The Hacker News, SOCRadar · 4 sourcesThe Hacker News · 4 sources · 4 reports · SOCRadar discloses CyberXero attacking Ukrainian organizations with Claude Code
SOCRadar's threat research team disclosed that the Russian-speaking, profit-motivated initial access broker CyberXero combines conventional attack tools with a self-built AI orchestration layer, running both global automated attacks against WordPress and e-commerce platforms and targeted manual attacks against Ukrainian energy and critical infrastructure. The investigation originated from an exposed open directory server, an HTTP directory at IP 46.21.250.135, where more than 90,000 files leaked reconnaissance results, exploit scripts, AI configurations containing plaintext tokens, session history, and victim database exports; researchers used this to link eight infrastructure nodes across three autonomous systems and two regions. The report states that its main workstation was configured with up to 51 Claude Code agents, respectively responsible for web probing, password testing, exploitation, and data theft, and another environment connected the AI penetration testing framework PentAGI to Cobalt Strike via an AI provider API. The group is assessed to have been active since at least July 2026, stealing more than 628,000 Ukrainian personal records from four Ukrainian institutions.