CyberXero AI-augmented dual-pipeline campaign against WordPress and Ukrainian critical infrastructure
Campaign
Summary
Hide ▲
Show ▼
The CyberXero campaign is running dual AI-augmented access pipelines that are stealing access at scale from WordPress and e-commerce sites while also targeting Ukrainian energy and critical infrastructure. The operation combines Cobalt Strike with Claude Code and has been active since at least July 2026, increasing the risk of broader compromise and follow-on monetization. Researchers linked the activity to confirmed exfiltration from four Ukrainian organizations and more than 628,000 records tied to Ukrainian individuals. The same intrusion stack also showed automated scanning, web-shell deployment, and exploitation of exposed services.
Related Happenings
Ukrainian organizations' 628,000-record exfiltration
Data Leak
H score54
First: 12.10.2026 10:26
Last: 12.10.2026 10:26
Sources 1
How related:
"The campaign is estimated to have resulted in confirmed exfiltration from four Ukrainian organizations, leading to the harvesting of more than 628,000 records tied to Ukrainian individuals."
About this happening:
Confirmed exfiltration from four Ukrainian organizations exposed more than 628,000 records tied to Ukrainian individuals, creating a large-scale data-leak event. The stole...
Ukrainian organizations' 628,000-record exfiltration
Data LeakHow related: "The campaign is estimated to have resulted in confirmed exfiltration from four Ukrainian organizations, leading to the harvesting of more than 628,000 records tied to Ukrainian individuals."
About this happening: Confirmed exfiltration from four Ukrainian organizations exposed more than 628,000 records tied to Ukrainian individuals, creating a large-scale data-leak event. The stole...
Anthropic Claude misuse analysis of multi-agent reconnaissance, exploitation, and exfiltration
Technical Analysis
H score59
First: 11.09.2026 17:29
Last: 11.09.2026 17:29
Sources 1
About this happening:
Anthropic says Claude AI was abused by multiple threat groups, including ShinyHunters, Midnight Blizzard, and GTG-10007, for credential harvesting, recon...
Anthropic Claude misuse analysis of multi-agent reconnaissance, exploitation, and exfiltration
Technical AnalysisAbout this happening: Anthropic says Claude AI was abused by multiple threat groups, including ShinyHunters, Midnight Blizzard, and GTG-10007, for credential harvesting, recon...
Chinese-speaking operator AI-orchestrated intrusion campaign targeting government and financial systems
Campaign
H score48
First: 10.09.2026 20:47
Last: 10.09.2026 20:47
Sources 1
About this happening:
A Chinese-speaking operator is running an AI-orchestrated intrusion campaign that automates attacks against government and financial systems across multiple countries....
Chinese-speaking operator AI-orchestrated intrusion campaign targeting government and financial systems
CampaignAbout this happening: A Chinese-speaking operator is running an AI-orchestrated intrusion campaign that automates attacks against government and financial systems across multiple countries....
Aurora ransomware Cursor Agent exploitation campaign
Campaign
H score24
First: 28.08.2026 11:00
Last: 28.08.2026 11:00
Sources 1
About this happening:
Aurora ransomware operators used Cursor Agent and Claude Sonnet to support post-compromise exploitation against 10 victims between April 8 and May 26, 2026...
Aurora ransomware Cursor Agent exploitation campaign
CampaignAbout this happening: Aurora ransomware operators used Cursor Agent and Claude Sonnet to support post-compromise exploitation against 10 victims between April 8 and May 26, 2026...
Jewelbug's shared-infrastructure hack-for-hire model links espionage and crypto fraud
Threat Actor Meta
H score62
First: 14.08.2026 10:30
Last: 14.08.2026 10:30
Sources 1
About this happening:
Jewelbug is a China-linked hack-for-hire threat actor using shared XG-Web infrastructure to run espionage and cryptocurrency fraud in parallel. Broadcom’s Sy...
Jewelbug's shared-infrastructure hack-for-hire model links espionage and crypto fraud
Threat Actor MetaAbout this happening: Jewelbug is a China-linked hack-for-hire threat actor using shared XG-Web infrastructure to run espionage and cryptocurrency fraud in parallel. Broadcom’s Sy...
Timeline
-
12.10.2026 10:26 2 articles · 2h ago
CyberXero targets WordPress sites and Ukrainian critical infrastructure with AI-assisted access operations
Initial DisclosureSOCRadar disclosed that CyberXero, a Russian-speaking initial access broker active since at least July 2026, is running two AI-assisted pipelines: a global automated campaign against WordPress and e-commerce platforms and a curated manual campaign against Ukrainian energy and critical infrastructure, including a heating provider in Kharkiv. The activity uses Claude Code and Cobalt Strike, and researchers linked it to confirmed exfiltration from four Ukrainian organizations and more than 628,000 records tied to Ukrainian individuals.
Show sources
- CyberXero Uses Claude Code in Campaign That Stole Over 628,000 Ukrainian Records — thehackernews.com — 12.10.2026 10:26
- CyberXero Uses Claude Code in Campaign That Stole Over 628,000 Ukrainian Records — thehackernews.com — 12.10.2026 10:26