Loading story…
SOCRadar reported that CyberXero, a Russian-speaking, financially motivated initial access broker, is running parallel campaigns against global WordPress and e-commerce sites and Ukrainian critical infrastructure. An exposed working directory contained victim data, exploitation tools, and AI session logs, linking eight infrastructure nodes to the operator. The investigation confirmed data exfiltration from four Ukrainian organizations involving more than 628,000 records associated with Ukrainian individuals, alongside curated reconnaissance against seven energy and utilities entities. CyberXero uses up to 51 specialized Claude Code agents and a PentAGI–Cobalt Strike integration to augment reconnaissance, exploitation, and post-exploitation. Logs showed both successful attempts to bypass AI refusals using fabricated authorization narratives and session resets, and refusals that held.
The operation illustrates adversary practices documented by MITRE ATT&CK: vulnerability scanning (T1595.002), obtaining publicly available or legitimate tools (T1588.002), and acquiring exploits rather than developing them internally (T1588.005). MITRE documents these practices across espionage and criminal groups, including scanning for vulnerabilities in internet-facing applications and using tools such as Cobalt Strike, Impacket, and Mimikatz; those broader examples are not all attributed to CyberXero. Defenders should prioritize internet-facing application patching, investigate suspicious scanning and Cobalt Strike activity, and assess potential data exposure. CyberXero remained active when SOCRadar published its report, but the purpose of its directed Ukrainian campaign and any sale of the resulting access remained unconfirmed.
Track how attackers are adapting to this technology.
14 events from the most recent confirmed update back to the earliest known activity.
CyberXero created AI accounts in late July, beginning a second operational phase in which its WordPress campaigns and SQL-injection chains increased in scale.
CyberXero's infrastructure was first observed in July 2026. The investigation distinguished an initial reconnaissance and exploitation phase from a later AI-augmented phase.
Investigators correlated eight infrastructure nodes using a shared provisioning token, an SSH-key hostname, command histories, and staging logs. Exposed account and billing information, a cover persona, and a verified Dread post linked CyberXero's identity across five platforms.
An unauthenticated HTTP directory at 46.21.250.135 exposed more than 90,000 files across approximately 3,000 subdirectories. Its contents included AI session logs, plaintext tokens, exploitation scripts, reconnaissance results, and exfiltrated databases.
Recovered logs showed CyberXero presenting fabricated authorization claims across four unrelated victims and two tools, and reopening sessions after model refusals. Some attempts succeeded, while other sessions sustained refusals to deploy backdoors or webshells, disable a firewall, move laterally, or perform a scan.
CyberXero attempted WAF bypass and credential spraying against two Pakistani national-security entities. The investigation did not confirm the outcome of these attempts.
CyberXero compromised a Chinese cluster through Redis exploitation and operated Cobalt Strike with China-specific tooling.
CyberXero's Polish activity included confirmed e-commerce compromises and WordPress exploitation attempts against state-administration entities. The activity involved 284 scanned domains.
CyberXero attacked an e-commerce portal using blind SQL injection to extract a time-limited password-reset token, followed by PHP deserialization. The chain achieved remote code execution and full database access.
Recovered files confirmed exfiltration of more than 628,000 records associated with Ukrainian individuals from four organizations. At a Kharkiv district-heating provider, CyberXero used a hardcoded credential to extract 564,073 subscriber records and 213,340 access-log entries.
CyberXero conducted curated reconnaissance against seven Ukrainian energy and utilities entities, including the national transmission system operator and the largest private energy holding. One recovered list enumerated 95 subdomains spanning email, VPN, dispatch, and data systems.
CyberXero exploited the time-based SQL-injection vulnerability CVE-2026-4815 in Support Board 3.8.7 within 30 days of its disclosure. Separate activity tested approximately 93 Magento domains in connection with CVE-2015-1397.
One automated execution scanned 4,708 targets, confirmed access to 429 WordPress administration panels, and deployed 32 shells within 61 seconds. CyberXero's wp2shell package used WordPress REST API batch-processing desynchronization to inject SQL, create rogue administrators, and deploy a WSO-family webshell.
