Key points
- CyberXero used 51 AI agents and Anthropic's Claude Code to orchestrate attacks against WordPress sites and Ukrainian critical infrastructure.
- An exposed server directory on IP 46.21.250.135 leaked over 90,000 files, including stolen data and AI session logs.
- The campaign confirmed the exfiltration of more than 628,000 records belonging to Ukrainian individuals, with breaches also in Poland, China, and the Netherlands.
The short version
- SOCRadar researchers identified CyberXero, a financially motivated initial access broker using AI to automate cyberattacks.
- The group targeted WordPress sites globally and Ukrainian energy providers specifically, stealing over 628,000 records.
- A misconfigured server exposed the attacker’s entire working directory, including scripts, tokens, and victim data.
The details
SOCRadar researchers disclosed details of a campaign attributed to CyberXero, a Russian-speaking initial access broker active since at least July 2026, according to a report published by The Hacker News. The operation combines commodity offensive tools like Cobalt Strike with an AI orchestration layer powered by Anthropic's Claude Code. Security Affairs noted that the group deployed 51 AI agents to support these cyberattacks. The broker sells network access to other criminals rather than exploiting it directly for financial gain.
The operation runs two distinct pipelines simultaneously. One is a global, automated campaign targeting WordPress sites and e-commerce platforms worldwide. The other is a curated, manual campaign focusing on Ukrainian energy and critical infrastructure, including a heating provider in Kharkiv, according to SOCRadar. The group confirmed the exfiltration of more than 628,000 records tied to Ukrainian individuals. Confirmed compromises also occurred in Poland, China, and the Netherlands.
The context
SOCRadar discovered the operation after identifying an exposed open directory hosted at IP address 46.21.250.135, according to The Hacker News. This misconfiguration leaked the threat actor’s live working directory from a Linux workstation. The exposed server contained more than 90,000 files, including AI session logs, scripts with plaintext tokens, exploitation toolkits, reconnaissance output, and exfiltrated victim data, according to Security Affairs.
The global campaign uses a custom tool called wp2shell to exploit flaws in the WordPress REST API, according to Security Affairs. This tool injects SQL, creates rogue admin accounts, and drops web shells. Analysis showed a single automated execution scanned 4,708 targets, confirming access to 429 WordPress administration panels and deploying 32 web shells in 61 seconds, according to The Hacker News. The campaign also targets known vulnerabilities, including CVE-2026-63030, CVE-2026-60137, and CVE-2026-4815, an SQL injection flaw in the Support Board plugin.
What to watch
The campaign remains ongoing, according to SOCRadar. Researchers noted that session logs recording planned targets and workaround attempts act like a keylogger for the attacker’s own operation. The group continues to use the same infrastructure for both automated and manual attacks. Organizations should monitor for unusual administrative account creation and rapid web shell deployments.
Background: Initial access brokers
Initial access brokers exploit human error and weak configuration. Stop buying their inventory by enforcing strict identity controls, segmenting networks, and verifying external links. These six fixes close the doors they use to resell access to ransomware groups.
Read the full guide: Initial Access Broker Mistakes That Open Your Network
What to do and how to stay safe: CyberXero
- Audit WordPress installations for known vulnerabilities, specifically CVE-2026-63030, CVE-2026-60137, and CVE-2026-4815, and remove unused plugins like Support Board.
- Review server configurations to ensure no open directories or sensitive files are publicly accessible without authentication.
- Monitor WordPress administration panels for unauthorized new accounts or unexpected web shell files.
- Verify that AI session logs and plaintext tokens are not stored on servers accessible via the internet.
Step-by-step guide: Shadow AI Mistakes That Put Corporate Data at Risk
General security guidance from the TechSec Headlines newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CyberXero?
CyberXero is a Russian-speaking, financially motivated initial access broker that uses AI agents and traditional hacking tools to breach networks and sell access to other criminals.
How many records were stolen?
More than 628,000 records tied to Ukrainian individuals were confirmed to have been exfiltrated by the CyberXero campaign.
What vulnerabilities did the attackers use?
The attackers exploited CVE-2026-63030, CVE-2026-60137, and CVE-2026-4815, an SQL injection vulnerability in the Support Board WordPress plugin.
