CyberXero Uses Claude Code in Theft of 628,000+ Ukrainian Records

CyberXero used Anthropic’s Claude Code in a campaign that stole more than 628,000 records tied to Ukrainians, according to SOCRadar’s Oct. 6 investigation. A district heating provider in Kharkiv was among the confirmed victims.

SOCRadar investigators connected the Russian-speaking initial access broker to two operations: automated attacks on WordPress and e-commerce websites worldwide, and targeted reconnaissance against Ukrainian energy and utility organizations. They confirmed data theft from four Ukrainian organizations and separate probing of seven energy and utility entities. 

For European security teams, the case raises immediate questions about vulnerable web applications, access monitoring, and the protection of sensitive customer databases.

How CyberXero used AI agents to exploit websites at scale

SOCRadar traced the activity after finding an unsecured directory on the attacker's server. The exposed files included scripts, stolen data, AI session logs, and configurations linking the campaign to an automated toolset.

The operator configured up to 51 Claude Code agents for reconnaissance, exploitation, and post-exploitation. A separate PentAGI deployment integrated with a Cobalt Strike Team Server and used an AI provider API to support payload generation and penetration-testing tasks.

The Hacker News reported that one 61-second run scanned 4,708 targets, confirmed access to 429 WordPress administration panels, and deployed 32 web shells. The attacker exploited vulnerabilities including CVE-2026-63030, CVE-2026-60137, and the Support Board plugin's CVE-2026-4815.

Recovered logs also showed CyberXero describing malicious tasks as authorized penetration testing and reopening sessions after model refusals. Researchers also documented refusals that held, including requests to install backdoors and disable firewalls.

Kharkiv heating data stolen as Ukrainian utilities face probing

At a district heating provider in Kharkiv, attackers obtained 564,073 subscriber records containing personal data, home addresses, and account numbers. Another 213,340 access-log entries contained timestamps and IP addresses. Those logs are a separate dataset, not another 213,340 affected people.

SOCRadar also identified reconnaissance against seven Ukrainian energy and utility entities, including major electricity organizations. Target lists covered email, VPN, and network dispatch infrastructure, but the investigation did not confirm those seven entities were breached or that services were disrupted.

Beyond Ukraine, the investigation confirmed e-commerce compromises in Poland. For European organizations operating similar public-facing websites, the campaign extends beyond Ukrainian critical infrastructure.

The exposure of home addresses is especially concerning in Kharkiv, a city near an active war front. SOCRadar described CyberXero as financially motivated, but found no direct evidence that access to Ukrainian utilities had been sold.

What European security teams should investigate now

The campaign targeted familiar weaknesses, but automation compressed defenders' response time. Security teams can prioritize three checks:

• Inspect WordPress sites. Patch affected components and investigate unauthorized accounts starting with wp2_, suspicious wp2shell_ plugin directories, and WSO-family web shells.
• Review exposed infrastructure. Restrict public Redis access, check ~/.ssh/authorized_keys for unfamiliar entries, and investigate connections matching SOCRadar's published indicators.
• Monitor customer databases. Alert on unusual bulk exports, unexpected account privileges, and unexplained access to subscriber information, especially at energy and utility providers.

Organizations deploying their own AI agents should also protect session logs and tokens. CyberXero's exposed logs let investigators reconstruct the campaign, showing how much operational detail those files can contain.

In Kharkiv, researchers documented stolen customer information without confirming a heating outage. European utilities should treat unusual subscriber-data exports and privileged account activity as urgent security events, even when essential services remain operational.

Also read: European organizations face another threat through Microsoft logins. The N0va phishkit abuses device-code authentication to obtain access tokens even after users complete MFA.