CyberXero Used 51 AI Agents to Steal 628,000 Ukrainian Records
Russian-speaking initial access broker CyberXero ran 51 Claude Code AI agents to steal 628,000 Ukrainian records, per SOCRadar.
SOCRadar exposes CyberXero, a Russian-speaking financially motivated initial access broker running two campaigns: automated attacks on WordPress and e-commerce sites via wp2shell, and manual targeting of Ukrainian energy infrastructure. Over 628,000 Ukrainian records were confirmed stolen, including 564,000 customer records from a Kharkiv district heating provider, posing physical risk to civilians in a war zone. The operation ran up to 51 Claude Code agents for exploit chaining, recon, and lateral movement, and was exposed by a misconfigured open directory on 46.21.250.135 containing 90,000+ files including AI session logs. Over 40 organizations in Ukraine, Poland, China, and Pakistan were affected.