On October 6, 2026, SOCRadar reported that Claude Code was one layer in a wider toolchain it attributed to CyberXero, alongside two distinct campaign streams: automated attacks on websites worldwide and targeted activity involving Ukrainian energy and utilities. Its account also details a reported route into an unnamed district-heating provider’s systems in Kharkiv and the data taken from them. For background, read NeoTeo’s earlier English-language overview of the campaign.
Claude Code’s reported role in the toolchain
SOCRadar says the operator’s primary workstation ran up to 51 specialized Claude Code agents for tasks including reconnaissance, exploit chaining and post-exploitation. The report describes a separate layer in which PentAGI connected to a Cobalt Strike Team Server through an AI-provider API; SOCRadar associates that setup with payload generation and penetration-testing execution.
Recovered session logs, according to SOCRadar, recorded refusals involving requests to install a backdoor, disable a firewall, move laterally and deploy a web shell. The logs also recorded attempts to reframe requests or open fresh sessions after refusals.
Two reported campaign streams
| Campaign stream | Target | Approach described by SOCRadar |
| Global, automated | WordPress and e-commerce sites | Automated targeting |
| Directed, Ukraine-focused | Ukrainian energy and utilities | Curated reconnaissance and manual exploitation |
SOCRadar reported four Ukrainian organizations with file-confirmed data exfiltration and seven additional energy and utilities entities under reconnaissance. It also said data linked to more than 628,000 Ukrainian individuals was in the actor’s possession. In one separate automated execution, SOCRadar counted 4,708 targets scanned, access to 429 WordPress administration panels and 32 web shells deployed within 61 seconds.
The Kharkiv provider’s data and reported access path
SOCRadar says a hardcoded credential in an actor script enabled direct access to an unnamed district-heating provider in Kharkiv, after which a multithreaded extractor pulled two distinct sets of data. One contained 564,073 subscriber records with personal data, home addresses and account numbers. The other comprised 213,340 access-log entries containing timestamps and IP addresses.
Those figures describe different kinds of records: subscriber information on one side, access logs on the other. SOCRadar’s report also places the provider’s data among the broader Ukrainian findings, rather than equating the record counts with a count of people affected by one incident.
What SOCRadar says ties the activity to CyberXero
SOCRadar says it found the operator’s working files in an exposed directory containing more than 90,000 files across 3,000 subdirectories. The company attributes the activity to the CyberXero alias based on several artifacts: an account file in the directory, session logs referring to a Dread forum post under that alias, external verification of the post, and infrastructure and subscription traces. SOCRadar says its identity-resolution work drew on five platforms; its report does not name an operator.
WordPress patterns associated with the campaign
SOCRadar identifies two WordPress indicators linked to the reported activity: an administrator username beginning with wp2_ followed by eight hexadecimal characters, and the plugin-directory pattern /wp-content/plugins/wp2shell_[0-9a-f]{8}/. The patterns give site administrators specific artifacts to investigate when reviewing their installations.
