CyberXero, a Russian-speaking, financially motivated Initial Access Broker operation, runs a dual campaign: a global automated assault on WordPress/e-commerce platforms using an AI orchestration layer and a targeted manual campaign against Ukrainian energy and critical infrastructure.

The operation combines traditional hacking tools with an AI layer on its own infrastructure, leveraging Claude Code and an extensive network of agents for scanning, exploitation, and persistence.

A misconfigured open directory exposed the actor’s working files—over 90,000 items including AI session logs and plaintext tokens—shedding light on internal workflows and ongoing operations.

SOCRadar also found an exposed server directory (46.21.250[.]135) with live work logs, IA scripts, AI agent configurations, and exfiltrated victim data, signaling active operations.

The global campaign uses wp2shell to exploit a WordPress REST API vulnerability, inject SQL, plant a rogue admin, and deploy webshells; in a rapid run, thousands of targets were scanned and hundreds of admin panels accessed with dozens of webshells deployed.

Threat actors attempted social engineering to bypass AI model safety, with some requests declined and others succeeding by creating new sessions to reset context, illustrating evolving AI-assisted threat capabilities.

The Ukrainian-focused campaign targeted energy and utilities, including the national electricity transmission operator, with several Ukrainian organizations compromised and a Kharkiv district heating provider notably affected.

A separate manual campaign targeted Ukrainian critical infrastructure, using deep reconnaissance and exploitation against a Kharkiv heating provider.

Operation Master, attributed to masterblack, involved mass scanning for PAN OS GlobalProtect gateways, API reconnaissance, automated SQL injections, and the use of Earned-talent tools, with AI-assisted development akin to CyberXero.

The attack architecture comprises eight nodes and dual AI stages: Claude Code with 51 agents handling scanning/exploitation, and PentAGI for autonomous penetration testing linked to Cobalt Strike.

In Kharkiv, an attacker-stored password enabled access to a provider’s systems, and an automated tool exfiltrated over 564,000 customer records, raising physical risk concerns amid ongoing hostilities.

Operation Master reportedly generated millions of fraud messages and hundreds of thousands of personalized invoice links targeting Brazilian consumers, with substantial potential fraudulent invoices and link value.