SOCRadar says an exposed open directory belonging to a financially motivated initial access broker it calls CyberXero held evidence that the operator ran up to 51 specialized Claude Code agents, alongside data on more than 628,000 Ukrainian individuals.
What SOCRadar found
In its October 6 report, SOCRadar’s Threat Research Unit describes CyberXero as a Russian-speaking broker with two pipelines: an automated global campaign against WordPress and e-commerce platforms, and a manual campaign against Ukrainian energy and utilities. The researchers say the open directory held AI session logs, scripts, reconnaissance output and exfiltrated data.
The report gives these figures. One automated run scanned 4,708 targets, reached 429 accessible admin panels and deployed 32 shells in 61 seconds. Four Ukrainian organizations had file-confirmed exfiltration, including a Kharkiv district heating provider that accounted for 564,073 subscriber records. SOCRadar counts more than 40 affected organizations worldwide and lists Ukraine, Poland, China and Pakistan as target countries.
On tooling, SOCRadar says the operator used up to 51 Claude Code agents on its main workstation and connected PentAGI to a Cobalt Strike Team Server through an AI provider API. The report also says several model refusals held during the sessions.
What defenders should check
SOCRadar suggests hunting for rogue WordPress administrator accounts with a wp2_ prefix followed by eight hex characters, WSO-family web shells, and unexpected entries in SSH authorized_keys files on internet-exposed Redis hosts. It also advises monitoring outbound traffic to the Cobalt Strike ports listed in the report.
Why it matters
SOCRadar writes that the session logs are “the functional equivalent of a keylogger for offensive activity.” The same logic applies to defenders, whose own agent logs record commands, tokens and targets. Our read is that teams running coding agents should give those logs the retention and access controls they give credential stores, a point we made in a scope prompt is not an AI agent control. For another case of AI tooling in an intrusion, see our report on CrowdStrike’s ARTEX findings.
Source: SOCRadar
