CyberXero's attack campaign used Claude Code to steal more than 628,000 Ukrainian records

Cybersecurity company SOCRadar disclosed that the Russian-speaking initial access broker group CyberXero used Anthropic's Claude Code to orchestrate attacks, stealing more than 628,000 Ukrainian personal records from four Ukrainian institutions. The group is assessed to have been active since at least July 2026, running two pipelines simultaneously: global automated attacks against WordPress and e-commerce platforms, and targeted manual attacks against Ukrainian energy and critical infrastructure. The attackers used Claude Code with 51 specialized agents to perform scanning, vulnerability chaining, and post-exploitation, and integrated the open-source autonomous penetration testing agent PentAGI with Cobalt Strike. To bypass model refusals, they used context engineering and session resets, falsely claiming authorized penetration testing; logs also recorded the model repeatedly insisting on refusing. SOCRadar also disclosed the Operation Master activity of another group, masterblack, which also used Claude to develop intrusion code.