CyberXero is a financially motivated Russian-speaking Initial Access Broker active since July 2026. It operates two parallel campaigns: a global mass exploitation targeting WordPress, Magento, and e-commerce platforms, and a focused campaign against Ukrainian energy and utilities organizations. The actor uses AI augmentation with specialized Claude Code agents and PentAGI integrated with Cobalt Strike. Over 40 organizations across Ukraine, Poland, China, Pakistan, and the Netherlands have been affected, with more than 628,000 personal records exfiltrated and 429 WordPress admin panels compromised. Techniques include SQL injection, PHP deserialization, and lateral movement. The actor weaponizes vulnerabilities within 30 days of disclosure.
