CriticalAPT
Dark Web Profile: CyberXero
SOCRadar·Source published ·1 min read
What happened?
CyberXero is a Russian-speaking, financially motivated Initial Access Broker (IAB) active on Dark Web forums, including Dread and HackForums. The actor runs two parallel operations: an opportunistic global campaign that mass-exploits WordPress, Magento and other e-commerce platforms for access and payment data, and a directed campaign that conducts curated reconnaissance against Ukrainian energy and utilities organizations.
Key details
- CyberXero is a Russian-speaking financially motivated Initial Access Broker active on Dark Web forums.
- The actor runs two parallel campaigns: mass-exploiting e-commerce platforms and targeted reconnaissance against Ukrainian energy organizations.
- Hardcoded administrator credentials allowed extraction of 564,073 subscriber records from Kharkiv’s district heating service without exploitation.
Affected
- More than 40 organizations across Ukraine, Poland, China, Pakistan and the Netherlands are confirmed victims.
Fixes and mitigations
- Patch WordPress, Magento, PrestaShop and Support Board deployments within days to address known vulnerabilities.
- Expose Redis to the internet only with authentication disabled and SLAVEOF/REPLICAOF command renamed or disabled.
- Block C2 IP 42.193.227.214 on ports 1002, 8044 and 8033 and hunt for UpdSvc service and PowerShell download cradles.
What to look for
- Watch for WordPress usernames matching wp2_ followed by eight hexadecimal characters indicating wp2shell compromise.
- Monitor for outbound connections to C2 IP 42.193.227.214 on ports 1002, 8044 or 8033.
- Search for the UpdSvc Windows service and PowerShell download cradles on endpoints.
Summarised by SecOraLens from SOCRadar. Always read the original source before acting. How SecOraLens verifies advisories.