CyberXero Combines Claude Code, PentAGI and Cobalt Strike in AI

Cybersecuritynews •Tushar Subhra Dutta • October 7, 2026

CyberXero has emerged as an initial access broker that combines familiar hacking tools with artificial intelligence to run large-scale intrusions. The Russian-speaking operator targeted WordPress and e-commerce sites worldwide while separately probing Ukrainian energy and utility organizations. The campaign came to light after an open directory exposed more than 90,000 files, including scripts, AI session […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

CyberXero Campaign Targets Ukrainian Records Using AI Tools CyberXero, a Russian-speaking initial access broker, has launched a dual-pronged campaign targeting WordPress sites and Ukrainian critical infrastructure, leveraging AI tools like Claude Code. The operation has led to the exfiltration of over 628,000 records from Ukrainian entities, with confirmed compromises in Poland, China, and the Netherlands. The campaign exploits vulnerabilities such as CVE-2026-63030 and CVE-2026-4815, focusing on known security flaws in WordPress and e-commerce platforms. Researchers identified the operation through an exposed directory containing over 90,000 files, including reconnaissance results and exploitation scripts. The attack architecture consists of eight nodes, utilizing Cobalt Strike and AI agents for automated scanning and exploitation. The campaign remains active, with ongoing efforts against Ukrainian energy and utility organizations. SOCRadar reported the findings, confirming the threat actor's continued activity since at least July 2026. 5 sources 79

Extracted Entities

CyberXero Combines Claude Code, PentAGI and Cobalt Strike in AI

The full story

Extracted Entities

Industries (1)

Malware (1)

Platforms (1)