CyberXero deployed up to 51 specialized Claude Code agents for activities including reconnaissance, exploitation, lateral movement, and exfiltration. It also operated a separate PentAGI integration with Cobalt Strike through an AI-provider API.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 13 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
6 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcesocradar.io
Open sourceattack.mitre.org
Open sourceattack.mitre.org
Open sourceattack.mitre.org
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CloudSEK reported that an exposed server uncovered a Russian-speaking **initial access broker** running a large-scale intrusion operation against internet-facing appliances and public applications across more than a dozen countries. From mid-2025 into late 2026, the actor used public and modified proof-of-concept exploits to compromise organizations in education, healthcare, finance, telecommunications, government, managed services, and other enterprise sectors, then deployed web shells and tunnels, stole credentials, exfiltrated device configurations and cloud backups, and in some cases achieved full **Active Directory** compromise by obtaining material needed to forge **Kerberos** tickets. The investigation found that several victims were later claimed by different ransomware groups within weeks, indicating the actor likely sold network access rather than conducting extortion directly. CloudSEK also said the same infrastructure was later used for targeted collection against Ukrainian defence and aerospace entities, including theft from exposed source-code repositories, use of **Sliver C2**, and collection of imagery and activity from exposed IP cameras and RDP sessions, suggesting an overlap between criminal access brokerage and activity aligned with Russian state-linked intelligence requirements.
Aug 4, 2026
Ukraine said Russia-linked threat groups intensified cyberattacks against its critical infrastructure, government, communications, energy, and humanitarian logistics networks, using phishing and multiple destructive malware families including **HermeticWiper**, **IsaacWiper**, **CaddyWiper**, and **DoubleZero**. CERT-UA attributed activity during the period to several tracked clusters such as `UAC-0056`, `UAC-0051/UNC1151`, `UAC-0028/APT28`, and `UAC-0033/XDSpy`, and said the operations were tied to actors affiliated with Russian and Belarusian state structures and proxy entities. Ukrainian officials also reported targeting of organizations documenting war crimes and of European charities supporting refugees, underscoring that the campaign extended beyond domestic wartime targets. Researchers separately documented destructive intrusions in which **HermeticWiper** and **CaddyWiper** were deployed through Windows Group Policy after attackers had already gained broad control of victim networks. HermeticWiper hit finance organizations, government contractors, and other Ukrainian systems while also affecting some machines in Latvia and Lithuania; it corrupted local data and the master boot record, leaving devices unable to boot. In parallel, CERT-UA warned that phishing emails posing as antivirus updates delivered **Cobalt Strike** along with the **GraphSteel** and **GrimPlant** backdoors, a campaign linked with medium confidence to `UAC-0056`, showing that espionage, access operations, and destructive attacks were being conducted in tandem.
Aug 15, 2026
Kaspersky reported that several interconnected pro-Ukrainian hacktivist groups, including **4BID**, **Hacker kiт**, **C.A.S**, and **Goffee**, expanded attacks beyond Russia and Belarus to targets in **Kazakhstan, the UAE, Syria, and Egypt**. Victims included government entities, healthcare organizations, and the aviation sector. Researchers said the intrusions commonly began with exploitation of Microsoft Exchange **ProxyShell** vulnerabilities, followed by deployment of the `fd.aspx` ASP.NET web shell, execution of PowerShell or `cmd.exe`, reconnaissance, and installation of remote-management tools such as AnyDesk, Dev Tunnels, Panorama9, Tactical RMM, and Nezha Monitoring. The campaigns used a broad post-compromise toolkit that mixed public C2 frameworks and custom malware, including **Sliver**, **Havoc**, **Mythic Apollo**, **AdaptixC2**, **BlackSalt** backdoor, **Warp RAT**, **BlackReaperRAT**, **ClearWater** ransomware, and an updated **Blackout Locker**. Investigators also observed BYOVD-based EDR killers, including modified EDRKiller variants and GhostDriver, along with signs that some delivery scripts may have been AI-generated. ClearWater was seen encrypting files with **ChaCha20** and **RSA-2048**, dropping ransom notes, changing wallpapers, and deleting recovery artifacts, while Blackout Locker added a persistent screen-locking feature, reinforcing researchers' assessment that the actors are shifting from politically branded hacktivism toward financially motivated operations.
Jun 29, 2026