A Russian-speaking, financially motivated initial access broker tracked as CyberXero has used Claude Code, configured with 51 specialized agents, to scan for and exploit vulnerable systems, and the operation has exfiltrated more than 628,000 records from Ukrainian organizations. SOCRadar researchers uncovered the campaign, which they describe as ongoing, after finding an exposed directory on the server at 46.21.250[.]135.
CyberXero Campaign Hit Four Ukrainian Victims and Sites Across Four Countries
CyberXero has been active since at least July. SOCRadar confirmed four Ukrainian victims, including energy and utilities targets, whose records account for the 628,000-plus figure. The broker’s reach extended beyond those four organizations: WordPress and e-commerce sites in Ukraine, Poland, China and the Netherlands were also compromised.
Initial access brokers sell footholds in compromised networks to other criminals, and the CyberXero findings show the group building that inventory at machine speed. SOCRadar’s analysis points to automation as the defining feature of the operation, with AI agents handling work that operators once performed by hand.
How CyberXero Wired 51 Claude Code Agents Into PentAGI and Cobalt Strike
The operators did not use Claude Code as a standalone assistant. According to SOCRadar, they organized it into 51 specialized agents dedicated to scanning and exploitation, then integrated those agents with PentAGI and Cobalt Strike. That arrangement let the agents discover targets, attack them and hand off access through established post-exploitation tooling.
The group also had to get past the model’s safety controls. SOCRadar reports that the operators used context-engineering and session-reset techniques to bypass those controls, steering the AI into carrying out tasks it would otherwise have refused.
The Scale of Automation: 4,708 Systems Scanned and 32 Web Shells in 61 Seconds
The exposed directory gave SOCRadar a record of how quickly the agents worked. One automated scan targeted 4,708 systems. From that scan, 429 WordPress admin panels were compromised, and 32 web shells were deployed in just 61 seconds.
The speed matters for brokers because their business depends on volume. A single run that converts hundreds of admin panels into access points produces a large stock of footholds for resale or follow-on attacks, and it does so faster than a human team could.
Exploited Flaws: CVE-2026-63030, CVE-2026-60137 and CVE-2026-4815
SOCRadar identified the vulnerabilities the agents used to gain entry. They are CVE-2026-63030, CVE-2026-60137 (tracked as wp2shell) and CVE-2026-4815. The operators also exploited a Redis server as part of the activity.
The WordPress focus explains the pattern of victims. Admin-panel compromise followed by web shell deployment gives an attacker persistent control of a site, and the same technique worked against both the Ukrainian organizations and the commercial e-commerce sites in the other three countries.
Records Stolen From Energy and Utilities Targets
The four confirmed Ukrainian victims include energy and utilities targets, and the combined theft exceeds 628,000 records. SOCRadar’s findings do not break the total down by victim, and the data fields involved were not itemized in the report.
The report does not say who has purchased access from CyberXero or whether the stolen records have been sold.
SOCRadar’s Guidance for Defenders Hunting CyberXero Activity
SOCRadar advised organizations to check for three specific indicators of compromise: rogue WordPress administrator accounts, WSO web shells and unauthorized SSH keys. Each is a persistence mechanism an attacker can leave behind on a compromised site.
Finding any of the three means an attacker established lasting access rather than simply probing the site. The server address 46.21.250[.]135, where SOCRadar found the exposed directory, is the other concrete indicator the researchers published.
What the Campaign Shows About AI-Assisted Intrusion
The CyberXero campaign is an example of attackers combining a commercial AI coding tool with established offensive frameworks to scale up exploitation. The 61-second web shell deployment and the 4,708-system scan show the effect of that combination in concrete numbers.
The bypass of Claude Code’s safety controls through context-engineering and session resets is the part of the report most relevant to AI developers. The campaign was still described as ongoing when SOCRadar’s findings became public, so the record count and the list of affected countries may grow as investigators learn more about what the agents reached.
