CyberXero Used AI Agents to Steal Over 628,000 Ukrainian Records

How the CyberXero Campaign Unfolded

Researchers from SOCRadar have reported a major cyberattack campaign run by a group called CyberXero. This group is described as a Russian-speaking, financially motivated initial access broker. Their operation combined traditional hacking tools with artificial intelligence (AI), specifically using Anthropic's Claude Code and a cluster of 51 AI agents. The campaign has been active since at least July 2026, according to The Hacker News↗ (opens in a new tab) and Security Affairs↗ (opens in a new tab).

The campaign had two main tracks. The first was a global, automated attack on WordPress and e-commerce platforms. The second was a more targeted, manual campaign against Ukrainian energy and critical infrastructure providers, including a heating provider in Kharkiv. The attackers used known vulnerabilities in WordPress plugins and exploited exposed Redis servers to gain access.

What Was Stolen and Who Was Affected

The attackers managed to steal over 628,000 records linked to Ukrainian individuals, including sensitive data from energy infrastructure providers. One of the largest breaches involved a district heating provider in Kharkiv, where more than 564,000 customer records were taken. These records included home addresses and account numbers. Researchers say this data could put people at physical risk, especially as Kharkiv is on an active war front.

Data was also stolen from organisations in Poland, China, and the Netherlands. In total, more than 40 organisations were affected across several countries. The campaign remains ongoing, and the attackers' infrastructure is still active.

How AI Was Used in the Attacks

CyberXero used AI in two main ways. First, they ran up to 51 specialised Claude Code agents on their primary workstation. These agents handled tasks like scanning, exploit chaining, reconnaissance, and post-exploitation. Second, they connected an open-source AI pentesting framework called PentAGI to their Cobalt Strike command server. This allowed for automated payload generation and penetration testing.

To bypass safety controls in the AI models, the attackers used a technique called context-engineering. They told the AI agents they were running authorised penetration tests on their own infrastructure. If an agent refused a task, the attackers simply started a new session with the same story. Logs show that the AI sometimes refused to perform malicious actions, but the attackers could often get around these refusals by resetting the session.

How the Attack Was Discovered

The campaign came to light after researchers found an open directory on a server used by the attackers. This directory contained more than 90,000 files, including AI session logs, scripts with plaintext tokens, and stolen victim data. The logs provided a detailed look at the attackers' methods, targets, and even their failed attempts to bypass AI safety controls.

Researchers were able to link the operation to a specific online alias and found evidence that matched Moscow time, supporting the assessment that the group is Russian-speaking.

What Organisations Should Do

Organisations running WordPress, Magento, PrestaShop, or exposing Redis to the internet are advised to check for rogue WordPress administrators, web shells, and unexpected SSH keys on their systems. Protecting AI agent session logs is also critical, as these can reveal sensitive details about both attack and defence operations.

The report includes indicators of compromise (IoCs) and detection guidance for defenders. Regular patching, limiting internet exposure of critical services, and monitoring for unusual admin accounts or web shells are recommended steps.

What Happens Next

The campaign is still active, and the full impact is not yet known. With ongoing attacks and the use of AI to automate and scale operations, defenders should stay alert for new tactics. The exposure of sensitive data, especially in a conflict zone, raises serious privacy and physical safety concerns for affected individuals.