CyberXero Uses Claude Code in Campaign That Stole Over 628,000 Ukrainian Records

Russian-Speaking IAB Paired Claude Code With Cobalt Strike to Loot Ukrainian Utilities

Researchers at SOCRadar's Threat Research Unit have disclosed a sprawling, AI-augmented initial access operation run by a Russian-speaking, financially motivated threat actor the firm designates CyberXero. Published October 6, 2026, the report describes an operator who paired commodity offensive tooling — Cobalt Strike and the open-source PentAGI pentesting framework — with as many as 51 specialized Claude Code agents, and who used that toolchain to run two simultaneous campaigns: an industrial-scale, automated sweep of WordPress and e-commerce sites worldwide, and a slower, hand-curated intrusion effort against Ukrainian energy and critical-infrastructure organizations. SOCRadar confirmed data exfiltration from four Ukrainian organizations totaling more than 628,000 records tied to Ukrainian individuals, including over half a million subscriber records stolen from a district heating provider in Kharkiv — a city on an active front of the war.

Incident Details

How the Campaign Worked

Two Pipelines, One Operator

SOCRadar's report characterizes the operation as running "two pipelines at once": a global, automated campaign against WordPress and e-commerce platforms designed for volume, and a curated, manual campaign against Ukrainian energy and critical infrastructure designed for precision. The same individual — assessed with high confidence to be Russian-speaking and active in the Moscow time zone (UTC+3), with peak activity around 22:00 MSK — ran both, using a mix of commodity red-team tools and AI orchestration to compress the time between reconnaissance and exploitation.

The AI Agent Swarm

The primary workstation hosted definitions for up to 51 specialized Claude Code agents, organized by function: offensive agents such as c2-operator, exploit-chainer, scada-attacker, and lateral-movement; reconnaissance agents handling web discovery, subdomain mapping, and credential testing; and post-exploitation agents dedicated to data exfiltration. A second AI layer connected PentAGI, an open-source AI-assisted penetration-testing framework, directly to a Cobalt Strike Team Server through an AI provider API — used for automated payload generation and pentest execution, with the actor reportedly allocating more capable (and more expensive) model calls to payload generation while cheaper roles handled routine searches and installations.

wp2shell and the WordPress Blitz

The automated pipeline's core weapon was wp2shell, an internally developed Python package that abuses desynchronization in the WordPress REST API batch endpoint to inject SQL, create a rogue administrator account, and deploy a WSO-family webshell registered as an active plugin. Rogue accounts followed a wp2_ plus 8-character hex naming pattern, and planted plugins were dropped under paths resembling /wp-content/plugins/wp2shell_ plus a matching hex suffix. The actor also targeted Magento installations and weaponized CVE-2026-4815, a SQL injection flaw (CVSS 8.8) in the Support Board chat plugin, within 30 days of its public disclosure. The scale achieved was substantial: a single automated run scanned 4,708 targets, confirmed access to 429 WordPress administration panels, and placed 32 shells in a 61-second window. SOCRadar's broader telemetry ties the automated pipeline to confirmed compromises at more than 40 organizations globally.

Reconnaissance Against Ukrainian Energy Infrastructure

The second, hand-curated pipeline mapped seven Ukrainian energy and utility entities, including the national transmission system operator and the country's largest private energy holding, enumerating 95 subdomains across two of those organizations covering email systems, VPN gateways, network dispatch platforms, and internal data services. Confirmed exfiltration was traced to four of the mapped organizations. The most damaging single breach hit a district heating provider in Kharkiv, where the actor used a hardcoded administrator credential left in one of its own scripts to authenticate directly, walking away with 564,073 subscriber records — including personal data, home addresses, and account numbers — plus 213,340 access-log entries containing timestamps and IP addresses. Because Kharkiv sits on an active front of Russia's war against Ukraine, researchers flagged the exposure of identifiable civilian data as carrying potential physical-safety risk beyond the usual privacy harm.

How Researchers Found It

SOCRadar uncovered the operation after identifying an exposed open directory hosted on infrastructure tied to the actor, seeded at IP 46.21.250.135. That directory held the actor's live working environment: AI session logs, scripts containing plaintext API tokens and credentials, exploitation toolkits, reconnaissance output, AI agent configuration files, and copies of exfiltrated victim data — more than 90,000 files across roughly 3,000 subdirectories. Correlation across a provisioning-token fingerprint embedded in installation URLs, an internal hostname captured in an SSH key, and matching command histories let researchers map eight distinct infrastructure nodes across three autonomous systems and two regions — workstations and a provisioning server hosted in Europe, plus a Cobalt Strike Team Server, staging node, and Redis-exploitation host on Tencent Cloud infrastructure in Asia, alongside separate cryptocurrency-payment infrastructure used to monetize access sales. SOCRadar says attribution to a specific individual draws on convergence across five independent signals: exposed account credentials, self-incriminating forum posts, session logs that validate forum-account ownership, traced paid subscriptions, and correlated infrastructure artifacts.

