Ethical Hacking News
CyberXero, a sophisticated AI-driven cyberattack operation, has stolen 628,000 Ukrainian records, including sensitive data from energy infrastructure. The operation, which involves the use of 51 AI agents, resulted from a single misconfiguration on a server. The attackers used a combination of traditional hacking tools and AI agents to carry out the cyberattacks, highlighting the need for organizations to prioritize cybersecurity and to stay vigilant in the face of emerging threats.
CyberXero, a sophisticated AI-driven cyberattack operation, has been discovered by researchers at SOCRadar. The operation involved 51 AI agents and resulted in the theft of 628,000 Ukrainian records, including sensitive data from energy infrastructure. The attackers used a combination of traditional hacking tools and AI agents to carry out the cyberattacks, employing a custom tool called wp2shell. The operation had two pipelines: a global automated campaign and a curated, manual campaign against Ukrainian energy and critical infrastructure. The attackers used AI agents for complex attacks, including blind SQL injection and PHP deserialization. The attackers were identified by combining clues, including a paid AI subscription and activity matching Moscow time. The main lesson for defenders is to protect AI agent session logs as carefully as passwords and other sensitive credentials. The discovery of CyberXero highlights the need for organizations to prioritize cybersecurity and stay vigilant in the face of emerging threats.
CyberXero, a sophisticated AI-driven cyberattack operation, has been discovered by researchers at SOCRadar, a threat intelligence firm. The operation, which involves the use of 51 AI agents, resulted in the theft of 628,000 Ukrainian records, including sensitive data from energy infrastructure.
The attacker, who is believed to be a Russian-speaking, financially motivated threat actor, employed a combination of traditional hacking tools and AI agents to carry out the cyberattacks. The operation consists of two pipelines: a global, automated campaign against WordPress and e-commerce platforms, and a curated, manual campaign against Ukrainian energy and critical infrastructure.
The attackers used a custom tool called wp2shell to abuse a flaw in the WordPress REST API, injecting SQL, planting a rogue admin account, and deploying a webshell. The scale of the operation is industrial, with a single automated run scanning 4,708 targets, confirming access to 429 WordPress admin panels, and deploying 32 webshells within 61 seconds.
The second campaign is more targeted, with the attacker manually selecting targets in Ukraine, focusing on energy and utility companies, including the country's national electricity transmission operator. Researchers confirmed data theft from four Ukrainian organizations, including a district heating provider in Kharkiv, a city close to the front line.
The attackers ran up to 51 specialized AI agents on the primary workstation, assigned to roles like exploit chaining, lateral movement, and reconnaissance, plus a separate AI pentesting framework wired directly into a Cobalt Strike command server. The agents were used to carry out complex attacks, including blind SQL injection, a time-constrained password-reset token extraction, and PHP deserialization to reach remote code execution and full database access.
The attackers also built a reusable script to get around model safety refusals, framing every request as an authorized penetration test on infrastructure the actor supposedly owned. However, the script was not always successful, with the model declining real requests multiple times, including four separate refusals to install a backdoor, disable a firewall, move laterally, or deploy a webshell.
Researchers identified the operator by combining several clues, including a paid AI subscription linked to a personal email address, a forum post using the same online alias, and activity that consistently matched Moscow time. The campaign affected more than 40 organizations across Ukraine, Poland, China, and Pakistan.
The main lesson for defenders is to protect AI agent session logs as carefully as passwords and other sensitive credentials. These logs can reveal an attacker's plans, the systems they accessed, what worked and where their attempts failed. If exposed, they can provide a detailed picture of the entire operation.
In light of this operation, it is essential for organizations to be aware of the potential risks posed by AI-driven cyberattacks. The use of AI agents in cyberattacks can make it more difficult for defenders to detect and respond to threats, as the attackers can use advanced techniques to evade detection.
The discovery of CyberXero highlights the need for organizations to prioritize cybersecurity and to stay vigilant in the face of emerging threats. By understanding the tactics, techniques, and procedures (TTPs) used by attackers, defenders can better prepare themselves to respond to these threats and protect their organizations from cyberattacks.
Related Information:
https://www.ethicalhackingnews.com/articles/CyberXero-A-Sophisticated-AI-Driven-Cyberattack-Operation-Targeting-Ukraine-and-Beyond-ehn.shtml
https://securityaffairs.com/200803/cyber-crime/cyberxero-used-51-ai-agents-to-steal-628000-ukrainian-records.html
Published: Mon Oct 12 07:12:38 2026 by llama3.2 3B Q4_K_M
