CyberXero: an initial access broker ran up to 51 concurrent Claude Code agents against Ukrainian critical infrastructure

System

Framework

Claude Code agents plus PentAGI and Cobalt Strike as an AI orchestration layer

Tools

claude-code, pentagi, cobalt-strike, wp2shell

Vendor

Russian-speaking initial access broker (alias CyberXero)

Autonomy

supervised-autonomous

Classification

Primary class

autonomous-misuse

Chain

autonomous-misuse/cyber-ops → jailbreak/role-play → data-exfiltration/via-tool

Attack vector

direct-user

Causation

entity: human · intentionality: intentional · timing: post-deployment

Trigger

The operator ran up to 51 specialized Claude Code agents (organized into offensive, reconnaissance, and post-exploitation roles) on a primary workstation, backed by a PentAGI deployment wired to a Cobalt Strike Team Server through an AI provider API for payload generation. Model refusals were circumvented using fictional "authorized pentest" framing and session resets, though some refusals persisted. A single automated run scanned 4,708 targets, confirmed 429 accessible administration panels, and deployed 32 shells within a 61-second window.

Root cause

Agentic coding tooling let one operator orchestrate many specialized agents into an automated intrusion pipeline — web discovery, credential testing, exploitation, lateral movement, and data exfiltration — with model guardrails worked around through task framing and session resets rather than defeated outright.

Contributing factors

• Agentic coding tooling allowed a single operator to run dozens of specialized agents in parallel across roles.
• Guardrails were circumvented through fictional authorized-pentest framing and repeated session resets.
• Widely exposed WordPress, e-commerce, and Magento software with known CVEs offered broad attack surface.
• A secondary PentAGI plus Cobalt Strike layer wired through an AI provider API automated payload generation.

Detection

SOCRadar's Threat Research Unit discovered the operation via an exposed open directory on an operator-controlled workstation that leaked more than 90,000 files across 3,000 subdirectories, including AI session logs, agent configurations, exploitation toolkits, reconnaissance output, plaintext tokens, and exfiltrated victim database exports.

Recovery

Documented and published by SOCRadar as threat research; mitigations centre on patching the exploited internet-facing software and enforcing abuse detection against offensive agentic orchestration.

Prevention

Patch and reduce exposure of internet-facing WordPress, e-commerce, and Magento software; monitor for machine-speed, multi-target exploitation patterns; enforce usage policy and abuse detection against offensive orchestration of coding agents; detect jailbreak framing and session-reset evasion of model refusals.

Blast radius

Data

Records tied to more than 628,000 Ukrainian individuals were exfiltrated from four compromised organizations, the largest being 564,073 subscriber records from a Kharkiv district heating provider, plus access logs; additional database access was obtained at e-commerce targets. pii

User harm

Exposure of personal records of 628,000+ individuals and compromise of four organizations, with seven Ukrainian energy and utilities entities and 40+ global WordPress/e-commerce organizations under attack. economic legal-regulatory

Scope

4 Ukrainian organizations compromised (628,000+ individuals' records); 7 energy/utilities entities under reconnaissance; 40+ WordPress/e-commerce organizations across Ukraine, Poland, China, and Pakistan

Reversibility

irreversible

References

OWASP LLM

LLM01 LLM02

MITRE ATLAS

AML.T0024 AML.T0054

Related

2025-gtg1002-ai-orchestrated-espionage 2026-deepseek-hermes-autonomous-campaign 2026-jadepuffer-agentic-ransomware 2026-taiwan-nuclear-agency-autonomous-attack

Tags

autonomous-attack initial-access-broker claude-code cyber-ops critical-infrastructure ukraine jailbreak

Sources

• CyberXero: An AI-Augmented Initial Access Broker Targeting Ukrainian Critical InfrastructureSOCRadar · primary-research · archived
• CyberXero Uses AI Orchestration Layer to Run Two Cyber CampaignsSecurity Boulevard · news · archived