Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
SOCRadar’s Threat Research Unit says it uncovered a financially motivated operation it calls CyberXero, reporting that it exfiltrated more than 628,000 records tied to Ukrainian individuals from four Ukrainian organizations. The report, published October 6, 2026, also describes the use of Claude Code and other AI tooling. These are findings attributed to SOCRadar, not independently established facts: a secondary account says the active-status assessment and detailed operational figures had not been separately confirmed in a technical investigation.
What SOCRadar says CyberXero is
SOCRadar characterizes CyberXero as a financially motivated initial access broker: an operation that seeks access to organizations’ systems, potentially for resale or other criminal use. The report describes two distinct activity pipelines rather than one uniform campaign.
| Pipeline | Reported targets and workflow | Reported outcome |
|---|---|---|
| WordPress and e-commerce activity | Global, opportunistic targeting with automated, high-volume scanning and exploitation of WordPress administration panels. | SOCRadar reports shell deployment on accessible sites; it does not equate every scanned target with a successful compromise. |
| Ukrainian energy and utilities activity | Selected Ukrainian entities, with curated reconnaissance followed by reported manual exploitation. | SOCRadar reports confirmed exfiltration from four Ukrainian organizations. Separately, it says seven energy and utility entities were under reconnaissance; those seven are not reported as confirmed compromises. |
The two counts describe different evidence categories. The four organizations are tied to reported confirmed exfiltration, while the seven energy and utility entities are a reconnaissance set, not an additional confirmed-victim count. The secondary account also says the dataset’s full origin remains unclear.
What the report says was stolen
SOCRadar reports more than 628,000 records associated with Ukrainian individuals and says exfiltration was confirmed from four Ukrainian organizations. The available account does not establish that every record came from the seven energy and utility entities under reconnaissance, nor does it resolve the full provenance of the dataset. The figure should therefore be read as SOCRadar’s reported total, not as an independently verified count or a count attributable to every targeted organization.
#1 Best Overall
How SOCRadar says it found the operation
According to SOCRadar, investigators discovered an exposed directory containing the operator’s live working files, AI session logs, scripts with plaintext tokens, and exfiltrated data. The report says: “The entire operation surfaced from a single configuration error: an exposed open directory that served the actor’s live working directory, including AI session logs, scripts with plaintext tokens, and exfiltrated victim data.”
Those exposed artifacts are the basis for SOCRadar’s account of the operator’s tools and activity. Their presence enabled the researchers to examine working material, but the findings remain attributed to that investigation.
How SOCRadar says CyberXero used AI
SOCRadar reports that the operator’s workstation contained up to 51 specialized Claude Code agents. It also describes a separate PentAGI deployment connected to a Cobalt Strike Team Server through an AI-provider API. These are two reported elements of the setup; the report does not establish that Claude Code itself performed every scanning, exploitation, or exfiltration action.
Recovered AI session logs reportedly show models refusing some requests, followed by operator efforts to work around refusals by reframing prompts and resetting sessions. That is evidence of what the recovered logs contain, not a controlled test of model safety or a general measurement of how often refusals succeed.
Rank #3
What the WordPress figures mean
SOCRadar reports one automated run that scanned 4,708 targets, found 429 accessible WordPress administration panels, and deployed 32 shells in a 61-second window. Those numbers describe the run cited in the report; they should not be read as totals across all CyberXero activity or as independently confirmed measurements.
The report identifies WordPress administrator usernames matching wp2_ followed by eight hexadecimal characters as a hunting clue associated with its reported wp2shell activity. A matching username alone does not prove a site was compromised.
What defenders can check
For organizations that administer WordPress sites, the username pattern is a lead for investigation, not a verdict. Check it alongside access logs, unexpected administrator accounts, unfamiliar files or shells, and other evidence of unauthorized activity. Preserve relevant logs and investigate the affected system before removing artifacts, so response teams can determine what happened and what credentials or systems may need attention.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →More broadly, SOCRadar’s account makes exposed operational directories a significant security concern: working files, session logs, tokens, and stolen data can reveal an operation and expose additional sensitive material. Organizations should ensure directories intended for internal use are not publicly accessible and rotate credentials if plaintext tokens may have been exposed.
Best Value
How strongly are the findings corroborated?
SOCRadar’s Threat Research Unit published its investigation on October 6, 2026, based on artifacts it says it recovered from exposed infrastructure. CyPro’s secondary account notes that the active-status assessment and detailed operational figures had not been independently confirmed by a separate technical investigation. Treat the attribution, campaign status, and specific totals as SOCRadar-reported claims rather than settled, independently verified conclusions.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
