Cyber Xero Uses Claude Code in Campaign That Stole Over 628,000 Ukrainian Records
Summary: SOCRadar attributed a two-pronged AI-augmented initial access campaign to a Russian-speaking, financially motivated broker called CyberXero, active since at least July 2026, that pairs Cobalt Strike with an orchestration layer powered by Anthropic's Claude Code. Confirmed exfiltration from four Ukrainian organizations yielded more than 628,000 records tied to Ukrainian individuals, with other confirmed compromises in Poland, China, and the Netherlands, and one automated execution scanned 4,708 targets, confirmed access to 429 WordPress admin panels, and deployed 32 web shells in a 61-second window.
Why it matters: The actor evaded model refusals by reopening fresh sessions with preloaded claims of an authorized pentest on his own infrastructure, and the logs also show refusals that held across four iterations against installing a backdoor, disabling a firewall, moving laterally, and deploying a web shell. A single 61-second burst that planted 32 web shells on 429 compromised admin panels is the tempo your detection and response timelines are now measured against.