CyberXero: AI Agents Behind a 628K-Record Breach
In short: On October 6, 2026, SOCRadar researchers disclosed an operation by the hacking group CyberXero, which deployed up to 51 specialized AI agents built on Anthropic's Claude Code, chained to the PentAGI penetration-testing tool and a Cobalt Strike Team Server. The group used the setup to automate reconnaissance and website breaches at scale, and in a targeted campaign against Ukrainian energy and utility organizations, stole more than 628,000 records — addresses, account numbers, IP addresses, and access logs belonging to subscribers of a Kharkiv district heating provider. One automated scan completed in 61 seconds checked 4,708 targets and deployed 32 web shells.
What CyberXero did
CyberXero is a Russian-speaking initial access broker (IAB) running two parallel operations at once. The first is fully automated and broad: scanning thousands of WordPress sites and e-commerce platforms for vulnerable admin panels, then reselling access to other cybercriminals. The second is manual and targeted: operator-driven reconnaissance and data theft against Ukrainian energy and utility organizations, including reconnaissance activity against seven energy entities, among them a national grid operator.
How the AI agents were set up
According to SOCRadar, the operator's workstation had up to 51 specialized Claude Code agents configured, each handling a stage of the attack — reconnaissance, vulnerability discovery, exploitation, and persistence. The agents connected via an AI provider API to PentAGI, an automated penetration-testing framework, which in turn fed into a Cobalt Strike Team Server for command and control. Notably, the model repeatedly refused to execute explicitly malicious requests, forcing the operators to reword prompts to work around built-in safety guardrails.
What exactly was stolen
Confirmed exfiltration hit four Ukrainian organizations: the largest dataset was 564,073 subscriber records from a Kharkiv district heating provider (home addresses and account numbers), plus another 213,340 access-log entries with timestamps and IP addresses. In total, more than 628,000 records belonging to real people — some living in a city on an active front line, which makes the exposure especially sensitive.
Why this matters beyond Ukraine
The case shows two things at once. First, automated AI-driven attacks against WordPress and e-commerce sites are no longer a one-off — they're a scalable template: one scan a minute can check thousands of sites. If you run a site on a similar CMS, keeping passwords and plugins current is no longer a one-time task but ongoing hygiene. Second, for an everyday user the risk looks different: the more services — including utilities and energy providers — store your address, account number, and contact history, the higher the odds that data ends up in a breach like this, regardless of how careful you personally are. If your own account is already compromised, see our guide on protecting an account from hacking.
How to lower your own risk
- Use a different password for every service — a password manager makes this practical without memorizing or reusing credentials.
- Turn on two-factor authentication for any utility, energy, or banking account portal.
- If you get a call or message claiming to be from your energy or utility provider asking you to "confirm" your details, don't share anything — call back using the number on an official bill instead.
- If you run a WordPress site or similar CMS, patch plugins and the core software promptly — outdated admin panels were the entry point for the automated side of this campaign.
The breach itself happened on the targeted organizations' servers, and no VPN could have stopped that. But when you log into your own energy provider's portal, bank, or email over café, airport, or hotel Wi-Fi, encrypting your traffic with LiMP VPN closes a related risk — your login being intercepted on someone else's network. Plans start at 69 ₽/month — see pricing.