Researchers at SOCRadar have documented CyberXero, a Russian-speaking, financially motivated initial access broker (a criminal who breaks in and sells access) that has been active since at least July 2026. It runs two campaigns at once: a global, automated one against WordPress and e-commerce sites, and a manual, targeted one against Ukrainian energy and critical infrastructure organizations, including a heating provider in Kharkiv. SOCRadar says confirmed exfiltration from four Ukrainian organizations yielded more than 628,000 records tied to individuals, with other confirmed compromises in Poland, China and the Netherlands. The campaign was still active when SOCRadar published.
What sets it apart is the tooling. Using an exposed open directory on the attacker’s own workstation (AI session logs, scripts with plaintext tokens, exploitation toolkits and stolen data), SOCRadar found Claude Code running a cluster of 51 specialized agents for scanning, exploit chaining, reconnaissance and post-exploitation, plus PentAGI, an open-source autonomous penetration-testing agent, wired into a Cobalt Strike team server. One automated run scanned 4,708 targets, confirmed access to 429 WordPress admin panels and dropped 32 web shells in 61 seconds. The global campaign leans on known flaws: the wp2shell WordPress bugs (CVE-2026-63030 and CVE-2026-60137) and CVE-2026-4815, an SQL injection in the Support Board plugin; it also exploited exposed Redis servers to breach two Chinese entities.
The logs also show how the actor got around model refusals: it framed requests as an “authorized pentest on my own infrastructure” and, when an agent refused, opened a fresh session with that framing preloaded. SOCRadar notes that the logs record some refusals that held, such as declining to install a backdoor, disable a firewall, move laterally or deploy a web shell across four iterations. Its conclusion is that session-reset evasion is better handled by logging and auditing at the infrastructure layer than by the model alone. The wp2shell flaws were covered in our July post on the WordPress wp2shell RCE.
How to check if you’re affected
Affected products are WordPress, Magento and PrestaShop sites, and Redis servers exposed to the internet. Per SOCRadar and THN, check for:
- Rogue WordPress administrator accounts whose username is
wp2_followed by eight hexadecimal characters (created by wp2shell). - Plugin directories matching
/wp-content/plugins/wp2shell_[0-9a-f]{8}/, which indicate a deployed web shell. - A WSO-family web shell variant that SOCRadar says was undetected on VirusTotal at analysis time.
- Unexpected entries in
~/.ssh/authorized_keyson Redis hosts, consistent with the rogue-replication (SLAVEOF) technique. - Outbound traffic to the attacker infrastructure, starting with the seed node 46.21.250[.]135 (the full indicator set is in SOCRadar’s report).
Make sure the WordPress core, plugin and Support Board versions you run are patched against the CVEs above, and do not expose Redis to the internet.