CyberXero Uses AI to Steal 628,000 Ukrainian Records in Campaign
Researchers attribute an AI-augmented intrusion campaign targeting Ukrainian infrastructure and global WordPress sites to the broker group CyberXero.
Key points
- The group used Anthropic's Claude Code to orchestrate attacks on WordPress and critical infrastructure.
- Over 628,000 records linked to Ukrainian individuals were exfiltrated from four organizations.
- An exposed directory on a Linux workstation leaked scripts, tokens, and AI session logs.
Cybersecurity researchers have identified a two-pronged campaign by the initial access broker CyberXero that leverages artificial intelligence to compromise WordPress sites and Ukrainian critical infrastructure. According to a report by SOCRadar, the group used Anthropic's Claude Code to automate parts of its intrusion process.
The operation targets both global e-commerce platforms and specific entities in Ukraine. SOCRadar stated that the activity involves combining commodity tools like Cobalt Strike with an AI orchestration layer. The group has been active since at least July 2026 and is financially motivated.
Campaign Mechanics and Discovery
SOCRadar discovered the operation after finding an exposed open directory at IP address 46.21.250[.]135. This directory leaked the live working environment of a Linux workstation used by the threat actor. The exposure included AI session logs, exploitation toolkits, reconnaissance output, and scripts containing plaintext tokens.
The analysis revealed that a single automated execution scanned 4,708 targets. The system confirmed access to 429 WordPress administration panels. Within a 61-second window, the automated process deployed 32 web shells on the compromised sites. This speed demonstrates the efficiency of the AI-assisted workflow.
Targeting and Impact
The campaign runs two distinct pipelines simultaneously. The first is a global, automated effort against WordPress and e-commerce platforms. This track exploits known security flaws, including wp2shell (CVE-2026-63030 and CVE-2026-60137) and CVE-2026-4815. The latter is an SQL injection vulnerability in the Support Board WordPress plugin.
The second pipeline is a curated, manual campaign focused on Ukrainian energy and utilities. SOCRadar noted that this track includes deep reconnaissance against a heating provider in Kharkiv. The opportunistic global campaign aims to harvest access and payment data, while the targeted track seeks deeper infiltration.
Confirmed exfiltration occurred from four Ukrainian organizations, resulting in the theft of more than 628,000 records tied to Ukrainian individuals. Other confirmed compromises have been identified in Poland, China, and the Netherlands. The campaign remains ongoing as of the latest report.
What should you do?
Administrators should audit their WordPress installations for the specific plugins and vulnerabilities mentioned in the report. Organizations should monitor for unusual outbound traffic or unauthorized administrative access, which may indicate a breach. Security teams should review exposed directories and ensure that sensitive configuration files are not publicly accessible.
What to do and how to stay safe: CyberXero
- Scan WordPress sites for the Support Board plugin and update or remove it to mitigate CVE-2026-4815.
- Check for the presence of web shells in web directories, especially after any suspected unauthorized access.
- Review server logs for rapid, automated scanning activity that matches the profile of the CyberXero campaign.
- Ensure that development and working directories are not exposed to the public internet via open directory listings.
Step-by-step guide: Prompt Injection Warning Signs: How to Spot AI Manipulation
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What AI tool did CyberXero use in this campaign?
The group used Anthropic's Claude Code as an orchestration layer to automate parts of its intrusion process.
How many records were stolen from Ukrainian organizations?
More than 628,000 records tied to Ukrainian individuals were exfiltrated from four confirmed organizations.
Which vulnerabilities were exploited in the global campaign?
The campaign exploited wp2shell (CVE-2026-63030 and CVE-2026-60137) and CVE-2026-4815 in the Support Board plugin.
