A new threat investigation has exposed the operations of CyberXero, a financially motivated initial access broker that reportedly uses artificial intelligence to accelerate cyberattacks against organizations worldwide, including entities connected to Ukraine’s critical energy infrastructure. According to research by SOCRadar’s Threat Research Unit, the actor combines AI-powered penetration-testing frameworks, specialized AI agents and automated exploitation tools to identify vulnerable systems, gain unauthorized access and collect sensitive information at scale.
A financially motivated cybercriminal operating under the alias CyberXero has combined artificial intelligence, automated exploitation tools and conventional hacking techniques to compromise organizations across multiple countries, according to an investigation by SOCRadar’s Threat Research Unit. The findings are particularly alarming in Ukraine, where the actor reportedly obtained personal data relating to more than 628,000 individuals while conducting targeted reconnaissance against energy and utility providers.
The investigation also uncovered an operation capable of compromising hundreds of WordPress administration panels in a single automated run, alongside a network of AI agents designed to assist with reconnaissance, exploitation and post-compromise activities. The actor’s exposed working directory – containing more than 90,000 files, operational scripts and AI session logs – gave researchers an unusually detailed view of the operation.
The case highlights a growing cybersecurity challenge: AI is not replacing established hacking methods, but it can help a single operator coordinate them at a scale that would previously have demanded substantially more time and resources. For organizations responsible for critical infrastructure, online platforms and sensitive personal data, CyberXero is a warning about the convergence of automation, AI-assisted attacks and weaknesses in basic security practices.
Who is CyberXero?
SOCRadar describes CyberXero as a Russian-speaking, financially motivated Initial Access Broker (IAB). Rather than relying solely on direct fraud or ransomware, an IAB gains unauthorized access to organizations and sells that access to other threat actors, who may use it for further intrusions, data theft or other criminal activity.
The operation was first observed in July 2026. Its infrastructure and recovered activity logs indicate that the operator targeted a broad range of organizations, including e-commerce businesses, telecommunications providers, government entities and Ukrainian energy companies.
What distinguishes CyberXero is its use of AI as an operational layer around existing offensive tools. Researchers documented a workstation configured with as many as 51 specialized Claude Code agents, alongside a separate deployment of PentAGI, an AI-assisted penetration-testing framework connected to a Cobalt Strike command-and-control server through an AI provider API.
These components served different purposes. The agents helped organize reconnaissance, exploitation and post-exploitation tasks, while the PentAGI deployment supported automated security-testing workflows and payload generation. Traditional tools remained central to the operation.
The distinction is important: this was not an autonomous AI system independently carrying out every stage of an attack. It was a human-directed operation using AI to coordinate and accelerate activities that included scanning, exploiting vulnerabilities, establishing persistence and collecting data.
SOCRadar’s report also identifies a broader international footprint, with documented activity involving Ukraine, Poland, China and Pakistan. More than 40 organizations were reportedly affected across different countries and sectors, although the precise status and impact varied between confirmed compromises and unsuccessful or unconfirmed attempts.
One exposed directory uncovered the operation
The investigation began with a surprisingly basic security failure.
Researchers identified an internet-accessible HTTP server at 46.21.250.135 that exposed a directory without authentication. Instead of serving only intended public content, the directory revealed the working files of a Linux workstation used in the operation.
The exposed material included more than 90,000 files organized across approximately 3,000 subdirectories. Among them were reconnaissance results, exploitation tools, configuration files, AI agent definitions, session logs, provisioning information and exports containing victim data.
This gave investigators an opportunity to reconstruct how the operation worked. Tokens embedded in installation URLs, internal hostnames, SSH configuration details and correlated command histories helped researchers connect different systems to the same infrastructure.
The investigation ultimately mapped eight infrastructure nodes with high confidence, spread across three autonomous system networks and two regions. These included workstations, a provisioning server, payment infrastructure, a mass-scanning server and systems associated with command and control.
The discovery also illustrates the danger of poor operational security, or OPSEC. Cybercriminals often invest considerable effort in concealing their identities and infrastructure, yet an exposed directory can reveal information that would otherwise take investigators substantial time and resources to assemble.
