CyberXero's 51 AI Agents Stole 628,000 Ukrainian Records in 61 Seconds

CyberXero built two parallel attack tracks from the same AI infrastructure. The automated global track targets WordPress installations at internet scale. A single orchestrated run scans thousands of targets, authenticates to accessible WordPress admin panels using credential stuffing, fires the CVE-2026-63030 REST API batch endpoint payload, and deploys PHP web shells before moving to the next target. The 61-second timeline for 4,708 targets is not anomalous: it is the design goal of an agent pipeline that removes every human bottleneck.

The curated manual track targets Ukrainian energy infrastructure. For these high-value targets, CyberXero operators direct AI agents through deliberate lateral movement, using stolen credentials and Cobalt Strike beacons to navigate internal segments. PentAGI connects to the Cobalt Strike Team Server and coordinates agent behavior across the post-compromise phase without requiring continuous human supervision.

The 51 Claude Code agent definitions found in CyberXero's exposed working directory reveal the attack taxonomy. Reconnaissance agents used Shodan queries and custom port scans. Exploitation agents carried CVE-specific payloads for WordPress, SonicWall SMA VPNs, Keycloak instances, and Microsoft Exchange endpoints. Post-exploitation agents handled credential harvesting from database tables and configuration files. Exfiltration agents staged data locally before transmitting to 46.21.250.135 using HTTP POST with base64-encoded payloads.

Two supply chain attacks covered this week share the same credential-harvesting logic: attackers acquire legitimate access tokens from developer pipelines and reuse them at scale. CyberXero extends that pattern by using AI to orchestrate the token reuse automatically, without a human operator selecting targets individually.

Four Ukrainian organizations suffered confirmed exfiltration. The Kharkiv district heating provider was the largest single breach: 564,073 subscriber records including home addresses, billing account numbers, and service zone data, plus 213,340 access log entries that reveal internal API authentication patterns. Additional confirmed compromises affected organizations in Poland, Netherlands, and China, though full record counts have not been published.

Reconnaissance logs in the exposed working directory show activity against at least 7 Ukrainian energy entities. SOCRadar assessed that not all reconnaissance produced confirmed exfiltration, but the targeting pattern is consistent with a financially motivated actor evaluating which organizations hold the most valuable data before committing to full exfiltration operations.

The global automated campaign cast a wider net. One logged run scanned 4,708 targets across four countries, identified 429 WordPress admin panels with accessible login interfaces, and placed 32 web shells. The web shell deployments serve dual purposes: they enable persistent access for ransomware or extortion follow-through, and they provide the actor a monetizable access inventory to sell on underground forums. CyberXero's classification as an initial access broker means some of the 429 compromised sites may already be listed for sale to ransomware affiliates.

The following indicators are derived from SOCRadar's analysis of CyberXero's exposed working directory. Block the C2 IP immediately at your perimeter. Monitor for the REST API exploitation path and webshell creation patterns in your web server logs and EDR telemetry.

The Support Board plugin endpoint indicator applies specifically to WordPress sites running the Support Board plugin through version 3.6.1. If that plugin is present in your environment, prioritize its removal or update regardless of whether other IOCs are visible.

These rules target the two most reliable detection signals from the CyberXero campaign: exploitation of the WordPress REST API batch endpoint and outbound connections to the confirmed C2 host. Both carry experimental status; validate against your environment's log format and whitelist your internal REST API clients before enabling automatic blocking.

Three CVEs form CyberXero's initial access toolkit against WordPress installations. CVE-2026-63030 and CVE-2026-60137 are chained together in the wp2shell attack: CVE-2026-63030 is a critical remote code execution flaw in the WordPress core REST API batch endpoint, and CVE-2026-60137 enables privilege escalation after initial entry. CISA added both to the Known Exploited Vulnerabilities catalog on July 21, 2026. CVE-2026-4815 is a SQL injection vulnerability in the Support Board plugin that CyberXero uses as an alternate entry point. WordPress released fixes on July 17, 2026.

Any WordPress installation running versions before 6.8.6 (for the 6.8.x branch), 6.9.5 (for 6.9.x), or 7.0.2 (for 7.0.x) remains vulnerable to automated exploitation by CyberXero's scan pipeline. Forced automatic updates reached many installations when the patches shipped, but self-hosted environments with auto-updates disabled, custom hosting configurations, or modified core files may not have received the fix. Verify your version manually with wp core version or check the WordPress admin dashboard.

See the GhostAction supply chain attack post for the credential rotation checklist that applies if your WordPress credentials may have been exposed alongside this campaign.

The speed advantage is the clearest immediate consequence. CyberXero's 61-second window from scan to deployed web shell eliminates the assumption that defenders have hours or days to respond to new vulnerability disclosures before mass exploitation begins. When the attacker's pipeline can pivot from reconnaissance to active exploitation faster than a human analyst can read the advisory, patch windows measured in days are no longer protective.

The skill barrier argument against AI-powered attacks has consistently been overstated. CyberXero is assessed as a financially motivated criminal actor, not a nation-state. The attacker did not need a deep understanding of each CVE's technical mechanism: the Claude Code agents carried pre-configured exploitation payloads, and the PentAGI orchestration layer handled the sequencing. The practical effect is that threat actors who previously lacked the technical depth to execute complex multi-CVE campaigns can now operate them at scale by configuring AI agent pipelines.

The actor's own carelessness exposed the operation: an unsecured open directory on the primary workstation revealed the full attack toolkit, victim data, and AI session logs. That is the intelligence opportunity here. When AI-orchestrated attackers run automated pipelines, they generate structured logs, agent configuration files, and reusable tooling that leave forensic artifacts traditional human-operated attacks avoid. Defenders who instrument their environments for outbound connections, anomalous REST API activity, and unexpected file creation in web directories will surface these campaigns before exfiltration volume reaches six figures.