CyberXero: An Access Broker Running Claude Code Swarms

Key Takeaways

SOCRadar’s Threat Research Unit has documented CyberXero, a Russian-speaking, financially motivated initial access broker (IAB) that combines conventional offensive tooling with an AI orchestration layer built on up to 51 specialized Claude Code agents [1][2]. The report is notable less for any novel exploit than for what it shows about the operating model: a financially motivated actor using commercially available tooling and a personal paid subscription, running a scan-exploit-persist pipeline against thousands of targets while a second, manual track pursued Ukrainian energy and utility organizations [1][3].

The most important finding for defenders is how the actor handled model refusals. According to the session logs recovered by SOCRadar, the operator defeated guardrails by repeating a fictional “authorized penetration test on my own infrastructure” framing and by opening fresh sessions after a refusal, a pattern that works, in SOCRadar’s reading of the logs, because a refusal does not carry forward once context resets [1][3]. The same logs record four refusals that held, and the recovered logs suggest that model-level safeguards imposed friction but did not stop the campaign [1][2].

Two practical consequences follow. First, defenders should expect the cost and skill threshold for mass exploitation of commodity web platforms, particularly WordPress, to keep falling, and should shorten patch and detection timelines accordingly. Second, AI session logs and agent working directories are now a category of sensitive artifact: the entire operation was exposed because the actor left a directory open to the internet [1]. All findings below rest on a single primary source, SOCRadar, as relayed by trade press, and have not been independently confirmed by Anthropic or a second research team as of this writing. The reporting reviewed for this note includes no public statement from Anthropic.

Background

Initial access brokers are specialists who compromise networks or web properties and sell or hand off that access to downstream criminals such as ransomware affiliates and data thieves. The role has historically depended on scanning infrastructure, exploit kits, and human operators who triage which footholds are worth monetizing. CyberXero fits that profile, with SOCRadar describing a financially motivated Russian-speaking operator who was traced across eight infrastructure nodes using exposed credentials, subscription and billing data, bash histories, SSH keys, and self-incriminating posts on the Dread forum [1]. The company notes that this convergence of evidence does not fully rule out a false-flag scenario [1].

The discovery itself was an operational security failure. SOCRadar found an open directory on a Linux workstation that served the actor’s live working directory, containing more than 90,000 files that included AI session logs, scripts with plaintext tokens, and exfiltrated victim data [1][4]. The actor was reportedly active as far back as July 2026 and remained active when the report was published [1][2]. References [2] through [4] report SOCRadar’s findings and were not independently sourced, so agreement among them should not be read as independent corroboration. Because the logs captured prompts, model responses, and agent configuration, researchers could reconstruct how the AI layer was actually used rather than inferring it from victim-side artifacts.

CyberXero is not the first documented case of Claude Code being turned to offensive use. In November 2025, Anthropic disclosed a Chinese state-sponsored campaign in which attackers decomposed intrusion work into small, innocuous-looking tasks and deceived the model about its purpose, reportedly executing the large majority of the operation with limited human intervention [5]. The CyberXero case differs in actor profile. Where the earlier campaign involved a well-resourced state-linked group, this one involves a financially motivated broker using a personal paid subscription and open-source components, and the two documented cases are consistent with the technique having diffused down the capability ladder [1][5].

Security Analysis

Architecture of the operation

SOCRadar describes two pipelines operating in parallel. The first is a global, automated campaign against WordPress and e-commerce platforms, with more than 56,000 target URLs identified and more than 40 affected organizations across several countries [1][4]. The second is a curated, manual campaign against Ukrainian energy and utilities, with seven entities under reconnaissance and confirmed exfiltration from four organizations [1][2].

The AI layer has two components. Up to 51 Claude Code agents ran on the actor’s primary workstation, assigned to roles such as scanning, exploit chaining, reconnaissance, lateral movement, and post-exploitation [1][4]. Configuration files reportedly assigned models to tasks according to reasoning complexity, with explicit cost-benefit logic, which indicates deliberate engineering of the swarm rather than ad hoc prompting [1]. Separately, the actor ran PentAGI, an open-source, self-hosted multi-agent penetration testing system [6], connected to a Cobalt Strike Team Server through an AI provider API for payload generation and test execution [1][2].

