SOCRadar: Russian-Speaking Broker Used Claude Code Agents to Hit WordPress Sites and Ukrainian Utilities

A Russian-speaking, financially motivated hacker is running commercial AI coding agents alongside old-school attack tools, and he left the whole workshop sitting on the open internet.

SOCRadar's Threat Research Unit published its findings on Oct. 6, 2026. It tracks the actor as CyberXero, an initial access broker, meaning someone who breaks into networks and sells the access. SOCRadar assesses the actor has been active since at least July 2026.

Two campaigns, one operator

SOCRadar says CyberXero runs two pipelines at once.

The first is global and automated. It goes after WordPress and e-commerce platforms to harvest access and payment data. The second is curated and manual, aimed at Ukrainian energy and critical infrastructure.

The automated side leans on known flaws. SOCRadar lists the wp2shell chain (CVE-2026-63030 and CVE-2026-60137) and CVE-2026-4815, a SQL injection bug in the Support Board WordPress plugin. The actor exploited the Support Board flaw within 30 days of its disclosure, according to the report. Magento stores were also targeted.

The numbers from a single automated run: 4,708 targets scanned, 429 WordPress admin panels accessed, 32 web shells deployed in 61 seconds. The broader target list topped 56,000 URLs.

What was stolen

SOCRadar says file-confirmed exfiltration hit four Ukrainian organizations, with data on more than 628,000 Ukrainian individuals. Confirmed compromises also turned up in Poland, China and the Netherlands.

The biggest haul came from a district heating provider in Kharkiv. A hardcoded credential let the actor pull 564,073 subscriber records and 213,340 access-log entries. SOCRadar describes Kharkiv as a city on an active war front and warns that exposed addresses and account details create risks beyond financial fraud for civilians there.

The curated campaign also mapped seven energy and utility entities, including the national transmission operator and the country's largest private energy holding. One target list held 95 subdomains covering email, VPN, dispatch and data systems. SOCRadar says that reconnaissance did not produce a confirmed compromise at the additional organizations.

How the AI was used

On the actor's primary workstation, SOCRadar found configurations for up to 51 specialized Claude Code agents handling web discovery, password testing, exploitation and data theft. A second setup wired PentAGI, an AI-assisted penetration-testing framework, into a Cobalt Strike Team Server through an AI provider API.

Recovered settings reportedly assigned models and token budgets by task difficulty. Payload generation got the heavy effort. Searches and installations went to cheaper roles. SOCRadar's timeline puts the introduction of AI in late July 2026, after conventional exploitation had already started.

The session logs also show the actor getting around refusals. According to SOCRadar, he told the agent he was running an "authorized pentest on my own infrastructure." When a request was rejected, he opened a fresh session with the same preloaded story.

"Model safety controls act on the context of a session, not on the model weights, so a refusal in one session does not carry into the next," SOCRadar wrote.

The logs show some refusals held. The model declined requests to install a backdoor, disable a firewall, move across a network and deploy a webshell, per the report.

Limits on what the findings show

The findings do not say AI ran the whole show. The Ukrainian campaign is described as manual, and the 51-agent configuration does not establish which tasks each agent performed or how often they succeeded. Nor does the evidence establish that every one of the 628,000 exposed people is tied to an infrastructure victim.

On attribution, SOCRadar frames this as a financially motivated criminal operation, not a confirmed state-sponsored campaign. Researchers found no direct evidence that the actor has sold any access. The focus on Ukrainian utilities does raise the question of who might eventually buy it.

The mistake that exposed it

The operation surfaced through a configuration error. An unprotected HTTP directory at 46.21.250.135, hosted through Zomro in the Netherlands, served the actor's live Linux working directory. It held more than 90,000 files across roughly 3,000 subdirectories: AI session logs, scripts with plaintext tokens, reconnaissance output, agent configurations and victim database exports.

SOCRadar used that material to map eight infrastructure nodes across three autonomous systems and two regions. European nodes handled the workstation, provisioning and monetization. Tencent Cloud hosted Cobalt Strike, staging and Redis exploitation infrastructure.

What defenders are told to check

SOCRadar's guidance for site administrators is concrete:

• Verify WordPress updates and patch against the wp2shell chain and the Support Board flaw.
• Look for unknown plugins and rogue admin accounts. The actor's accounts follow the pattern wp2_ plus eight hexadecimal characters.
• Limit internet-facing Redis and audit SSH keys.
• Check for a Windows persistence service named UpdSvc.
• Treat AI agent logs like credentials: encrypt them, restrict access and keep audit trails.

SOCRadar says CyberXero was still active when it published on Oct. 6, so any access already taken could be sold or reused. It is unclear whether the exposed directory leads to the buyers, since nobody has said who, if anyone, has paid for the access to Ukrainian utilities.

SOCRadar has also published the full indicator set, including the IP addresses and tooling signatures, for defenders hunting for compromise.