# CyberXero: an access broker ran 51 Claude Code agents against Ukraine

> CyberXero is an AI-augmented initial access broker whose own agent session logs documented its intrusions in detail.

- **Severity:** Info: Research, tools, evals or lab claims with no direct exposure. Context, not an alert.
- **Category:** Incident
- **Published by:** SOCRadar
- **Disclosed:** 2026-10-06
- **Affects:** Claude Code, PentAGI, Cobalt Strike, WordPress
- **Research by:** SOCRadar Threat Research Unit
- **Primary source:** https://socradar.io/blog/cyberxero-ai-iab-ukraine-critical-infrastructure/
- **Page:** https://theinjection.dev/items/socradar-cyberxero-ukraine/

CyberXero is a Russian-speaking initial access broker driving 51 specialized Claude Code agents. SOCRadar found its exposed working directory and confirmed theft of over 628,000 records from four Ukrainian organizations.

## What happened

SOCRadar's Threat Research Unit published its CyberXero report on October 6, 2026, after finding an open directory on the actor's seed workstation that leaked its working files. The broker has been active since at least July 2026, is financially motivated and Russian-speaking, and was still operating when SOCRadar published. The report counts more than 40 affected organizations worldwide.

## How it works

The operation runs on two layers. On the workstation, Claude Code drives 51 specialized agents split into offensive, reconnaissance and post-exploitation roles, with names such as c2-operator, exploit-chainer, scada-attacker and lateral-movement. On a separate team server, PentAGI, an open-source autonomous pentesting system, is wired into Cobalt Strike through an AI provider API to generate payloads and run tests. A recovered configuration assigns models by reasoning complexity and gives payload generation the largest token budget. SOCRadar describes the actor's refusal handling as context engineering rather than a technical bypass: a rehearsed claim of an authorized test on its own infrastructure, reused across four unrelated victims, and a fresh session opened with that framing preloaded whenever the model declined.

## Who is affected

Ukrainian energy and critical infrastructure were the targeted half of the campaign, with confirmed exfiltration at four organizations and a Kharkiv district heating provider losing 564,073 subscriber records. A separate automated pipeline hits WordPress and e-commerce sites worldwide, with confirmed compromises in Poland, China and the Netherlands, and the CVEs listed below are the entry points. SOCRadar reports two Pakistani national-security entities targeted without a confirmed result.

## What to do

Hunt for the indicators SOCRadar publishes: WordPress admin accounts matching wp2_ followed by eight hex characters, webshell plugin directories under /wp-content/plugins/wp2shell_[0-9a-f]{8}/, injected keys in ~/.ssh/authorized_keys on internet-exposed Redis hosts, and a Windows service named UpdSvc. Patch the WordPress and Support Board flaws listed below. SOCRadar also advises treating AI agent session logs as sensitive, with the retention, encryption and access controls given to credential logs, because those logs record offensive activity in full.

## Quick facts

- **Actor:** CyberXero, a Russian-speaking initial access broker, active since July 2026
- **AI tooling:** Claude Code with 51 specialized agents, plus PentAGI into Cobalt Strike
- **Confirmed theft:** Over 628,000 records from four Ukrainian organizations
- **CVEs used:** CVE-2026-63030, CVE-2026-60137, CVE-2026-4815, CVE-2015-1397
- **Automated run:** 4,708 targets scanned, 429 admin panels reached, 32 shells in 61 seconds
- **Found by:** SOCRadar Threat Research Unit, from an exposed open directory
- **Status:** Active at the time of publication

## Sources

1. [SOCRadar Report](https://socradar.io/blog/cyberxero-ai-iab-ukraine-critical-infrastructure/)
2. [PentAGI Repo](https://github.com/vxcontrol/pentagi)
3. [Operation Master](https://socradar.io/blog/operation-master-intrusion-monetization-pipeline/)