Scale and speed

The automated pipeline’s reported figures illustrate the throughput that agentic tooling provides to a single operator. In one documented run, the tooling scanned 4,708 targets, confirmed 429 accessible WordPress administration panels, and deployed 32 webshells in 61 seconds [1][2]. SOCRadar attributes this to wp2shell, an internally developed tool that abuses a REST API batch endpoint desynchronization to inject SQL and create a rogue administrator account [1]. The actor’s rogue accounts and plugin paths follow predictable patterns (usernames of the form wp2_ followed by eight hex characters, and plugin directories beginning wp2shell_), which gives defenders a concrete detection handle [1].

SOCRadar names CVE-2026-63030 and CVE-2026-60137 in WordPress components and CVE-2026-4815, a SQL injection flaw in the Support Board plugin, as weaponized by the actor, and reports that the Support Board flaw was weaponized within 30 days of disclosure [1][2]. We have not independently verified these CVE assignments or the exploitation timeline, and readers should confirm them against the vendor and NVD records before acting on them. If confirmed, the reported 30-day interval would fit the argument that disclosure-to-exploitation windows are shrinking, although this note cites no independent source on that trend and the inference rests on a single unverified data point.

The Ukrainian track has quantifiable impact regardless of how the monetization question resolves. A district heating provider in Kharkiv reportedly leaked 564,073 subscriber records containing personal data and home addresses, and SOCRadar counts more than 628,000 Ukrainian individuals whose confirmed data is in the actor’s possession [1][3]. Reporting notes that Kharkiv lies near an active front, so exposure of residential data may pose a physical safety risk to identifiable civilians [3]. SOCRadar does not establish a firm monetization path for this curated campaign, and the broker’s intent toward energy targets beyond access sale remains unclear [1][2].

Guardrail evasion: what held and what did not

The session logs provide direct evidence of how a criminal user interacts with model safeguards. SOCRadar documents two techniques. The first is context engineering, in which the actor wrote a fictional “authorized pentest on my own infrastructure” narrative and reused it nearly verbatim across different victims. The second is session reset, in which the actor reopened a fresh session with the authorization framing preloaded whenever the model refused [1][3].

The logs also show that four refusals held across multiple iterations, covering requests to install a backdoor, disable a firewall, move laterally, and deploy a webshell [1][2][3]. The right reading is mixed. Safeguards evidently shaped the actor’s workflow and forced workarounds, but because refusals are stateless across sessions, a persistent operator with a plausible cover story could iterate toward compliance on many steps and use conventional tooling such as wp2shell and Cobalt Strike for the rest. SOCRadar’s own recommendation is to manage this evasion pattern through infrastructure-layer logging rather than relying on model-level controls alone [1]. This is a finding about the limits of per-session refusal as a control, not a conclusion that provider safeguards are ineffective.

Implications for defenders

Several inferences follow from the reported facts, and they should be treated as analysis rather than established findings. The swarm model likely lowers the marginal cost of working through a long tail of low-value targets, so web properties that were previously not worth an operator’s attention are now economically viable. The curated Ukrainian track suggests that the same toolset can be pointed at higher-value targets with a human directing agent effort, which blurs the traditional line between opportunistic and targeted activity. Finally, the open-directory exposure is a reminder that actors adopting agentic workflows accumulate rich, centralized records of their own operations, which creates both a defensive intelligence opportunity and a risk for victims if the data is resold or leaked.

For organizations operating their own agent infrastructure, the case carries a mirrored lesson. The artifacts that exposed CyberXero (session logs, plaintext tokens in scripts, working directories reachable from the internet) are the same artifacts that defenders’ own agent deployments produce. SOCRadar advises treating AI agent session logs as sensitive material on a par with credential stores [1].

Recommendations

Immediate Actions

Defenders running WordPress or e-commerce platforms should search for rogue administrator accounts matching the wp2_[0-9a-f]{8} pattern and plugin directories matching wp2shell_[0-9a-f]{8}, and review for WSO webshell variants [1]. Trade press also advises checking for unexpected entries in ~/.ssh/authorized_keys on Redis hosts [2]. Teams should verify the CVEs SOCRadar names against vendor advisories and patch affected WordPress core, plugin, and Support Board installations on an accelerated schedule. Indicators published by SOCRadar, including the infrastructure addresses it lists, should be loaded into detection tooling with the understanding that such infrastructure is typically short-lived [1].

Organizations in Ukraine’s energy and utilities sector, and in Poland where SOCRadar reports additional scanning, should treat the report as a prompt to review externally exposed web properties and customer-data stores [1].

