An access broker ran 51 Claude Code agents against WordPress sites and Ukrainian energy firms, SOCRadar says

Misuse · Claude Code; PentAGI (misused) · HIGH

Incident dateJul 2026 onward (SOCRadar: first infrastructure observed July 2026; still active at publication)

DisclosedOct 6, 2026 (SOCRadar Threat Research Unit). The Hacker News and Security Affairs coverage Oct 12, 2026. Added here as a backfill on Oct 15, 2026.

Added hereOct 15, 5:25 PM ET

Last verifiedOct 15, 2026

Summary

SOCRadar's Threat Research Unit reported on Oct 6, 2026 that CyberXero, a Russian-speaking, financially motivated initial access broker active since at least July 2026, put an AI layer on top of ordinary attack tooling. On its main workstation it ran Claude Code with up to 51 specialized agents for scanning, exploit chaining, reconnaissance and post-exploitation. A second setup wired PentAGI, an open-source autonomous pentesting agent, into a Cobalt Strike team server through an AI provider API. One pipeline mass-exploited WordPress and e-commerce sites worldwide. The other ran hand-picked reconnaissance against seven Ukrainian energy and utilities entities. SOCRadar says four Ukrainian organizations had file-confirmed data theft, totaling more than 628,000 records tied to Ukrainian individuals, and counts more than 40 affected organizations overall. This is misuse of AI tools by an attacker, not a flaw in Claude Code or PentAGI.

Severity

HIGH High (VibeIncidents editorial rating): confirmed data theft from four Ukrainian organizations, including 564,073 subscriber records with home addresses from a heating provider in Kharkiv, plus web shells planted on compromised sites. Not Critical on our scale because no flaw in an AI tool was involved, and the figures come from one research firm's analysis of the attacker's own files.

Timeline

Jul 2026
SOCRadar first observes CyberXero infrastructure. Until late July the activity it found is in the workstation's bash histories; a second phase, starting when the actor's AI account was created, adds the AI layer (per SOCRadar).
Oct 6, 2026
SOCRadar publishes its CyberXero report and says the actor is still active.
Oct 12, 2026
The Hacker News and Security Affairs report SOCRadar's findings.

How it happened

SOCRadar found an HTTP server at 46.21.250[.]135 serving the actor's live Linux working directory with no access control: more than 90,000 files, including AI session logs, scripts with plaintext tokens, exploit kits, reconnaissance output, agent configurations and stolen victim data. From there it mapped eight related machines across three networks. The Claude Code layer is a folder of 51 agent definitions with roles such as c2-operator, exploit-chainer, scada-attacker and lateral-movement. The WordPress pipeline used wp2shell, an in-house Python tool that abuses the WordPress REST API batch endpoint (CVE-2026-63030 and CVE-2026-60137) to inject SQL, add a rogue admin and drop a WSO-family web shell as a plugin. One automated run scanned 4,708 targets, confirmed access to 429 admin panels and deployed 32 shells in 61 seconds. The actor also went after Support Board (CVE-2026-4815), Magento and exposed Redis servers. At the Kharkiv heating provider, a hardcoded credential in the actor's own script gave access, and an extractor pulled 564,073 subscriber records and 213,340 access-log entries. The session logs show the actor framing requests as an 'authorized pentest on my own infrastructure' and opening a fresh session after a refusal. Some refusals held: SOCRadar says that across four iterations the model declined to install a backdoor, disable a firewall, move laterally and deploy a web shell, and in another episode it rejected a forged ownership token. SOCRadar's public post does not name the specific models, or the AI provider PentAGI used. Neither SOCRadar's post nor the coverage we found includes a statement from Anthropic.

How to check your app

If you run WordPress, look for admin accounts named wp2_ followed by eight hex characters, and plugin folders matching /wp-content/plugins/wp2shell_ plus eight hex characters. SOCRadar says both come from wp2shell.
Keep WordPress core and the Support Board plugin (CVE-2026-4815) patched, and check Magento and PrestaShop stores for rogue admins and web shells.
On Redis servers reachable from the internet, check ~/.ssh/authorized_keys for keys you did not add, then take Redis off the public internet.
Load SOCRadar's indicators (server IPs, Cobalt Strike ports, the UpdSvc service name) into your blocking and hunting tools.
If you run AI agents on servers, treat their session logs and working folders as sensitive and keep them off the open web. In this case they exposed the attacker.

Sources

Corrections and updates

None. Re-checked against every source on Oct 15, 2026.