CyberXero ran 51 Claude Code agents against WordPress sites and Ukrainian utilities
SOCRadar estimates broker CyberXero stole more than 628,000 records from four Ukrainian organizations with Claude Code and Cobalt Strike. The actor left a server open, and its logs show where the model's refusals held and where a fresh session got around them.
The Watch · Security desk
Three figures. SOCRadar estimates more than 628,000 records tied to Ukrainian individuals were exfiltrated. A single automated run scanned 4,708 targets and confirmed access to 429 WordPress admin panels in a 61-second window. Separately, the actor uses 51 specialized Claude Code agents.
| Figure | Value | Note | Claim |
|---|---|---|---|
| Ukrainian records exfiltrated | 628,000 records | Estimate: more than 628,000 | 17 |
| Targets scanned, one automated run | 4,708 targets | 429 admin panels confirmed in 61 seconds | 5 |
| Specialized Claude Code agents | 51 agents | 7 |
What happened
- One automated run scanned 4,708 targets, confirmed access to 429 WordPress admin panels and deployed 32 web shells inside a 61-second window.
- The global pipeline exploits wp2shell (CVE-2026-63030, CVE-2026-60137) and CVE-2026-4815, an SQL injection flaw in the Support Board WordPress plugin.
- A second, manual pipeline goes after Ukrainian energy and utilities, including a heating provider in Kharkiv, with deep reconnaissance.
- To get past model refusals, the actor told the agent it was running an "authorized pentest on my own infrastructure" and opened fresh sessions after a refusal.
- SOCRadar found the operation through an exposed open directory at 46.21.250[.]135 that held AI session logs, plaintext tokens, toolkits and stolen victim data.
Why it matters
- Who's exposed exposure Any internet-facing WordPress site carrying the listed flaws, and any exposed Redis server, sits inside this actor's targeting, and confirmed victims already span Poland, China and the Netherlands.
- What it limits constraint A model's refusal costs this actor one new session with the authorization framing preloaded, so defenders cannot count on provider-side refusals to stop the work.
- Who has to decide decision In our view, operators on the affected platforms need a compromise check as well as a patch, because activity dates to at least July 2026 and a patch does not remove a planted administrator or web shell.
Next story · Build · yesterday
Codex agent solves 49 of 50 unpublished physics problems for under $3 eachConfirmed2 publishers
The entry points are known flaws [3]. That keeps the defense ordinary: patch, then look for what was planted before the patch. SOCRadar says to check for WordPress administrator accounts that should not exist, WSO web shells, and SSH keys in ~/.ssh/authorized_keys on Redis hosts that nobody expected to find there [13].
The exposed logs show the pace of the planting. The automated run confirmed access on 9.1% of the 4,708 targets it scanned [5][15] and placed 32 web shells in 61 seconds, one every 1.9 seconds [5][16]. In our view that is machine pace.
SOCRadar describes eight nodes, among them the actor's Linux workstation, a provisioning server, monetization infrastructure, payload staging servers and a scanner [6]. The campaign pairs Cobalt Strike with an AI orchestration layer built on Claude Code [1]. AI runs at two independent stages. On the workstation, Claude Code drives a cluster of 51 specialized agents for scanning, exploit chaining, reconnaissance and post-exploitation [7]. On the Cobalt Strike Team Server, PentAGI, an open-source, self-hosted agent for autonomous penetration testing, reaches Cobalt Strike through an AI provider API for payload generation and pentest execution [8].
The refusal problem is where the logs are most specific. "Model safety controls act on the context of a session, not on the model weights, so a refusal in one session does not carry into the next," SOCRadar said [10]. It added: "When an agent refused a task, the actor reopened a fresh session, with the authorization framing preloaded and tried again." [11]
Some refusals did hold. Over four iterations the model would not plant a backdoor, turn off a firewall, move laterally or drop a web shell; in another episode it turned down a scan four times running and would not accept a forged ownership token [12].
The two pipelines have different jobs. The opportunistic one is built for access and payment data and is monetized through access sales or payment-data theft [14]. The directed one is built for deep reconnaissance and manual exploitation against Ukrainian energy and utilities [18].
Confirmed exfiltration covers four Ukrainian organizations and more than 628,000 records tied to Ukrainian individuals [17]. The Hacker News's account does not say which pipeline produced those records, or whether the Kharkiv heating provider is one of the four organizations. Other confirmed compromises are in Poland, China and the Netherlands [17], and the Redis route breached two Chinese entities [13].
