployed in 61 seconds. A directed pipeline targeted Ukrainian energy and critical infrastructure, including a Kharkiv heating provider, exfiltrating over 628,000 records. The actor used Claude Code with 51 specialized agents and Connected PentAGI linked to Cobalt Strike, using session-reset techniques to bypass model refusals. Compromises were also confirmed in Poland, China, and the Netherlands, partly via exposed Redis servers.