CYBERXERO , a Russian‑speaking, financially motivated threat actor described by SOCRadar as an initial access broker, operated with an AI orchestration layer running on its own infrastructure to support two parallel campaigns. One is a broad global operation targeting WordPress and e‑commerce platforms, while the other is a curated, manual campaign aimed at Ukraine’s energy and critical infrastructure.
In total, more than 628,000 Ukrainian records were found in the actor’s possession, including data from residents in Kharkiv, a city on an active front line. An exposed open directory on a server revealed the attacker’s working directory, containing over 90,000 files such as AI session logs, plaintext tokens and stolen victim data, illustrating the operation’s internal workflows.
The global campaign used a toolchain based on wp2shell that exploits a flaw in the WordPress REST API to inject SQL, plant a rogue admin account and drop a webshell. In one automated run, the operation scanned 4,708 targets, gained access to 429 WordPress admin panels, and deployed 32 webshells within 61 seconds, with a target list exceeding 56,000 URLs across various countries and sectors.
The Ukraine‑focused campaign identified four local organisations as victims, including a district heating provider in Kharkiv, where a password stored in the attacker’s script gave access to systems and allowed automated extraction of more than 564,000 customer records, tying home addresses to accounts. The report notes that, given Kharkiv’s war context, this data could pose physical risks beyond ordinary data breaches.
The operation reportedly ran up to 51 Claude Code AI agents on the main workstation for tasks such as exploitation, lateral movement and reconnaissance, and included an AI pentesting framework connected to a Cobalt Strike server; investigators caution that AI session logs should be treated like sensitive credentials, as they reveal planning, targets and success or failure details.