A Hacker Ran 51 Claude Code Agents Against Ukrainian Targets, Stole 628,000 Records, and Left the Logs Exposed

A financially motivated hacker has spent at least the past three months running two very different campaigns at once. One sprayed the internet looking for WordPress sites and online stores to break into and sell. The other quietly picked through Ukrainian energy and critical infrastructure, including a heating provider in Kharkiv. Both were powered by a fleet of AI agents.

Researchers at SOCRadar call the actor CyberXero, a Russian-speaking initial access broker active since at least July 2026. The firm confirmed data theft from four Ukrainian organizations, adding up to more than 628,000 records tied to Ukrainian individuals. The campaign is still running.

Two pipelines, two motives

The first pipeline is the money machine. It hunts known flaws in WordPress and a WordPress plugin across e-commerce platforms, then cashes in by selling the access or stealing payment data. It moves fast. In one automated run it scanned 4,708 targets, confirmed access to 429 WordPress admin panels, and planted 32 web shells in a 61 second window.

The second pipeline makes less sense on paper. It is manual, curated and aimed squarely at Ukraine, with a focus on deep reconnaissance rather than a quick sale.

"The opportunistic pipeline is global and automated, chasing access volume across e-commerce and WordPress with direct monetization through access sales or payment-data theft," SOCRadar wrote. "The directed pipeline is selective and geographically concentrated, aiming for deep reconnaissance and manual exploitation at Ukrainian critical infrastructure, with no obvious direct-monetization explanation."

The victims were not only in Ukraine. SOCRadar also confirmed compromises in Poland, China and the Netherlands, and exposed Redis servers led to the breach of two Chinese entities.

The AI crew

On its main workstation, the actor ran Anthropic's Claude Code with a cluster of 51 specialized agents handling scanning, reconnaissance and post exploitation work. Separately, it wired an open source autonomous pentesting agent called PentAGI into Cobalt Strike, the commercial attack framework.

It is a sharp example of how a single operator can now run something that looks like a team, the same pattern that surfaced when Anthropic warned that AI was letting lone actors run state-level hacks.

The model did not simply go along with everything. The actor framed its requests as an "authorized pentest on my own infrastructure" and opened fresh sessions when it hit a refusal. "Model safety controls act on the context of a session, not on the model weights, so a refusal in one session does not carry into the next," SOCRadar noted.

Some refusals stuck anyway. According to the researchers, "across four iterations the model declined to install a backdoor, disable a firewall, move laterally, and deploy a web shell, and in a separate episode it refused a scan four consecutive times and correctly rejected a forged ownership token."

Caught by its own mess

For all the automation, CyberXero was undone by a basic mistake. SOCRadar found the operation through an open directory on the actor's server that exposed its live working directory.

Inside sat everything: AI session logs, scripts holding plaintext tokens, toolkits, reconnaissance output, AI agent configurations and stolen victim data. The hacker had built an agent army and then left the door to its barracks wide open.

What defenders should check

SOCRadar's advice targets anyone running WordPress, Magento or PrestaShop, or exposing Redis to the internet. Look for rogue WordPress administrator accounts, WSO web shells on web servers, and unexpected entries in the authorized SSH keys file on Redis hosts.

Why an access broker would spend its time mapping a Kharkiv heating provider, with no clear way to profit from it, is the one question the leaked logs do not answer.

Some offers on this page may be paid placements or contain affiliate links.