CyberXero's AI-Powered Attacks Theft 628 Thousand Data Records
Cybersecurity researchers have revealed that the Russian-speaking group CyberXero targeted Ukrainian critical infrastructure and global WordPress sites using Claude Code and Cobalt Strike.
Cybersecurity experts have detailed the two-pronged initial access campaign conducted by the Russian-speaking and financially motivated threat actor CyberXero, utilizing Anthropic's Claude Code artificial intelligence tool.
Two-Pronged Attack Operation
According to cybersecurity researchers' reports, this operation simultaneously runs two separate lines: a manual campaign targeting energy and critical infrastructure in Ukraine, and an automated campaign directed against global WordPress sites.
Vulnerabilities Exploited
The global campaign specifically focuses on known vulnerabilities, such as wp2shell flaws and SQL injection affecting the Support Board WordPress plugin, aiming to take control of websites.
Volume of Stolen Data and Affected Regions
As a result of this cyber attack, data leaks from at least four Ukrainian organizations were confirmed, and over 628,000 records belonging to Ukrainian citizens were compromised. Additionally, breaches were detected in Poland, China, and the Netherlands.
The Role of Artificial Intelligence and Automation
While the attacking group utilized the Claude Code tool during the scanning, exploitation chaining, and reconnaissance phases, they employed context engineering and session reset techniques to bypass model limitations.