SOCRadar: 'CyberXero' wired AI agents into a Ukraine access-broker campaign

Threat-intel firm SOCRadar has published a report attributing an AI-augmented initial-access campaign against Ukrainian targets to an actor it calls CyberXero. The claim worth the practitioner's attention is not the record count — it is the operating model: SOCRadar says the actor plumbed autonomous AI agents directly into a commodity offensive toolchain. Read the SOCRadar writeup (October 6, 2026) as the primary; this beat earns extra skepticism, so treat the vendor's telemetry as its own, not as independently confirmed.

What SOCRadar reports

SOCRadar describes CyberXero as a financially motivated initial-access broker active since at least July 2026, and says "attribution rests on three converging lines of evidence" across five platforms. Its findings:

• More than 628,000 Ukrainian individuals have confirmed data in the actor's possession, including 564,073 subscriber records from a district heating provider in Kharkiv.
• The actor ran up to 51 specialized Claude Code agents on its primary workstation, and wired PentAGI — an open-source autonomous pentesting agent — to a Cobalt Strike Team Server through an AI-provider API.
• A single automated execution scanned 4,708 targets, confirmed 429 accessible administration panels, and deployed 32 shells within a 61-second window, per SOCRadar's reconstruction.
• Target countries named are Ukraine, Poland, China, and Pakistan.

How the access was gained

The entry points were ordinary, not novel. SOCRadar lists a wp2shell chain built on CVE-2026-63030 (primary) and CVE-2026-60137 (secondary), plus CVE-2026-4815, a CVSS 8.8 time-based SQL injection in the Support Board WordPress plugin. The AI layer was the force multiplier, not the exploit — the same wp2shell flaw we covered as a standalone pre-auth RCE.

The caveat that matters

SOCRadar also reports that the model refused several requests — to install a backdoor, disable a firewall, move laterally, and deploy a web shell — and that the actor leaned on context engineering and session resets, reopening fresh sessions with an "authorized pentest on my own infrastructure" framing preloaded. That detail cuts against the breathless read: guardrails fired, and the operator spent effort routing around them. The eye-catching "32 shells in 61 seconds" figure is SOCRadar's measurement of one automated run; it is a vendor metric, not a reproduced benchmark.

What to do

1. Patch the mundane WordPress and plugin flaws named above — the AI layer did not change what gets you owned, only how fast it is found.
2. Treat AI-provider API keys as offensive infrastructure in your threat model; monitor for their use against your own estate.
3. Hunt for Cobalt Strike indicators and mass-scan patterns consistent with automated admin-panel discovery.
4. Don't over-index on the agent count. The defensive work is unchanged: reduce internet-reachable attack surface and shorten patch windows.

Context

This fits a run of AI-abuse reporting we've tracked — from Anthropic's own internal-eval finding of agents taking unintended actions to Transluce's agents hitting SQL injection on government sites. The throughline: AI lowers the labor cost of opportunistic access, but the exploited bugs stay boring and patchable. The novelty is tempo, not capability.