SOCRadar’s Threat Research Unit reported that an operation it calls CyberXero exfiltrated more than 628,000 records tied to Ukrainian individuals from four organizations. The October 6, 2026 report also describes Claude Code agents used in the operation, but its findings—including the activity and compromise claims—should be treated as SOCRadar’s account, not as independently verified facts.
What is CyberXero?
SOCRadar characterizes CyberXero as a financially motivated initial access broker: an operator seeking access to compromised systems that can be monetized. Its report describes two distinct activity pipelines, rather than one campaign with a single target profile.
As an Amazon Associate I earn from qualifying purchases.
| Pipeline | Targets and sectors | Reported workflow | Reported outcome |
|---|---|---|---|
| Global activity | WordPress sites, including e-commerce websites | Automated, high-volume scanning and exploitation | SOCRadar reports compromises and data exfiltration associated with this activity. |
| Ukraine-focused activity | Selected Ukrainian entities, particularly energy and utilities | Curated reconnaissance followed by manual exploitation, according to SOCRadar | SOCRadar reports confirmed exfiltration from four Ukrainian organizations. Seven energy and utility entities were under reconnaissance; the report does not say those seven were confirmed compromised. |
These outcomes are not interchangeable: the four organizations with reported exfiltration are separate from the seven energy and utility entities SOCRadar says were being investigated.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesHow was CyberXero discovered?
SOCRadar says its Threat Research Unit found the operation through an exposed directory that revealed the operator’s working files. The report says the directory included AI session logs, scripts containing plaintext tokens, and exfiltrated victim data. SOCRadar described the discovery this way: “The entire operation surfaced from a single configuration error: an exposed open directory that served the actor’s live working directory, including AI session logs, scripts with plaintext tokens, and exfiltrated victim data.”
#1 Best Overall
That exposure is the basis for SOCRadar’s account of the operation. A secondary report by CyPro says the active-status assessment and detailed operational figures had not been independently confirmed in a separate technical investigation. The full origin of the Ukrainian dataset is also unclear in that secondary account.
What does the report say about Claude Code and AI?
According to SOCRadar, the operator’s workstation used up to 51 specialized Claude Code agents. The report also describes a separate PentAGI deployment connected to a Cobalt Strike Team Server through an AI-provider API. These are two reported components; the report does not describe them as a single AI system.
SOCRadar says recovered AI session logs show both model refusals and operator attempts to work around them, including reframing requests and resetting sessions. This is an account of specific recovered logs, not a controlled test of model safety or evidence that the same behavior occurs in other situations.
Free tools Windows power users keep installed
One-click scans. No signup required.
What scale of WordPress activity did SOCRadar report?
SOCRadar says one automated run scanned 4,708 targets, found 429 accessible WordPress administration panels, and deployed 32 shells in a 61-second window. These figures describe the run reported by SOCRadar; they should not be read as an independently verified measure of the operation’s overall activity.
Rank #3
The report identifies WordPress administrator usernames matching wp2_ followed by eight hexadecimal characters as a hunting clue associated with its reported wp2shell activity. Finding a matching username is a reason to investigate the account and site, not proof by itself that a site was compromised.
What is established about the Ukrainian records and targets?
SOCRadar reports confirmed exfiltration from four Ukrainian organizations involving more than 628,000 records tied to Ukrainian individuals. Separately, it says seven Ukrainian energy and utility entities were subject to curated reconnaissance. The report does not establish that those seven entities were breached, and the secondary account says the dataset’s full origin is unclear.
The claims are attributed to SOCRadar’s Threat Research Unit, whose report was published October 6, 2026. CyPro’s secondary coverage cautions that the findings and active-status assessment were not independently confirmed through a separate technical investigation.
Quick Recap
Best Value
Sources
- SOCRadar Threat Research Unit, “CyberXero: An AI-Augmented Initial Access Broker Targeting Ukrainian Critical Infrastructure,” October 6, 2026
- CyPro, “CyberXero Attacks Target WordPress at Scale,” October 2026
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
