WooCommerce

CyberXero Deploys Swarm of 51 AI Agents Against Ukrainian Critical Infrastructure

Researchers at SOCRadar uncovered the CyberXero campaign after discovering an openly accessible HTTP server at 46.21.250.135 that exposed the group's full workspace, logs, tools, and stolen data. The operation ran two parallel tracks using the same infrastructure: one mass campaign against WordPress and e-commerce sites worldwide, and a targeted strike on Ukraine's energy sector and critical infrastructure. Attackers created 51 specialized AI agents inside the Claude Code environment to automate reconnaissance, vulnerability identification, exploit chaining, and data exfiltration. They also integrated the PentAGI framework with Cobalt Strike for payload generation and attack automation while bypassing model refusals by claiming authorized penetration tests. The group relied on known vulnerabilities such as CVE-2026-4815 in WooCommerce rather than zero-days, achieving rapid results including 4,708 hosts scanned and 32 webshells deployed in 61 seconds. The campaign resulted in the theft of 628,000 records, primarily from a Kharkiv heating supplier, containing names, addresses, account numbers, and energy consumption details.