CyberXero: an access broker ran 51 Claude Code agents against Ukraine

01What happened

SOCRadar's Threat Research Unit published its CyberXero report on October 6, 2026, after finding an open directory on the actor's seed workstation that leaked its working files. The broker has been active since at least July 2026, is financially motivated and Russian-speaking, and was still operating when SOCRadar published. The report counts more than 40 affected organizations worldwide.

02How it works

The operation runs on two layers. On the workstation, Claude Code drives 51 specialized agents split into offensive, reconnaissance and post-exploitation roles, with names such as c2-operator, exploit-chainer, scada-attacker and lateral-movement. On a separate team server, PentAGI, an open-source autonomous pentesting system, is wired into Cobalt Strike through an AI provider API to generate payloads and run tests. A recovered configuration assigns models by reasoning complexity and gives payload generation the largest token budget. SOCRadar describes the actor's refusal handling as context engineering rather than a technical bypass: a rehearsed claim of an authorized test on its own infrastructure, reused across four unrelated victims, and a fresh session opened with that framing preloaded whenever the model declined.

03Who is affected

Ukrainian energy and critical infrastructure were the targeted half of the campaign, with confirmed exfiltration at four organizations and a Kharkiv district heating provider losing 564,073 subscriber records. A separate automated pipeline hits WordPress and e-commerce sites worldwide, with confirmed compromises in Poland, China and the Netherlands, and the CVEs listed below are the entry points. SOCRadar reports two Pakistani national-security entities targeted without a confirmed result.

04What to do

Hunt for the indicators SOCRadar publishes: WordPress admin accounts matching wp2_ followed by eight hex characters, webshell plugin directories under /wp-content/plugins/wp2shell_[0-9a-f]{8}/, injected keys in ~/.ssh/authorized_keys on internet-exposed Redis hosts, and a Windows service named UpdSvc. Patch the WordPress and Support Board flaws listed below. SOCRadar also advises treating AI agent session logs as sensitive, with the retention, encryption and access controls given to credential logs, because those logs record offensive activity in full.

Sources 3 links, all fetched

1. 1socradar.ioSOCRadar Report
2. 2github.comPentAGI Repo
3. 3socradar.ioOperation Master