CyberXero Uses Claude Code in Campaign That Stole Over 628,000 Ukrainian Records

CyberXero Campaign Combines Cobalt Strike with Claude Code

Cybersecurity researchers have disclosed a two-pronged AI-augmented initial access campaign targeting WordPress sites, e-commerce platforms, and critical infrastructure entities in Ukraine. The activity, attributed to a Russian-speaking, financially motivated initial access broker codenamed CyberXero, combines commodity offensive tools like Cobalt Strike with an AI orchestration layer powered by Anthropic's Claude Code. The threat actor is assessed to be active since at least July 2026.

According to SOCRadar, the operation runs two pipelines at once: a global, automated campaign against WordPress and e-commerce platforms, and a curated, manual campaign against Ukrainian energy and critical infrastructure. The global campaign exploits known flaws including wp2shell (CVE-2026-63030 and CVE-2026-60137) and CVE-2026-4815, an SQL injection vulnerability in the Support Board WordPress plugin.

Exposed Directory Reveals AI Attack Infrastructure

SOCRadar discovered the operation after identifying an exposed open directory at 46.21.250[.]135 that leaked the threat actor's live working directory, including AI session logs, scripts with plaintext tokens, exploitation toolkits, reconnaissance output, AI agent configurations, and exfiltrated victim data. Analysis showed a single automated execution scanned 4,708 targets, confirmed access to 429 WordPress administration panels, and deployed 32 web shells in a 61-second window.

The campaign resulted in confirmed exfiltration from four Ukrainian organizations, harvesting more than 628,000 records tied to Ukrainian individuals. Other confirmed compromises occurred in Poland, China, and the Netherlands. The attack architecture is based on eight distinct nodes, including the threat actor's Linux workstation, a provisioning server, monetization infrastructure, payload staging servers, and a scanner.

AI Agents Used Across Attack Lifecycle

CyberXero deployed AI in two independent stages. On the primary workstation, Claude Code runs with a cluster of 51 specialized agents for scanning, exploit chaining, reconnaissance, and post-exploitation. Separately, the open-source PentAGI agent is connected to Cobalt Strike through an AI provider API for payload generation and pentest execution on a Cobalt Strike Team Server.

To bypass model refusals, the threat actor used context-engineering and session-reset techniques, instructing the agent it was running an "authorized pentest on my own infrastructure." SOCRadar noted that model safety controls act on session context, not model weights, so a refusal in one session does not carry into the next. The logs also record genuine refusals that held, including declines to install a backdoor, disable a firewall, move laterally, and deploy a web shell.

Sources: The Hacker News