CyberXero campaign pairs Claude Code with attacks on Ukrainian targets
SOCRadar has disclosed an ongoing CyberXero campaign that used Anthropic’s Claude Code alongside commodity offensive tooling to compromise WordPress sites, e-commerce platforms and Ukrainian critical-infrastructure targets. The Russian-speaking, financially motivated initial access broker is assessed to have been active since at least July 2026. Confirmed theft from four Ukrainian organisations exceeded 628,000 records linked to Ukrainian individuals.
The activity combines two pipelines. A global automated operation seeks access and payment data from WordPress and e-commerce environments, while a more selective track conducts deep reconnaissance and manual exploitation against Ukrainian energy and utilities. SOCRadar identified a heating provider in Kharkiv among the targets of the directed campaign. Confirmed compromises also occurred in Poland, China and the Netherlands.
Automated access at scale
The global pipeline exploited known weaknesses including wp2shell, tracked as CVE-2026-63030 and CVE-2026-60137, and CVE-2026-4815, an SQL injection flaw in the Support Board WordPress plugin. CyberXero also targeted exposed Redis servers, a route that led to breaches at two Chinese entities.
One automated execution scanned 4,708 targets, confirmed access to 429 WordPress administration panels and deployed 32 web shells within 61 seconds. SOCRadar reconstructed the activity after finding an exposed open directory on a server that disclosed the operator’s Linux working directory, including AI session logs, scripts containing plaintext tokens, exploitation toolkits, reconnaissance results, agent configurations and victim data.
AI agents in two parts of the intrusion chain
SOCRadar said CyberXero used Claude Code on its primary workstation with a cluster of 51 specialised agents for scanning, exploit chaining, reconnaissance and post-exploitation. Separately, it connected PentAGI, an open-source self-hosted AI agent for autonomous penetration testing, to Cobalt Strike through an AI provider API for payload generation and penetration-test execution on a Cobalt Strike Team Server.
The exposed logs showed attempts to bypass model refusals through context engineering and session resets. The operator framed requests as authorised testing of its own infrastructure, then opened a fresh session after a refusal. SOCRadar also recorded controls that held: across four iterations, the model declined requests to install a backdoor, disable a firewall, move laterally and deploy a web shell. In another episode, it rejected a scan four times and refused a forged ownership token.
What defenders should check
The case illustrates how automated exploitation, AI-assisted orchestration and conventional post-compromise tools can be assembled into a high-volume access operation while targeted activity proceeds in parallel. SOCRadar described an eight-node architecture comprising the attacker workstation, a provisioning server, monetisation infrastructure, payload staging servers and a scanner, among other components.
Organisations running WordPress, Magento or PrestaShop should apply relevant fixes and investigate rogue WordPress administrators and WSO web shells. Teams exposing Redis to the internet should inspect ~/.ssh/authorized_keys for unexpected entries. The practical business implication is to treat exposed administration surfaces, unpatched web applications and internet-facing Redis instances as immediate review priorities, because this campaign remains active.