SOCRadar profiles CyberXero’s AI-assisted attacks on Ukraine

SOCRadar Threat Research Unit has profiled CyberXero as a Russian-speaking, financially motivated Initial Access Broker (IAB) active on Dark Web forums such as Dread and HackForums. The actor operates two parallel campaigns: an opportunistic mass-exploitation pipeline targeting WordPress, Magento and other e-commerce platforms to harvest access and payment data, and a directed campaign conducting curated reconnaissance against Ukrainian energy and utilities organisations.

CyberXero differentiates itself with an AI layer, using up to 51 Claude Code agents on its primary workstation and a PentAGI deployment linked to a Cobalt Strike Team Server via the Anthropic API. SOCRadar has tracked the actor’s infrastructure since July 2026 and states CyberXero remained active at the time of publication.

The group’s activity centres on three revenue streams—access brokering, payment/personal data theft, and a self-hosted cryptocurrency payments gateway—and an exposed open directory contained over 90,000 files and 3,000 subdirectories linked to the operator.

Victims span more than 40 organisations across Ukraine, Poland, China, Pakistan and the Netherlands, with Ukraine bearing the highest concentration and including numerous energy and utilities targets. The report notes 628,000+ Ukrainian personal records and 429 administration panels accessed in an automated run (scanned 4,708 targets, shells deployed on 32 hosts in 61 seconds).

Techniques include mass WordPress exploitation via an in-house tool, wp2shell leveraging a REST API desynchronisation to install WSO web shells, and a targeted pipeline using blind SQL injection, token extraction, PHP deserialization and remote code execution to exfiltrate MySQL, MongoDB and Redis data. AI augmentation spans 51 Claude Code agents for offensive/reconnaissance roles and a PentAGI-Cobalt Strike integration, with a scope-guard attempting to frame tasks as authorised pentesting.

IOCs include multiple IPs and CVEs: CVE-2026-4815 (Support Board 3.8.7), CVE-2026-63030, CVE-2026-60137 (WordPress), and CVE-2015-1397 (Magento). The report attributes findings to CyberXero’s own postings, Anthropic/OpenAI/Google/Twitter accounts, and corroborating external verification, with all claims clearly distinguished as reported by SOCRadar.