Artificial Intelligence · Cybersecurity
SOCRadar links CyberXero to Ukrainian data theft
SOCRadar said a Russian-speaking broker used Claude Code, Cobalt Strike and other tools in a dual campaign against WordPress sites and Ukrainian infrastructure, then described a separate fraud operation.
- SOCRadar said CyberXero ran two campaigns in parallel, one automated against WordPress and e-commerce sites and one directed at Ukrainian energy and critical infrastructure.
- It said the activity used Claude Code, Cobalt Strike and PentAGI, and that the actor had been active since at least July 2026.
- It said four Ukrainian organisations were confirmed victims and more than 628,000 records tied to Ukrainian individuals were taken, with other compromises in Poland, China and the Netherlands.
- It said it found the operation through an exposed directory at 46.21.250.135 that contained logs, scripts, tokens, tooling and victim data.
- It also said Operation Master, run by masterblack, stole customer and billing data and fed invoice fraud against Brazilian targets.
SOCRadar said the first operation had two tracks: one broad and automated, the other selective and manual. It attributed the activity to CyberXero, a Russian-speaking broker it said had been active since at least July 2026.
The broader track went after WordPress and e-commerce systems by using known flaws, while the other track focused on Ukrainian energy and utilities, including a heating provider in Kharkiv. SOCRadar said the activity led to confirmed exfiltration from four Ukrainian organisations and more than 628,000 records.
The company said it found the campaign after an open directory on 46.21.250.135 exposed live working files from a Linux workstation. Those files included AI session logs, scripts, tokens, reconnaissance results, agent settings and stolen victim data, and one automated run scanned 4,708 targets, reached 429 WordPress administration panels and deployed 32 web shells in 61 seconds.
SOCRadar said CyberXero used Claude Code with 51 specialist agents on a primary workstation for scanning, exploit chaining, reconnaissance and post-exploitation. It also said the actor connected PentAGI to Cobalt Strike on a team server for payload generation and test runs, and tried to bypass refusals by presenting tasks as authorised work.
The same report also described Operation Master, which it linked to the alias masterblack between April and mid-September 2026. SOCRadar said that operation stole customer and billing records, sold some data on underground forums and turned the rest into an invoice-fraud system aimed at Brazilian consumers and companies.
Named in this story
People
- CyberXero
- the codename for the broker behind the first campaign
- masterblack
- the alias of the adversary behind Operation Master
Companies
- Anthropic
- provided Claude Code
- Palo Alto Networks
- the vendor whose gateways were targeted in Operation Master
Organisations
- SOCRadar
- published the report and attributed the activity
Products and systems
- Claude Code
- the AI coding tool used in the intrusion workflow
- Cobalt Strike
- the offensive framework used in the campaigns
- PentAGI
- the self-hosted AI agent linked to Cobalt Strike
- WordPress
- one of the main platforms targeted for compromise
- Support Board
- the WordPress plugin whose flaw was used
- Redis
- server software whose exposed instances were exploited
- GlobalProtect gateways
- the gateway systems targeted for scanning and exploitation
- Microsoft 365
- the tenant platform targeted with phishing and password spraying
- AdaptixC2
- the command-and-control framework installed by the adversary
- GitLab
- the platform whose takeover flaw was used against an energy company
Places
- Kharkiv
- the city mentioned in the targeted Ukrainian infrastructure
How the source tells it
The article was mostly a straight security write-up, but it leaned on scale and threat language from the researchers to make both campaigns feel broad and active.
- alarm the report stressed ongoing compromise, cross-border spread and data exfiltration
- scale emphasis large counts of targets, records, messages and links were foregrounded without much context