The Pulse
SOCRadar Finds CyberXero Configured 51 Claude Code Agents
SOCRadar says CyberXero used an AI-assisted attack system with 51 specialized Claude Code agents and PentAGI linked to Cobalt Strike. The security firm also reports 32 web shells deployed in one 61-second run and data from more than 628,000
AI.info Team · Written with AI ·
On October 6, SOCRadar described how an exposed directory opened a view into CyberXero’s operation: more than 90,000 files, including attack scripts, victim data and AI session logs. The firm’s Threat Research Unit says the Russian-speaking, financially motivated access broker paired conventional offensive tools with an AI orchestration system. Its investigation describes two concurrent campaigns: mass targeting of WordPress and e-commerce sites, and more selective reconnaissance of Ukrainian energy and utility organizations.
Files exposed a two-layer AI system
SOCRadar says it found 51 specialized Claude Code agent definitions on CyberXero’s primary workstation, divided among reconnaissance, exploitation and post-exploitation tasks. A second layer connected the open-source testing framework PentAGI to a Cobalt Strike team server through an AI-provider API. The report describes configured agents and tooling; it does not establish that every agent operated at once or that the attacks ran without human direction.
“The second layer runs on the Team Server and integrates PentAGI, an open-source AI-augmented pentesting framework, with Cobalt Strike through an AI provider API.”
SOCRadar Threat Research Unit
SOCRadar says one automated run scanned 4,708 targets, confirmed access to 429 WordPress administration panels and deployed 32 web shells within 61 seconds. Those figures describe separate stages of the run: the report does not say that all 429 panels received a shell. The broader operation also targeted e-commerce platforms, including through exploitation of a vulnerability in the Support Board software.
Ukraine targeting went beyond the mass campaign
The firm found curated reconnaissance against seven Ukrainian energy and utility entities, including the national transmission system operator and the country’s largest private energy holding. A target list covered 95 subdomains belonging to those two organizations. Separately, SOCRadar says it confirmed data exfiltration from four Ukrainian organizations, with more than 628,000 records tied to Ukrainian individuals in CyberXero’s possession.
One dataset came from a district heating provider in Kharkiv: SOCRadar reports that it contained 564,073 subscriber records and 213,340 access-log entries. The firm says seven additional energy-sector entities were under reconnaissance without confirmed compromise. It did not find direct evidence that the Ukrainian access had been sold or establish the purpose of that targeting.
Session logs recorded refusals and workarounds
The exposed logs show the operator presenting a fabricated “authorized pentest” explanation to AI tools, according to SOCRadar. The same ownership claim appeared across four unrelated victims and two tools; after refusals, the operator also opened fresh sessions with the authorization story already in context. The report describes these tactics as attempts to reframe requests, not technical changes to the models.
Some refusals held: SOCRadar says the logs show models declining requests to install a backdoor, disable a firewall, move laterally and deploy a web shell. The exposed files also gave investigators a detailed record of the operator’s plans and prompts, illustrating the sensitivity of agent session histories. For WordPress administrators, the report identifies a specific sign to check: rogue account names matching “wp2_” followed by eight hexadecimal characters.