Thehackernews CyberXero Campaign Targets Ukrainian Records Using AI Tools
Article Content
- •CyberXero has exfiltrated over 628,000 records from Ukrainian organizations.
- •The campaign utilizes AI tools like Claude Code and Cobalt Strike for exploitation.
- •Exploited vulnerabilities include CVE-2026-63030 and CVE-2026-4815 targeting WordPress.
CyberXero, a Russian-speaking initial access broker, has launched a dual-pronged campaign targeting WordPress sites and Ukrainian critical infrastructure, leveraging AI tools like Claude Code. The operation has led to the exfiltration of over 628,000 records from Ukrainian entities, with confirmed compromises in Poland, China, and the Netherlands. The campaign exploits vulnerabilities such as CVE-2026-63030 and CVE-2026-4815, focusing on known security flaws in WordPress and e-commerce platforms. Researchers identified the operation through an exposed directory containing over 90,000 files, including reconnaissance results and exploitation scripts. The attack architecture consists of eight nodes, utilizing Cobalt Strike and AI agents for automated scanning and exploitation. The campaign remains active, with ongoing efforts against Ukrainian energy and utility organizations. SOCRadar reported the findings, confirming the threat actor's continued activity since at least July 2026.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (4)
Following this threat?
Track Cobalt Strike and CVE-2020-1938 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Common questions
What data was compromised?
How is this campaign being conducted?
What should organizations do to protect themselves?
Continue Reading
FamousSparrow Deploys SparroWocky Backdoor in Latin America The China-aligned cyberespionage group FamousSparrow has replaced its previous backdoor, SparrowDoor, with a new malware called SparroWocky, targeting governmental organizations in Latin America since August 2025. ESET Research attributes this campaign to a likely response to increased U.S. interests in the region.… 
Emerging EDR Killer Tool Targeting Ransomware Groups A new malicious tool, referred to as the EDR killer, is being actively used by at least eight ransomware groups, including Blacksuit and Medusa, to disable endpoint detection and response (EDR) solutions. This tool is believed to be an evolution of the EDRKillShifter developed by RansomHub, which allows ransomware…