CYBERXERO , a Russian-speaking initial access broker, is reported to be running a two‑pronged AI‑augmented campaign that targets Ukrainian critical infrastructure and a broader global surface. According to SOCRadar, the operation combines commodity tools such as Cobalt Strike with an AI orchestration layer built on Anthropic’s Claude Code.
The researchers say the global pipeline pursues WordPress and e‑commerce compromises using flaws including wp2shell (CVE-2026-63030 and CVE-2026-60137) and CVE-2026-4815 in the Support Board WordPress plugin, while a separate curated, manual pipeline attacks Ukrainian energy and utilities sectors.
The campaign has led to confirmed exfiltration from four Ukrainian organisations, with more than 628,000 records linked to Ukrainian individuals suspected to have been stolen; additional compromises have been observed in Poland, China and the Netherlands.
Evidence of the campaign’s scale and mechanics comes from an exposed directory at 46.21.250[.]135 that reportedly contained the operator’s live Linux workstation workspace, AI session logs, plaintext tokens, exploitation toolkits, reconnaissance outputs and exfiltrated data. The automated pipeline scanned 4,708 targets, gaining access to 429 WordPress administration panels and deploying 32 web shells within a 61‑second window.
The operation uses Claude Code via a cluster of 51 agents for scanning, exploitation chaining, reconnaissance and post‑exploitation, and also leverages PentAGI to connect to a Cobalt Strike Team Server for autonomous pentesting. In addition, the group has been observed using context‑engineering and session resets to bypass model refusals.
Organisations running WordPress, Magento or PrestaShop, or exposing Redis to the internet, are advised to audit for rogue administrators, WSO web shells and unexpected SSH keys on Redis hosts. The campaign remains ongoing.