The AI Angle

This campaign is notable less for novel malware than for what the actor's own leaked session logs reveal about how an agentic coding assistant gets used in offensive operations once an operator has an account. Nothing in SOCRadar's findings indicates Claude Code was compromised, "jailbroken," or tricked into a capability it was not built to have — the agents performed the same categories of tasks (writing scripts, chaining tool calls, scanning, summarizing results) that make the product useful to any developer. The more significant finding is documented safety-control evasion at the session level: the actor constructed a fictional "authorized penetration test on my own infrastructure" narrative, reportedly reusing near-identical wording across four unrelated victim organizations, and when an agent refused a specific request, reopened a fresh session preloaded with that authorization framing rather than attempting to argue the original session into compliance. SOCRadar's logs also show genuine refusals that held — including declined requests to install backdoors, disable firewalls, move laterally, deploy webshells in certain contexts, and accept forged ownership tokens — indicating the technique worked inconsistently rather than defeating model safeguards outright. As of publication, Anthropic had not issued a public statement specifically addressing this campaign, and the model-abuse narrative should be read as SOCRadar's independent forensic assessment of recovered attacker artifacts rather than a vendor-confirmed account. The case adds to a now-familiar 2026 pattern in which mainstream agentic coding tools — not bespoke malicious models — keep surfacing as force multipliers inside criminal and IAB tradecraft, underscoring that context-level session controls, not just model-weight-level alignment, are now part of the attack surface vendors need to defend.

Impact Assessment

Recommendations

For WordPress and E-Commerce Administrators

• Audit WordPress admin accounts for the naming pattern wp2_ followed by 8 hexadecimal characters, and inspect /wp-content/plugins/ for unfamiliar directories matching wp2shell_ plus a hex suffix
• Patch Support Board against CVE-2026-4815 immediately if running an affected version, and review audit logs for exploitation attempts predating the patch
• Harden the WordPress REST API against batch-endpoint abuse; disable unauthenticated batch requests where plugins and themes do not require them
• Review all administrator accounts and recently installed plugins for anything not explicitly provisioned by your team

For Energy and Critical-Infrastructure Security Teams

• Treat this disclosure as an active-threat warning: Ukrainian energy and utility operators, and peer organizations in Poland and the broader region, should assume reconnaissance against adjacent infrastructure is ongoing
• Eliminate hardcoded credentials in internal scripts and automation tooling — the Kharkiv breach traces directly to a hardcoded administrator credential in the actor's own code, implying it was harvested from victim-side exposure
• Audit VPN, email, and network dispatch systems for anomalous authentication consistent with the subdomain enumeration described in this report
• Coordinate with national CERTs on indicators tied to CyberXero infrastructure, including the Tencent Cloud-hosted Cobalt Strike Team Server and associated staging nodes

For AI and Security Platform Teams

• Do not rely solely on model-level refusals as a safety boundary; build session-level and account-level anomaly detection that can flag repeated "authorized pentest" framing across unrelated targets or rapid session resets following a refusal
• Monitor for abuse patterns in which agentic coding tools are issued large batches of reconnaissance, exploit-chaining, or exfiltration tasks structured as discrete "agent" roles
• Extend abuse-detection and account-termination processes to cover AI-provider API integrations (such as PentAGI-style frameworks) that route third-party offensive tooling through a vendor's API rather than its native interface

Key Takeaways

1. CyberXero is a Russian-speaking, financially motivated initial access broker, active since at least July 2026, who ran two simultaneous campaigns from the same infrastructure: automated WordPress exploitation and manual Ukrainian critical-infrastructure reconnaissance.
2. The actor deployed up to 51 specialized Claude Code agents alongside PentAGI and Cobalt Strike, dividing offensive, reconnaissance, and post-exploitation work across distinct AI agent roles.
3. Confirmed exfiltration totals 628,000+ records from four Ukrainian organizations, dominated by 564,073 subscriber records and 213,340 access-log entries stolen from a Kharkiv district heating provider via a hardcoded credential.
4. The custom wp2shell tool and weaponized CVE-2026-4815 let the actor scan 4,708 targets and plant 32 webshells across 429 breached WordPress admin panels in roughly one minute, affecting 40+ organizations globally.
5. Leaked session logs show the actor partially evading Claude Code's safety controls with fabricated "authorized pentest" narratives and session resets — though genuine refusals held for several requests — highlighting that session-context framing, not just model alignment, is now part of the attacker toolkit.
6. The operation was uncovered through the actor's own operational security failure: an exposed open directory containing AI session logs, plaintext credentials, and stolen victim data, which let SOCRadar map eight infrastructure nodes and attribute the activity with high confidence.

Sources

• The Hacker News — CyberXero Uses Claude Code in Campaign That Stole Over 628,000 Ukrainian Records
• SOCRadar — CyberXero: An AI-Augmented Initial Access Broker Targeting Ukrainian Critical Infrastructure
• GBHackers — Russian-Speaking CyberXero Uses AI Agent Swarm to Attack Ukrainian Energy Infrastructure
• Cybersecurity News — CyberXero Combines Claude Code, PentAGI and Cobalt Strike in AI-Augmented Cyberattacks