The Hacker News, SOCRadar · 4 sourcesThe Hacker News · 4 sources · 4 reports · SOCRadar's threat research team disclosed that the Russian-speaking, profit-motivated initial access broker CyberXero combines conventional attack tools with a self-built AI orchestration layer, running both global automated attacks against WordPress and e-commerce platforms and targeted manual attacks against Ukrainian energy and critical infrastructure. The investigation originated from an exposed open directory server, an HTTP directory at IP 46.21.250.135, where more than 90,000 files leaked reconnaissance results, exploit scripts, AI configurations containing plaintext tokens, session history, and victim database exports; researchers used this to link eight infrastructure nodes across three autonomous systems and two regions. The report states that its main workstation was configured with up to 51 Claude Code agents, respectively responsible for web probing, password testing, exploitation, and data theft, and another environment connected the AI penetration testing framework PentAGI to Cobalt Strike via an AI provider API. The group is assessed to have been active since at least July 2026, stealing more than 628,000 Ukrainian personal records from four Ukrainian institutions.
SwarmChase 自9月28日起追踪对高德地图地点入口客流数据的自动化抓取，10月5日10:45 UTC更新称最后一次带标签扫描在当日04:11，截至08:46未观察到更晚活动，峰值并发最多14路。该研究依据网络基础设施、自报名称和有限代码风格测试提出归因假说，但无法确定模型、训练任务或实际执行者，腾讯云也可供其他用户使用，且未发现智能体间通信或协调证据。TechCrunch 报道称，独立研究人员发现一支疑似运行于腾讯基础设施的 AI 智能体“舰队”针对高德地图发起查询，研究人员拒绝使用“蜂群”一词，称这些并行智能体执行同类任务但彼此没有通信迹象，活动仍在进行中。Murmuration 复核后仅将相关结果列为 Lead/E1 线索，称多个运行的结果去向不同，未证实存在共享汇点或后续公开读取者，也未独立核实原报告的托管位置与时区归因。另有报道称，研究人员将集群 IP 关联到腾讯，并观察到智能体使用名为 hysandbox-ats 的代理，尚不清楚其属于腾讯还是使用其云服务器的客户，该活动于上周末被发现，可能是一次模型评估的一部分。The Ruling Desk 的梳理为二手汇总，不能作为所有活动均已归因于 AI 的独立确认。
