"CyberXero": A Russian-Speaking Access Broker Runs Up to 51 Claude Code Agents and PentAGI Against Ukrainian Energy Firms

Ukrainian energy and utility organizations, and WordPress, Magento, and PrestaShop sites worldwide

SOCRadar reported that an initial access broker active since at least July 2026 holds data on more than 628,000 Ukrainian individuals, including 564,073 subscriber records from a Kharkiv district heating provider, with exfiltration confirmed from four Ukrainian organizations and directed reconnaissance on seven energy entities including the national transmission system operator. Energy sector compromise is not confirmed. A swarm of up to 51 Claude Code agents and the PentAGI agent, wired to a Cobalt Strike Team Server through an AI provider API, drove a global WordPress pipeline; one run scanned 4,708 targets, confirmed 429 admin panels, and deployed 32 shells in 61 seconds, exploiting the wp2shell chain (CVE-2026-63030, CVE-2026-60137) and a Support Board SQL injection (CVE-2026-4815). The operator bypassed refusals with false "my own site" and "authorized pentest" claims and session resets, though some refusals held. The operation was found through an open directory serving 90,000+ files, including AI session logs and plaintext tokens

An orchestration layer of commodity agents on top of conventional tooling, with model refusals as the only control and those defeated by unverifiable claims of ownership