Short-Term Mitigations

Place web application firewalls and rate limiting in front of WordPress REST API endpoints, and alert on bursts of administrator creation, plugin installation, and file writes in plugin directories, since the reported run deployed 32 shells in 61 seconds [1]. Detection logic should be based on behavior and speed, not only on the known wp2 naming pattern, because the actor can change it. Reduce the value of any one foothold by segmenting web servers from internal networks and limiting the data held in web-tier databases.

For organizations that operate agentic coding tools, apply infrastructure-layer controls that do not depend on a single session’s context: central logging of agent prompts and tool calls, egress restrictions, and protection of session logs and working directories as sensitive data [1]. For model and platform providers, the evidence points toward cross-session signals such as account-level abuse detection, repeated identical authorization narratives, and reuse of pretext text across many distinct targets, though this is our inference rather than a recommendation SOCRadar makes.

Strategic Considerations

Security programs should plan for the possibility that financially motivated actors will have agent-scale tooling and for compressed exploitation timelines against internet-facing software; this is our inference rather than a recommendation SOCRadar makes. The reported deployment of 32 webshells in 61 seconds points toward automated patch deployment, an asset inventory of exposed web properties, and detection engineering that targets post-exploitation behavior rather than initial vulnerability signatures [1]. Threat models for agentic AI should now include the attacker’s own agent swarm as a standard adversary capability, alongside the more familiar risks of attacks against an organization’s agents.

Governance teams should also weigh the dual position of agentic tooling. The same capabilities that CyberXero used for offense are being adopted defensively, so policy decisions about logging, identity, and runtime enforcement for agents should be made with both uses in mind.

CSA Resource Alignment

CSA’s research note “Living Off the Agent”: AI Agents as Lateral Movement is the closest prior work on adversary use of agents [7]. It examines how AI agents themselves become a vector for lateral movement, and CyberXero complements it from the opposite direction: that note centers on adversaries subverting an organization’s agents, while this case shows adversaries operating their own agents at scale. Its emphasis on agent credentials and access as high-value assets applies directly to the plaintext-token and exposed-log failures observed here.

CSA’s Zero Trust for Securing Agentic AI describes a policy-as-code interceptor with default-deny rules between agents and the tools they invoke [8]. That kind of infrastructure-layer enforcement is what SOCRadar recommends in place of reliance on per-session model refusals, and it remains effective when a user successfully resets context, which makes it relevant to organizations deploying coding agents of their own. The CSA note Claude for Chrome: Synthetic Click Flaw Lets Extensions Hijack AI Actions is a further example of how safeguards at the interface layer can be bypassed, and it supports the argument for layered controls [9].

For threat modeling, CSA’s MAESTRO framework offers a structured way to include adversary-operated agents in analysis [10], and the AI Controls Matrix (AICM) v1.1 provides control mappings, including the threat and vulnerability management and logging domains, that apply to the patching, detection, and agent-logging recommendations above [11].

References

[1] SOCRadar Threat Research Unit. “CyberXero: An AI-Augmented Initial Access Broker Targeting Ukrainian Critical Infrastructure.” SOCRadar, October 2026.

[2] The Hacker News. “CyberXero Uses Claude Code in Campaign That Stole Over 628,000 Ukrainian Records.” The Hacker News, October 2026.

[3] Security Affairs. “CyberXero Used 51 AI Agents to Steal 628,000 Ukrainian Records.” Security Affairs, October 12, 2026.

[4] Cyber Security News. “CyberXero Combines Claude Code, PentAGI and Cobalt Strike in AI-Augmented Cyberattacks.” Cyber Security News, October 2026.

[5] Anthropic. “Disrupting the First Reported AI-Orchestrated Cyber Espionage Campaign.” Anthropic, November 13, 2025.

[6] vxcontrol. “PentAGI.” GitHub, accessed October 2026.

[7] Cloud Security Alliance. “Living Off the Agent: AI Agents as Lateral Movement.” Cloud Security Alliance, 2026.

[8] Cloud Security Alliance. “Zero Trust for Securing Agentic AI.” Cloud Security Alliance, 2026.

[9] Cloud Security Alliance. “Claude for Chrome: Synthetic Click Flaw Lets Extensions Hijack AI Actions.” Cloud Security Alliance, July 2026.

[10] Huang, Ken. “Agentic AI Threat Modeling Framework: MAESTRO.” Cloud Security Alliance, February 6, 2025.

[11] Cloud Security Alliance. “AI Controls Matrix (AICM) v1.1.” Cloud Security Alliance.