AI agent incident
CyberXero ran 51 Claude Code agents in a campaign that stole more than 628,000 Ukrainian records
What happened
SOCRadar reported that CyberXero, a Russian-speaking initial access broker, used Claude Code with 51 specialized agents, plus the open-source PentAGI agent wired to Cobalt Strike, against WordPress and e-commerce sites worldwide and Ukrainian energy and utility targets, with confirmed exfiltration of more than 628,000 records from four Ukrainian organizations. SOCRadar found the operation through an exposed directory holding the actor's AI session logs and said the campaign is ongoing.
Why it matters
The logs show how the actor got around refusals: when an agent declined, they opened a fresh session framed as an authorized test of their own infrastructure, because a refusal does not carry over from one session to the next. Some refusals held: the model declined to install a backdoor or disable a firewall. With ARTEX, it is the second campaign this month that researchers reconstructed from the attacker's own exposed agent sessions.