For defenders, the lesson is equally direct: access controls and secure configuration matter even when the system being exposed is not part of a legitimate business environment. In CyberXero’s case, the same kind of configuration failure that organizations routinely guard against became the starting point for a detailed investigation of an active threat actor.
Two attack pipelines: global automation and targeted reconnaissance
SOCRadar’s findings describe two parallel streams of activity operating from the same broader environment. Their targeting patterns and apparent objectives were different.
The global campaign: WordPress and e-commerce
The first pipeline focused on obtaining access at scale. It targeted WordPress websites and e-commerce platforms, seeking administrator privileges, opportunities for payment-data theft and access that could potentially be sold to other criminals.
At the center of the WordPress campaign was an internally developed Python tool called wp2shell. According to the report, it abused a weakness in the processing of requests to the WordPress REST API batch endpoint to inject SQL, create unauthorized administrator accounts and deploy webshells.
A webshell is a malicious script installed on a compromised web server that can provide an attacker with a way to execute commands or maintain access. In this case, the tool deployed a WSO-family webshell and registered it as an active WordPress plugin.
The scale was substantial. In one automated execution, the operator scanned 4,708 targets, identified 429 accessible WordPress administration panels and deployed 32 webshells within approximately 61 seconds. The wider target set exceeded 56,000 identified URLs.
The campaign also extended beyond WordPress. Researchers documented exploitation attempts against other e-commerce technologies, including Magento, as well as a time-based SQL injection attack against Support Board 3.8.7 involving CVE-2026-4815.
These figures demonstrate the practical advantage of automation. A threat actor can test large numbers of targets, identify systems that appear vulnerable and concentrate follow-up activity on successful compromises. When AI agents help coordinate the workflow, the operator may be able to manage more parallel tasks without proportionally increasing the size of the team.
The targeted campaign: Ukrainian energy and utilities
The second pipeline was more selective and more concerning from a public-safety perspective.
Researchers found evidence of curated reconnaissance against seven Ukrainian energy and utilities organizations, including the national electricity transmission system operator and the country’s largest private energy holding. One target list contained 95 subdomains associated with two major organizations, spanning areas such as email infrastructure, VPN services, network dispatch systems and data platforms.
Four Ukrainian organizations had file-confirmed data exfiltration in the report. The most striking case involved a district heating provider in Kharkiv.
According to SOCRadar, a hardcoded credential in the actor’s own script provided access to the provider’s systems. The operator then extracted 564,073 subscriber records containing personal information, home addresses and account numbers, along with 213,340 access-log entries containing timestamps and IP addresses.
Other documented compromises involved an internet service provider and an e-commerce platform, while another affected gas-provider accounts and session tokens. The report also describes additional reconnaissance against energy-sector entities for which a successful compromise had not been confirmed.
More than 628,000 Ukrainian individuals had confirmed data in the actor’s possession, according to the investigation. That figure represents data records and individuals reported by researchers; it should not be interpreted as proof that every person suffered identity theft or that every record was subsequently sold.
The potential consequences nevertheless extend beyond conventional financial crime. Kharkiv is located close to an active conflict front, making the exposure of identifiable residents’ addresses and other personal information particularly sensitive. The report does not establish that the information was used to physically target civilians, but the possibility of misuse raises the stakes considerably.
SOCRadar considers access brokering to a buyer with an interest in Ukrainian critical infrastructure a plausible explanation for the targeted campaign. However, researchers did not recover direct evidence confirming a sale, identifying a buyer or establishing who ultimately intended to use the access. That uncertainty is important: the targeting is documented, but its ultimate purpose remains unresolved.
What the AI layer reveals about the next phase of cybercrime
AI’s role in CyberXero’s operation goes beyond using a chatbot to write scripts. The recovered configuration and session logs describe an organized system in which different agents were assigned specialized roles, including reconnaissance, exploit development, command-and-control operations and data collection.
The report identifies two main layers of AI integration:
- A collection of up to 51 specialized Claude Code agents running on the operator’s primary workstation.
