CyberXero: An AI-Augmented Initial Access Broker Targeting Ukrainian Critical Infrastructure

**Executive summary:** SOCRadar documents "CyberXero," a Russian-speaking financially motivated initial access broker that pairs commodity tooling (Cobalt Strike, webshells, SQLi chains) with an AI orchestration layer to run a high-scale global campaign against WordPress/e-commerce and a directed campaign against Ukrainian energy and utilities; the exposed working directory revealed AI session logs, scripts, plaintext tokens, IoCs (IPs, hashes, username patterns), and confirmed exfiltration of over 628,000 Ukrainian records, prompting detailed TTP mapping and detection/hunting guidance.