CyberXero Used Claude Code in Campaign That Stole 628,000+ Ukrainian Records
Summary
Researchers detailed CyberXero’s ongoing campaign targeting WordPress, e-commerce, and Ukrainian infrastructure, with more than 628,000 Ukrainian records reportedly exfiltrated. The article also describes Operation Master, an AI-assisted intrusion and invoice-fraud synd
Key points
- CyberXero’s campaign used a global automated pipeline targeting WordPress and e-commerce platforms alongside a more targeted operation against Ukrainian energy and critical infrastructure.
- Researchers attribute the campaign to a Russian-speaking, financially motivated initial access broker active since at least July 2026; the campaign remains ongoing.
- The operation exploited WordPress vulnerabilities and exposed Redis servers. Researchers reported confirmed exfiltration from four Ukrainian organizations, totaling more than 628,000 records, as well as compromises in Poland, China, and the Netherlands.
- An exposed directory revealed the actor’s working files, including AI session logs, plaintext tokens, exploitation tools, reconnaissance results, and victim data. One automated run scanned 4,708 targets, accessed 429 WordPress admin panels, and deployed 32 web shells in 61 seconds.
- The actor used Claude Code with context-engineering and session resets to retry refused tasks; logs also show the model rejecting several requests to install backdoors, disable firewalls, move laterally, and deploy web shells.
- A separate operation attributed to masterblack combined enterprise intrusions and data theft with an automated Pix invoice-fraud platform. Researchers reported millions of messages and more than 622,000 personalized invoice links before the platform went offline in mid-September 2026.
- Organizations using WordPress, Magento, or PrestaShop, or exposing Redis to the internet, were advised to check for rogue WordPress administrators, WSO web shells, and unexpected SSH authorized keys on Redis hosts.
Article Details
- Attack Vectors
- Exploitation of WordPress vulnerabilities, including wp2shell (CVE-2026-63030 and CVE-2026-60137) and a SQL injection vulnerability in the Support Board plugin (CVE-2026-4815).
- Exploitation of exposed Redis servers, reported in connection with breaches of two Chinese entities.
- Targeted manual exploitation and reconnaissance against Ukrainian energy and critical infrastructure entities.
- Deployment of web shells after gaining access to WordPress administration panels.
- A separate Operation Master campaign compromised enterprise networks and VPN gateways using a GlobalProtect authentication bypass (CVE-2026-0257).
- Defensive Notes
- Organizations running WordPress, Magento, or PrestaShop, or exposing Redis to the internet, are advised to check for rogue WordPress administrators, WSO web shells, and unexpected entries in ~/.ssh/authorized_keys on Redis hosts.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 46[.]21[.]250[.]135 | Exposed host whose open directory contained CyberXero's live working directory and campaign materials. |
MITRE ATT&CK
T1190 · Exploit Public-Facing ApplicationCyberXero exploited vulnerabilities in WordPress and exposed Redis servers; Operation Master also exploited a GlobalProtect authentication bypass.T1505.003 · Web ShellCyberXero deployed 32 web shells after confirming access to WordPress administration panels.T1595 · Active ScanningA single automated execution scanned 4,708 targets to identify WordPress sites and confirm access.
CVE
CVE-2026-0257critical network infrastructure, including VPN gateways via a GlobalProtect authentication bypass (CVE-2026-0257), while concurrently executing advanced web application exploits, deploying the AdaptixC2 framework,CVE-2026-4815specifically focuses on known security flaws like wp2shell (CVE-2026-63030 and CVE-2026-60137) and CVE-2026-4815, an SQL injection vulnerability impacting the Support Board WordPress plugin, to seize control ofCVE-2026-60137The global campaign specifically focuses on known security flaws like wp2shell (CVE-2026-63030 and CVE-2026-60137) and CVE-2026-4815, an SQL injection vulnerability impacting the Support Board WordPress plugin, to seizeCVE-2026-63030The global campaign specifically focuses on known security flaws like wp2shell (CVE-2026-63030 and CVE-2026-60137) and CVE-2026-4815, an SQL injection vulnerability impacting the Support Board WordPress plugin, to seize
Threat Actors
Products
Claude Codecommodity offensive tools like Cobalt Strike with an AI orchestration layer powered by Anthropic's Claude Code, has been attributed to a Russian-speaking, financially motivated initial access broker codenamedGlobalProtectcountries, the threat actor compromised critical network infrastructure, including VPN gateways via a GlobalProtect authentication bypass (CVE-2026-0257), while concurrently executing advanced web application exploits,Magentoexposed Redis servers, resulting in the breach of two Chinese entities. Organizations running WordPress, Magento, or PrestaShop, or exposing Redis to the internet, are advised to check for rogue WordPressPrestaShopservers, resulting in the breach of two Chinese entities. Organizations running WordPress, Magento, or PrestaShop, or exposing Redis to the internet, are advised to check for rogue WordPress administrators, WSO webRedisBeyond WordPress and e-commerce exploitation, the campaign involves the exploitation of exposed Redis servers, resulting in the breach of two Chinese entities. Organizations running WordPress, Magento, or PrestaShop, orWordPressdetails of a two-pronged artificial intelligence (AI)-augmented initial access campaign targeting WordPress sites, e-commerce platforms, and critical infrastructure entities in Ukraine.
Tools
AdaptixC2bypass (CVE-2026-0257), while concurrently executing advanced web application exploits, deploying the AdaptixC2 framework, and leveraging an AI-assisted development workflow," SOCRadar said.Cobalt StrikeThe activity, which brings together commodity offensive tools like Cobalt Strike with an AI orchestration layer powered by Anthropic's Claude Code, has been attributed to a Russian-speaking, financially motivatedWSOor PrestaShop, or exposing Redis to the internet, are advised to check for rogue WordPress administrators, WSO web shells, and unexpected entries in ~/.ssh/authorized_keys on Redis hosts.
Countries
BrazilChinathan 628,000 records tied to Ukrainian individuals. Other confirmed compromises have occurred in Poland, China, and the Netherlands.Netherlandstied to Ukrainian individuals. Other confirmed compromises have occurred in Poland, China, and the Netherlands.Polandof more than 628,000 records tied to Ukrainian individuals. Other confirmed compromises have occurred in Poland, China, and the Netherlands.Ukraineaccess campaign targeting WordPress sites, e-commerce platforms, and critical infrastructure entities in Ukraine.
Industries
Critical infrastructure(AI)-augmented initial access campaign targeting WordPress sites, e-commerce platforms, and critical infrastructure entities in Ukraine.E-commercea two-pronged artificial intelligence (AI)-augmented initial access campaign targeting WordPress sites, e-commerce platforms, and critical infrastructure entities in Ukraine.Energycampaign against WordPress and e-commerce platforms, and a curated, manual campaign against Ukrainian energy and critical infrastructure," SOCRadar said in a report published last week.Utilitiestargeted and geared towards deep reconnaissance and manual exploitation against Ukrainian energy and utilities, including a heating provider in Kharkiv.