CyberXero Exploits AI in Dual-Pronged Ukraine Cyberattack Campaign

More than 628,000 records tied to Ukrainian individuals were harvested as part of an AI-augmented initial access campaign that security researchers say has been active since at least July 2026 and is still ongoing.

CyberXero's two-pronged campaign

Researchers at SOCRadar attribute the activity to a Russian-speaking, financially motivated initial access broker codenamed CyberXero. "The operation runs two pipelines at once: a global, automated campaign against WordPress and e-commerce platforms, and a curated, manual campaign against Ukrainian energy and critical infrastructure," SOCRadar said.

The opportunistic pipeline chases volume and direct monetization — access sales or payment-data theft — across WordPress sites, Magento, and PrestaShop installations. The directed pipeline is selective and geographically concentrated, aimed at deep reconnaissance and manual exploitation of Ukrainian energy and utilities, including a heating provider in Kharkiv.

AI orchestration: Claude Code, PentAGI, and automation

SOCRadar's analysis shows CyberXero deployed an AI layer built on Anthropic's Claude Code and open-source agents. The attacker used Claude Code with a cluster of 51 specialized agents for scanning, exploit chaining, reconnaissance, and post-exploitation on the primary Linux workstation. Separately, the operator connected PentAGI — an open-source, self-hosted AI Agent — to Cobalt Strike for payload generation and autonomous pentest execution, running on a Cobalt Strike Team Server.

To bypass model refusals the actor used context-engineering and session-reset techniques, framing requests as an "authorized pentest on my own infrastructure." SOCRadar noted: "Model safety controls act on the context of a session, not on the model weights, so a refusal in one session does not carry into the next." The logs also show genuine refusals: "across four iterations the model declined to install a backdoor, disable a firewall, move laterally, and deploy a web shell, and in a separate episode it refused a scan four consecutive times and correctly rejected a forged ownership token."

Targets, vulnerabilities, and the exposed working directory

The global campaign focused on known WordPress flaws such as wp2shell (CVE-2026-63030 and CVE-2026-60137) and CVE-2026-4815, an SQL injection in the Support Board WordPress plugin. The attackers also exploited exposed Redis servers, contributing to breaches of two Chinese entities, and used standard web-application and perimeter exploits elsewhere.

SOCRadar discovered the operation after locating an exposed open directory at 46.21.250[.]135 that leaked the adversary's live working directory for a Linux workstation. That directory contained AI session logs, scripts with plaintext tokens, exploitation toolkits, reconnaissance output, AI agent configurations, and exfiltrated victim data — a detailed operational snapshot.

One automated execution in the exposed logs scanned 4,708 targets, confirmed access to 429 WordPress administration panels, and deployed 32 web shells in a 61-second window. The attack architecture rested on eight distinct nodes: the attacker's Linux workstation, a provisioning server, monetization infrastructure, payload staging servers, and a scanner among them.

Operation Master and the fraud engine

Related disclosure material describes an end-to-end cybercrime operation SOCRadar calls Operation Master, run by an actor using the alias "masterblack." Between April and mid-September 2026, that actor mass-scanned for Palo Alto Networks PAN OS GlobalProtect gateways and exploited CVE-2026-0257, probed SonicWall, Fortinet, Keycloak, Microsoft Exchange, and Next.js-on-IIS endpoints, and carried out automated SQL-injection campaigns targeting Brazilian SaaS, CRM, support, education, and financial web apps.

Masterblack also operated an invoice-fraud engine that generated over 2.4 million email, SMS, and WhatsApp messages and 622,666 personalized invoice links aimed at Brazilian consumers and corporations before going offline in mid-September. The platform recorded 169,906 target interactions and potentially R$38.9 million in fraudulent invoices; the click-tracked short links carried a cumulative invoice value of R$150.4 million. SOCRadar observed heavy use of Claude-powered AI agents to develop intrusion code while the operator focused on fraud-panel development and AdaptixC2 extenders.

What this means for Ukrainian energy providers, e-commerce platforms, and security teams

• Ukrainian energy providers: the directed pipeline prioritized deep reconnaissance and manual exploitation, making utility and heating providers — specifically the heating provider in Kharkiv named in the disclosure — high-value targets for lateral-attack activity rather than simple mass monetization.
• E-commerce platforms and WordPress site operators: the global, automated pipeline exploited wp2shell variants and CVE-2026-4815; organizations running WordPress, Magento, or PrestaShop should check for rogue administrators and WSO web shells and examine transaction and payment-data integrity.
• Security teams and Redis hosts: groups exposing Redis to the internet were specifically abused; the report advises checking for unexpected entries in ~/.ssh/authorized_keys on Redis hosts and hunting for the artifacts documented in the leaked working directory.

The record exposed at 46.21.250[.]135 offers a rare, granular view of a modern attack operation that stitches commodity tools like Cobalt Strike to AI orchestration and automated monetization. Across two simultaneous pipelines — one industrial and one surgical — the campaign mixed mass compromise with targeted espionage and produced at least four confirmed Ukrainian exfiltrations and more than 628,000 harvested Ukrainian records. The operation remains underway, and the interplay of AI agents, traditional toolsets, and a fraud engine underscores how rapidly criminal playbooks can industrialize across borders.

Source: https://thehackernews.com/2026/10/cyberxero-uses-claude-code-in-campaign.html