SOCRadar Details CyberXero’s AI-Assisted Intrusions and Web Exploitation

Nov 10, 2026 · Original article ↗

Summary

SOCRadar researchers detail CyberXero, an active Russian-speaking initial access broker using mass web-app exploitation and targeted intrusions, including against Ukrainian utilities. The profile documents its AI tooling, techniques, victim impact and defenses.

Key points

SOCRadar says it identified more than 40 affected organizations across several countries, excluding more than 4,500 WordPress sites targeted through mass exploitation.
The in-house wp2shell tool exploits a WordPress REST API batch-endpoint authorization desynchronization to use SQL injection, create administrator accounts and deploy a webshell.
The report documents targeted intrusions involving Ukrainian organizations, including alleged theft of subscriber records and credentials; it also describes reconnaissance against Ukrainian energy and utilities entities.
Researchers found a setup involving 51 Claude Code agents and PentAGI connected to a Cobalt Strike Team Server through the Anthropic API.
In a Chinese corporate network, the report describes Redis master-replication abuse to plant an SSH key, followed by lateral movement; successful EternalBlue exploitation was not confirmed.
The article recommends checking for wp2shell artifacts, patching exposed applications, removing default credentials, securing Redis, and protecting AI-agent session logs.

Article Details

Attack Vectors: Mass exploitation of WordPress REST API batch endpoint authorization desynchronization using adaptive SQL injection, followed by creation of rogue administrator accounts and deployment of WSO-family webshells.
Targeted intrusions used blind SQL injection, password-reset token extraction, and PHP deserialization to obtain remote code execution and dump databases.
Compromised exposed Magento configuration and used hardcoded administrator credentials to access victim systems and data.
Abused a misconfigured Redis server with rogue master replication to plant an SSH key, then moved laterally using WMI through a passwordless account.
Attempted password spraying against Pakistani government entities and brute-forced a ZTE gateway using default credentials.
Used a card-skimmer endpoint against a production payment flow and delivered Cobalt Strike beacons, staging, and PowerShell stagers from the Team Server.
Defensive Notes: Review WordPress user tables for usernames matching wp2_ followed by eight hexadecimal characters, and plugin paths matching wp2shell_ with the same suffix; treat either artifact as evidence of compromise.
Prioritize patching CVE-2026-63030, CVE-2026-60137, and CVE-2026-4815; verify that Magento configuration files such as app/etc/env.php are not publicly reachable.
Audit administration panels for hardcoded or shared credentials, replace default network-device passwords, and remove local accounts with blank passwords.
Do not expose Redis to the internet; require authentication, disable or rename SLAVEOF/REPLICAOF where unnecessary, and monitor authorized_keys for unexpected changes.
Block the listed C2 infrastructure and search historical logs for connections to 42.193.227.214 on ports 1002, 8044, and 8033; hunt for the UpdSvc service and PowerShell download cradles.
Protect AI-agent session logs with retention, encryption, and access controls comparable to those used for credential stores.

Indicators of compromise

Type	Indicator	Context
IPV4	`212[.]193[.]31[.]189`	Attacker-operated cryptocurrency payment gateway.
IPV4	`42[.]193[.]100[.]94`	Attacker Redis-exploitation node and PentAGI agent infrastructure.
IPV4	`42[.]193[.]227[.]214`	Cobalt Strike Team Server and PentAGI infrastructure; receives HTTPS beacons on port 1002, serves HTTP staging on port 8044, and delivers PowerShell stagers on port 8033.
IPV4	`45[.]88[.]106[.]2`	Attacker provisioning server, reported on port 1500.
IPV4	`45[.]88[.]106[.]78`	Attacker mass-scanning server.
IPV4	`46[.]21[.]250[.]135`	Attacker-controlled primary workstation and open-directory seed node.
IPV4	`49[.]234[.]12[.]182`	Attacker staging and payload-delivery server used in the Chinese network cluster.
IPV4	`91[.]208[.]184[.]148`	Attacker-controlled secondary workstation.
MD5	`3870a559b5b6ea6076f5f90029c180b7`	Hash of the Cobalt Strike x86 stager32.bin.
SHA256	`59c535f47ab4d35f6d9fc8b8aec4a72438ea0b89e5a4dcea74b05d2d32cfa483`	Hash of config.bin, identified as a Chinese-cluster staging payload.
SHA256	`71e21094c1ac1cf0275c91ed377965e248bca1c12711f6dd20e2682681fc1192`	Hash of 1.bin, identified as a Chinese-cluster staging payload.
SHA256	`92a789444708fa1cb4cc5a89e0aa6cc7a279b62a7b8a4d2857255a18197d0090`	Hash of the Cobalt Strike x86 stager32.bin from the pirated 4.9.1 build.
SHA256	`a5ae0aab352871bc0b038b3aa43b03eb223425628c884af7b9fc592cd34eb86c`	Hash of an obfuscated WSO webshell deployed by the actor.