- A PentAGI deployment connected to a Cobalt Strike server through an AI provider API, supporting automated workflows involving offensive tools.
This architecture allowed the operator to divide work into specialized tasks and use different model configurations according to the complexity of the job. More demanding tasks received greater reasoning resources, while simpler activities could use cheaper configurations.
That is a practical example of how AI can change the economics of cybercrime. An individual no longer needs to perform every repetitive task manually or switch constantly between tools and workflows. AI can help organize information, generate or adapt code, interpret results and coordinate subsequent steps.
But automation does not make every attack successful. Exploitation still depends on vulnerable systems, available credentials, network access and the quality of the tools being used. Human decisions also remain central to choosing targets and directing activity.
The CyberXero investigation is significant because researchers could examine the actor’s own operational files rather than infer AI usage from an attack’s outcome alone. The evidence provides a rare view into how AI-assisted offensive workflows were configured and used in practice.
AI safety refusals did not always stop the operator
One of the report’s most notable findings concerns attempts to work around AI safety restrictions.
The recovered session logs showed the operator repeatedly presenting requests as authorized penetration tests against systems supposedly under their own control. Researchers found the same ownership narrative in interactions relating to multiple unrelated victims, suggesting that it was a rehearsed tactic rather than a consistent description of legitimate authorization.
The logs also documented session resets. When a model refused a request, the operator sometimes opened a fresh session with a revised description of the task.
This is an example of context engineering: changing the information and framing supplied to a model in an attempt to influence how it interprets a request. It does not mean the model’s underlying safeguards were technically disabled.
Importantly, the report also recorded refusals that held. Models declined certain requests involving backdoors, firewall disabling, lateral movement and webshell deployment, and repeatedly rejected another scan request.
The findings therefore present a more nuanced picture than either extreme claim that AI safeguards are useless or that a refusal necessarily ends a malicious workflow. Controls can prevent individual actions, but their effectiveness also depends on how AI tools are deployed, the privileges they receive and the surrounding infrastructure.
For organizations using AI agents in software development, IT operations or security testing, the implications are substantial. An agent with terminal access, network permissions or access to sensitive business data can become a security risk if its activities are not properly constrained and monitored.
SOCRadar’s researchers argue that agent session logs should be treated like other sensitive operational records. These logs can reveal targets, planned tasks, credentials, internal infrastructure details and the results of previous actions. If exposed, they may provide an attacker with a detailed picture of an organization’s environment or an adversary’s methods.
AI governance must therefore extend beyond model selection and acceptable-use policies. It needs to cover permissions, secrets management, logging, monitoring, retention and incident response.
Ten steps security teams should take now
The CyberXero case provides practical lessons for organizations running public-facing websites, e-commerce platforms, cloud services and critical infrastructure. Security teams should prioritize the following actions.
1. Patch internet-facing applications. Review WordPress, Magento, PrestaShop and other web applications for known vulnerabilities. Verify fixes against trusted vendor advisories, update vulnerable components and remove unsupported plugins and themes.
2. Hunt for unauthorized WordPress administrators. Investigate unexpected administrator accounts, particularly usernames matching the pattern wp2_ followed by eight hexadecimal characters. Check account creation times, privilege changes and associated login activity.
3. Search for webshells and persistence mechanisms. Examine WordPress plugin directories for suspicious paths matching /wp-content/plugins/wp2shell_[0-9a-f]{8}/. Look for unexpected PHP files, unauthorized plugins, altered application code and unfamiliar scheduled tasks. Do not rely on antivirus detection alone.
4. Investigate suspected SQL injection and data theft. Review web server, application and database logs for unusual requests, repeated parameter manipulation, unexpected database queries and suspicious bulk exports. Preserve forensic evidence before rebuilding compromised systems.
5. Restrict access to Redis and other administrative services. Redis should not be unnecessarily exposed to the public internet. Restrict network access, enforce authentication and appropriate permissions, and inspect SSH authorized_keys files for unauthorized additions on systems that may have been exposed.