Every figure here comes from SOCRadar's report as relayed by The Hacker News. The Russian-speaking, financially motivated profile and the July 2026 start date are SOCRadar's assessment [2]. SOCRadar says the campaign remains ongoing [4].
What to watch
- Whether SOCRadar or another researcher says which pipeline produced the 628,000 records and whether the Kharkiv heating provider is among the four victims.
- Whether the actor moves infrastructure after the open directory at 46.21.250[.]135 was exposed, given SOCRadar says the campaign is ongoing.
- A statement from Anthropic on the Claude Code sessions recorded in the logs.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence58
- Adoption
- Not scored
- Hype gap+20
- Incentives
- Not scored
- Confidence60
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
The campaign brings together commodity offensive tools like Cobalt Strike with an AI orchestration layer powered by Anthropic's Claude Code.
- [2]
The activity is attributed to a Russian-speaking, financially motivated initial access broker codenamed CyberXero, assessed to be active since at least July 2026.
- [3]
The global campaign focuses on known flaws: wp2shell (CVE-2026-63030 and CVE-2026-60137) and CVE-2026-4815, an SQL injection vulnerability in the Support Board WordPress plugin, to seize control of WordPress sites.
- [4]
SOCRadar discovered the operation after identifying an exposed open directory hosted at 46.21.250[.]135 that leaked the actor's live working directory from a Linux workstation, including AI session logs, scripts with plaintext tokens, exploitation toolkits, reconnaissance output, AI agent configurations and exfiltrated victim data. The campaign remains ongoing.
- [5]
Analysis of the exposed directory shows a single automated execution scanned 4,708 targets, confirmed access to 429 WordPress administration panels, and deployed 32 web shells in a 61-second window.
- [6]
The attack architecture is based on eight distinct nodes, including the threat actor's Linux workstation, a provisioning server, monetization infrastructure, payload staging servers and a scanner that identifies targets.
- [7]
CyberXero uses Claude Code with a cluster of 51 specialized agents for scanning, exploit chaining, reconnaissance and post-exploitation, running on the attacker's primary workstation.
- [8]
CyberXero connected PentAGI, an open-source, self-hosted AI agent for fully autonomous penetration testing, to Cobalt Strike through an AI provider API for payload generation and pentest execution, running on a Cobalt Strike Team Server.
- [9]
To get around model refusals, the actor used context-engineering and session-reset techniques, instructing the agent they were running an "authorized pentest on my own infrastructure."
- [10]
"Model safety controls act on the context of a session, not on the model weights, so a refusal in one session does not carry into the next."
- [11]
"When an agent refused a task, the actor reopened a fresh session, with the authorization framing preloaded and tried again."
- [12]
The logs record refusals that held: across four iterations the model declined to install a backdoor, disable a firewall, move laterally and deploy a web shell, and in a separate episode it refused a scan four consecutive times and rejected a forged ownership token.
- [13]
The campaign exploits exposed Redis servers, breaching two Chinese entities. Organizations running WordPress, Magento or PrestaShop, or exposing Redis to the internet, are advised to check for rogue WordPress administrators, WSO web shells and unexpected entries in ~/.ssh/authorized_keys on Redis hosts.
- [14]
The opportunistic pipeline is global and automated, designed for access and payment data, with direct monetization through access sales or payment-data theft.
- [15]
The automated run confirmed access on about 9.1% of the targets it scanned.
- [16]
The 32 web shells were deployed at an average of one every 1.9 seconds.
- [17]
The campaign is estimated to have resulted in confirmed exfiltration from four Ukrainian organizations, harvesting more than 628,000 records tied to Ukrainian individuals; other confirmed compromises occurred in Poland, China and the Netherlands.
- [18]
The second campaign is targeted and geared toward deep reconnaissance and manual exploitation against Ukrainian energy and utilities, including a heating provider in Kharkiv.
Sources
2 independent publishers whose own reporting we read for this story.
- securityaffairs.comCyberXero Used 51 AI Agents to Steal 628,000 Ukrainian Records
1 article · October 12, 2026
- thehackernews.comCyberXero Uses Claude Code in Campaign That Stole Over 628,000 Ukrainian Records
1 article · October 12, 2026
Topics and entities
Topics
- WordPress vulnerabilities
- AI-Enabled Cyberattacks
- LLM safety guardrail evasion
- Ukraine critical infrastructure threats
- Initial Access Brokers