Researchers at SOCRadar have detailed a sophisticated cyber campaign by the group CyberXero that leveraged a swarm of 51 AI agents to target Ukrainian critical infrastructure and global e-commerce platforms.
The discovery occurred during routine monitoring when analysts found an unprotected HTTP server at 46.21.250.135. The server exposed the attackers' working directory, including reconnaissance tools, scripts, logs, and exfiltrated data, representing a significant OPSEC failure.
Parallel Operations
CyberXero conducted two simultaneous operations using shared infrastructure. One campaign focused on mass exploitation of WordPress sites and e-commerce platforms worldwide. The second targeted Ukraine's energy sector, specifically a heating supplier in Kharkiv.
Attackers avoided zero-day exploits and instead chained known vulnerabilities. Key vectors included SQL Injection via CVE-2026-4815 in WooCommerce, remote code execution flaws in popular WordPress plugins, and the wp2shell tool for deploying webshells. They also performed large-scale reconnaissance using custom orchestrators combined with nuclei and Python scripts.
AI Agents in Action
The most notable element was the use of 51 specialized AI agents created in the Claude Code environment. Each agent handled specific tasks such as scanning, vulnerability detection, and exploitation. The group further integrated the PentAGI framework with Cobalt Strike to generate payloads and automate core attack phases.
When AI agents refused tasks, operators bypassed restrictions by claiming they were conducting authorized penetration tests on their own systems. Persistent refusals were overcome by opening new sessions to reset context.
In just 61 seconds the operation scanned 4,708 targets, confirmed access to 429 WordPress admin panels, and deployed 32 webshells. The campaign ultimately yielded over 628,000 records belonging to Ukrainian citizens, including names, addresses, bank account numbers, and detailed energy consumption data.
While primarily a financially motivated Initial Access Broker, the focus on Ukrainian critical infrastructure suggests possible state alignment or approval.
