Dark Web Profile: CyberXero

CyberXero is a financially motivated Russian-speaking Initial Access Broker active since July 2026. It operates two parallel campaigns: a global mass exploitation targeting WordPress, Magento, and e-commerce platforms, and a focused campaign against Ukrainian energy and utilities organizations. The actor uses AI augmentation with specialized Claude Code agents and PentAGI integrated with Cobalt Strike. Over 40 organizations across Ukraine, Poland, China, Pakistan, and the Netherlands have been affected, with more than 628,000 personal records exfiltrated and 429 WordPress admin panels compromised. Techniques include SQL injection, PHP deserialization, and lateral movement. The actor weaponizes vulnerabilities within 30 days of disclosure.

• CVE-2026-63030: WordPress Core Interpretation Conflict VulnerabilityCriticalVulnerability2026-07-21
• WordPress Exploitation Underway (CVE-2026-63030), (Mon, Jul 20th)ExploitedVulnerability2026-07-20
• WordPress door Automattic · Kwetsbaarheden VerholpenExploitedVulnerability2026-07-18
• CVE-2026-4815: Schiocco Support Board · SQL InjectionHighVulnerability2026-03-25
• ARTEX: Agentic AsbestosMalware2026-11-06