6. Review outbound traffic and command-and-control indicators. Check security telemetry for communications with the infrastructure identified in the report, including 42.193.227.214 on ports 1002, 8044 and 8033. These are investigation leads, not proof of compromise; validate them against current threat intelligence and local telemetry before blocking or escalating.
7. Secure AI agents with least privilege. Give AI tools only the permissions they need. Isolate agent execution environments, restrict access to production systems, control outbound connections and require human approval for high-impact actions such as modifying infrastructure or accessing sensitive datasets.
8. Protect AI session logs and credentials. Prevent tokens, passwords, API keys and other secrets from appearing in logs or configuration files. Encrypt sensitive records, restrict access, define appropriate retention periods and rotate credentials if exposure is suspected.
9. Strengthen monitoring and incident response. Correlate website, endpoint, identity, database and network events. Prepare procedures for isolating compromised hosts, revoking sessions, rotating credentials, investigating data exfiltration and notifying affected parties when required.
10. Train staff and test defenses regularly. Conduct authorized penetration tests, vulnerability assessments and incident-response exercises. Provide practical cybersecurity training and awareness for developers, system administrators and security teams, with emphasis on secure configuration, credential handling, web application security and the safe use of AI tools.
Organizations seeking additional support can explore Saintynet Cybersecurity for cybersecurity services, security assessments and professional training.
Why CyberXero matters beyond Ukraine
Although Ukraine’s energy sector is the most sensitive part of this investigation, the operation has wider implications for organizations worldwide.
For financial institutions and e-commerce businesses, automated exploitation can put customer information, payment processes and online services at risk. Telecommunications providers and government agencies face the possibility of compromised credentials, unauthorized access and subsequent movement into internal networks. Critical infrastructure operators face an additional concern: unauthorized access to operationally important systems can create consequences that extend beyond financial losses.
Organizations across the Middle East and Africa should take note without assuming that they are specifically targeted by CyberXero. Public-facing websites, online customer portals, exposed management interfaces and poorly controlled third-party access can provide entry points for financially motivated attackers regardless of geography.
The report also reinforces a broader lesson for enterprises adopting AI. As AI agents gain access to code repositories, cloud consoles, internal documentation and administrative tools, their permissions and activity logs become part of the organization’s security boundary. An improperly secured agent can expose sensitive information or accelerate harmful actions, even when the underlying model is not compromised.
Security leaders should therefore assess AI-enabled workflows with the same rigor applied to privileged accounts, automation platforms and other systems capable of making changes at scale.
Conclusion: AI is amplifying an existing threat
CyberXero illustrates how one operator can combine established exploitation techniques, commodity offensive tools and AI-assisted workflows to run campaigns across multiple countries and sectors.
The investigation documented a global effort against WordPress and e-commerce platforms alongside targeted reconnaissance and confirmed data theft involving Ukrainian organizations. More than 628,000 Ukrainian individuals reportedly had personal data in the actor’s possession, including information associated with residents of Kharkiv. Meanwhile, the use of specialized AI agents demonstrated how automation can increase the speed and scale of offensive operations.
The ultimate purpose of the activity against Ukrainian critical infrastructure remains unresolved. Researchers identified access brokering as a plausible explanation, but did not establish that the compromised access was sold or identify a final buyer.
For defenders, the immediate priorities are clearer: patch exposed applications, investigate unauthorized accounts and webshells, restrict administrative services, secure credentials and tightly control AI agents with access to sensitive environments.
CyberXero’s exposed directory also offers a final reminder. Advanced tooling and sophisticated automation cannot compensate for basic operational discipline. For attackers and defenders alike, a single configuration error can change the course of an entire security investigation.
Sources and further reading
- Primary research: SOCRadar – CyberXero: An AI-Augmented Initial Access Broker Targeting Ukrainian Critical Infrastructure
- Technical indicators: Consult the full SOCRadar report for its complete infrastructure analysis, hashes, detection rules and indicators of compromise.
- Cybersecurity news and analysis: Cybercory
- Cybersecurity services and training: Saintynet Cybersecurity
