CriticalRansomwareCVE-2026-4815
CyberXero Combines Claude Code, PentAGI and Cobalt Strike in AI-Augmented Cyberattacks
Cyber Security News·Source published ·1 min read
What happened?
CyberXero has emerged as an initial access broker that combines familiar hacking tools with artificial intelligence to run large-scale intrusions. The Russian-speaking operator targeted WordPress and e-commerce sites worldwide while separately probing Ukrainian energy and utility organizations. The campaign came to light after an open directory exposed more than 90,000 files, including scripts, AI session records and stolen data. The evidence indicates that the operation remained active during the investigation, raising concern that compromised access could be sold or reused.
Key details
- CyberXero operates as an initial access broker that merges traditional hacking tools with AI to conduct large‑scale intrusions.
- The group focused on compromising WordPress and e‑commerce sites worldwide while also probing Ukrainian energy and utility organizations.
- An automated scan hit 4,708 targets, discovered 429 WordPress admin panels and deployed 32 shells in just 61 seconds.
- CyberXero employed two AI layers, configuring up to 51 Claude Code agents for discovery, password testing, exploitation and data theft.
- The campaign also targeted Magento platforms, exploiting the Support Board CVE‑2026‑4815 vulnerability shortly after its disclosure.
Affected
- WordPress sites vulnerable to the wp2shell remote execution vulnerability chain need urgent patching.
- Magento installations are at risk due to the Support Board CVE‑2026‑4815 vulnerability.
- Ukrainian energy and utility entities, including the national transmission system operator, were mapped and targeted.
Fixes and mitigations
- Admins should verify WordPress updates, check for unknown plugins or admin accounts, limit internet‑facing Redis and audit SSH keys.
What to look for
- IP 46.21.250.135 was identified as the primary workstation and open‑directory seed node.
- IP 42.193.227.214 served as the Cobalt Strike Team Server and PentAGI endpoint on port 9995.
- Network endpoint 42.193.227.214:1002 was used for a Cobalt Strike beacon over HTTPS.
- Username pattern wp2_[0-9a-f]{8} indicated rogue WordPress administrator accounts.
- Service name UpdSvc was created as a persistence mechanism via svc.cna.
Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.