CyberXero Used AI-Assisted Campaigns to Target Ukrainian Critical Infrastructure

Oct 6, 2026 · Original article ↗

Summary

Researchers uncovered CyberXero, a financially motivated access broker using AI-assisted tools in global campaigns and targeted operations against Ukrainian energy organizations. An exposed directory revealed infrastructure, session logs, and data from more than 628,000

Key points

An exposed directory containing over 90,000 files, AI session logs, scripts, and victim data enabled researchers to map eight infrastructure nodes.
CyberXero paired global automated attacks on WordPress and e-commerce platforms with targeted reconnaissance of seven Ukrainian energy and utilities entities.
One automated WordPress run scanned 4,708 targets, found 429 accessible admin panels, and deployed 32 webshells in 61 seconds.
Researchers found confirmed exfiltration from four Ukrainian organizations, including over 564,000 subscriber records from a Kharkiv district heating provider.
The operator used 51 specialized Claude Code agents and integrated PentAGI with a Cobalt Strike server; logs also documented refusals and attempts to work around them.
Defenders can hunt for WordPress admin names matching wp2_ followed by eight hexadecimal characters and plugin paths matching /wp-content/plugins/wp2shell_[0-9a-f]{8}/.
The operation was still active at publication; researchers found no direct evidence explaining the targeted Ukrainian infrastructure activity or confirming a sale of access.

Article Details

Attack Vectors: Exploited a desynchronization in the WordPress REST API batch endpoint to inject SQL, create rogue administrator accounts, and deploy webshells.
Used time-based and blind SQL injection against e-commerce targets, including Support Board and Magento.
Used hardcoded administrator credentials to access a Ukrainian district heating provider.
Used password spraying against named employee accounts and attempted default credentials against a ZTE router.
Exploited internet-exposed Redis through rogue replication to inject SSH authorized keys.
Used WMI for remote execution on Chinese-cluster hosts with a blank-password account.
Delivered PowerShell IEX stagers from C2 infrastructure and used Cobalt Strike and webshells for post-compromise activity.
Conducted reconnaissance and vulnerability scanning against global ranges and curated Ukrainian and Polish target lists.
Defensive Notes: Check WordPress installations for administrator usernames matching wp2_ followed by eight hexadecimal characters and for plugin paths matching /wp-content/plugins/wp2shell_[0-9a-f]{8}/.
Hunt for the WSO-family webshell variant described as obfuscated with R00t-Shell.com 2.0.15, and review its characteristic obfuscator header.
Review internet-exposed Redis hosts for unexpected entries in ~/.ssh/authorized_keys consistent with rogue replication.
Monitor for the UpdSvc persistence service and the reported PowerShell stager download pattern.
Treat AI agent session logs as sensitive operational material; apply retention, encryption, and access controls comparable to those used for credential logs or cryptographic keystores.
Organizations using WordPress, Magento, or PrestaShop, exposing Redis to the internet, or seeing outbound traffic to the reported Team Server ports are advised to investigate.

Indicators of compromise

Type	Indicator	Context
IPV4	`212[.]193[.]31[.]189`	Multi-chain CryptoPay gateway used as part of the actor’s monetization infrastructure.
IPV4	`42[.]193[.]100[.]94`	Redis exploitation node and PentAGI agent host.
IPV4	`42[.]193[.]227[.]214`	Cobalt Strike Team Server and PentAGI host; also used for beaconing and staging.
IPV4	`45[.]88[.]106[.]2`	Actor infrastructure provisioning server on port 1500.
IPV4	`45[.]88[.]106[.]78`	Mass-scanning server mapped to the actor’s infrastructure.
IPV4	`46[.]21[.]250[.]135`	Exposed open-directory seed node serving the actor’s live working directory.
IPV4	`49[.]234[.]12[.]182`	Staging and payload-delivery node for the Chinese cluster.
IPV4	`91[.]208[.]184[.]148`	Secondary workstation mapped to the actor’s infrastructure.
SHA256	`59c535f47ab4d35f6d9fc8b8aec4a72438ea0b89e5a4dcea74b05d2d32cfa483`	Hash of config.bin, identified as a Chinese-cluster staging payload.
SHA256	`71e21094c1ac1cf0275c91ed377965e248bca1c12711f6dd20e2682681fc1192`	Hash of 1.bin, identified as a Chinese-cluster staging payload.
SHA256	`92a789444708fa1cb4cc5a89e0aa6cc7a279b62a7b8a4d2857255a18197d0090`	Hash of stager32.bin, identified as a Cobalt Strike x86 stager.
SHA256	`a5ae0aab352871bc0b038b3aa43b03eb223425628c884af7b9fc592cd34eb86c`	Hash of the obfuscated WSO-Shell.php webshell.
URL	`hxxp[:]//42[.]193[.]227[.]214:8033/[a-z0-9]{13}`	Reported PowerShell stager download URL pattern hosted on the Cobalt Strike infrastructure.