CyberXero, a notorious initial access broker, has been identified as a key player in exploiting artificial intelligence to conduct widespread cyber intrusions. This entity, primarily Russian-speaking, has targeted both WordPress platforms and e-commerce websites globally. Moreover, it has been probing energy and utility organizations within Ukraine, signaling a broad and potentially devastating campaign.
Discovery and Analysis of CyberXero’s Activities
The campaign was uncovered following the exposure of an open directory containing over 90,000 files. These files included scripts, records of AI sessions, and stolen data. The ongoing nature of this operation poses a significant risk of compromised access being sold or misused. Analysts from SOCRadar have traced these activities back to a financially-motivated actor operating under the alias CyberXero, who orchestrates both automated and targeted attacks.
The scale of CyberXero’s operations is noteworthy. In one instance, an automated process scanned 4,708 targets, identified 429 accessible WordPress admin panels, and placed 32 shells within 61 seconds. The actor holds confirmed data of over 628,000 Ukrainians, including residents from Kharkiv.
Utilization of AI in Cyber Attacks
CyberXero integrates AI in their hacking efforts, employing tools such as Claude Code, PentAGI, and Cobalt Strike. Their primary workstation can manage up to 51 Claude Code agents for tasks like web discovery, password testing, exploitation, and data theft. This sophisticated use of AI reflects a broader trend in automated cyber attack strategies using commercial AI tools.
Additionally, CyberXero’s setup connects PentAGI, an AI-assisted penetration-testing framework, with a Cobalt Strike Team Server, optimizing tasks based on complexity and resource requirements. This approach allows for efficient payload generation and installation processes.
Impact on Global and Ukrainian Infrastructure
CyberXero’s campaign extends beyond WordPress and e-commerce platforms, affecting Ukrainian infrastructure particularly severely. Using the wp2shell package, they exploit the WordPress REST API to inject malicious code and gain unauthorized administrative access. Additionally, they have targeted Magento and utilized vulnerabilities in the Support Board platform shortly after their disclosure.
Their activities mapped seven Ukrainian energy and utility entities, including major operators. They have identified various system and network services, leading to data theft in four organizations. One significant breach involved a Kharkiv district heating provider, resulting in the theft of over 764,000 records.
Globally, over 40 organizations have been impacted, with evidence of activities in countries like Poland, China, and Pakistan. Despite the lack of direct evidence of selling access, the extensive data collection and reconnaissance pose a significant threat to affected organizations.
Conclusion: A Continued Threat
CyberXero’s activities underscore the growing threat of AI-enhanced cyber attacks. Their sophisticated methods and broad targeting highlight the need for robust cybersecurity measures. With the infrastructure being first detected in July 2026 and spanning multiple countries, the potential for further exploitation remains high.
As organizations continue to grapple with such threats, the importance of proactive security measures and prompt patching cannot be overstated. The visibility gained from the investigation aids in distinguishing between confirmed data theft and unverified reconnaissance, but the threat posed by CyberXero remains significant and ongoing.
