Russian-Speaking CyberXero Uses AI Agent Swarm to Attack Ukrainian Energy Infrastructure

CyberXero is a Russian-speaking initial access broker using conventional exploitation, a custom WordPress package (wp2shell), Cobalt Strike, and an AI agent swarm to scale global website compromises and targeted intrusions against Ukrainian energy entities; investigators recovered an exposed workstation with >90,000 files, mapping of infrastructure, agent definitions, session logs, and confirmed exfiltration of civilian and organizational data, plus several IOCs (multiple IPs, provisioning artifacts, and distinctive rogue admin naming patterns).