CyberXero Used 51 AI Agents to Steal 628,000 Ukrainian Records

SOCRadar researchers uncovered an operation dubbed “CyberXero,” a Russian‑speaking initial access broker that ran two pipelines—a high-speed automated campaign exploiting WordPress REST API flaws to deploy webshells across thousands of sites, and a curated campaign against Ukrainian energy and utility organizations—using up to 51 AI agents; an exposed server with ~90,000 files confirmed theft of over 628,000 Ukrainian records, revealed session logs, plaintext tokens, IoCs, and techniques used (wp2shell, Cobalt Strike integration), posing both privacy and potential physical risks to civilians.