SOCRadar’s October 6, 2026, report says data relating to more than 628,000 Ukrainian individuals was in the hands of CyberXero, and that four Ukrainian organizations had file-confirmed data exfiltration. The report describes Claude Code as one part of an operator-controlled toolchain, alongside a separate AI-assisted setup. SOCRadar’s findings
SOCRadar classified CyberXero as a Russian-speaking, financially motivated initial-access broker: an operator that gains entry to systems for potential resale or other monetization. Its account describes two tracks—a global, automated effort against WordPress and e-commerce systems, and selective reconnaissance and manual exploitation aimed at Ukrainian energy and utilities.
What the Ukrainian figures count
SOCRadar reports file-confirmed exfiltration from four Ukrainian organizations. Separately, it says seven energy and utilities entities were under reconnaissance. The two counts describe different stages of activity.
For a district-heating provider in Kharkiv, SOCRadar lists 564,073 subscriber records containing personal data, addresses, and account numbers, as well as 213,340 access-log entries with timestamps and IP addresses. These are separate data categories, not a combined count of people.
Claude Code was one layer in a larger toolchain
SOCRadar describes up to 51 specialized Claude Code agents running on the operator’s primary workstation. It assigns them tasks involving reconnaissance, exploit chaining, and post-exploitation. Separately, it describes PentAGI connected through an AI-provider API to a Cobalt Strike Team Server, for payload generation and penetration-testing execution.
| Tooling layer | Reported location | Reported role |
| Claude Code | Operator’s primary workstation | Up to 51 specialized agents for reconnaissance, exploit chaining, and post-exploitation |
| PentAGI with Cobalt Strike | PentAGI connected to a Cobalt Strike Team Server through an AI-provider API | Payload generation and penetration-testing execution |
The account places Claude Code within an operator-run campaign. It describes automation for particular tasks, not a tool independently directing the whole operation. For another distinct case involving Claude, NeoTeo previously covered China-linked military and surveillance operations described by Anthropic.
What one automated run involved
In one execution, SOCRadar says CyberXero scanned 4,708 targets, accessed 429 WordPress administration panels, and deployed 32 web shells in 61 seconds. The panel figure describes access to administrative panels; SOCRadar separately reports file-confirmed exfiltration from four Ukrainian organizations.
The report also describes attempts to work around some model refusals: after a refusal, the operator reopened sessions with authorization framing. SOCRadar says other refusals held, including requests involving a backdoor, disabling a firewall, lateral movement, and deploying a web shell.
SOCRadar said the campaign was active when it published its report on October 6, 2026. For WordPress administrators, the report identifies administrator usernames matching wp2_ followed by eight hexadecimal characters, and plugin paths matching /wp-content/plugins/wp2shell_[0-9a-f]{8}/, as indicators associated with the campaign’s wp2shell tool.
