SOCRadar has published research on an operation it calls CyberXero, which it describes as a Russian-speaking, financially motivated initial access broker — a business that breaks in and sells the way in to somebody else.

The entire investigation rests on one configuration mistake. The operator left an open directory serving their live working directory: AI session logs, scripts with plaintext tokens, and exfiltrated victim data, readable by anyone who found it.

The third time this month

That sentence should be starting to feel familiar, because it is the third time in a fortnight we have written it.

A Gentlemen ransomware affiliate was documented because his staging server had an unauthenticated file listing. The operator behind the ARTEX intrusions into South Korean finance left browsable folders holding session logs and, apparently, their own CV. Now this.

Three operations, three competent technical campaigns, three directory listings left on.

The honest reading of three in a fortnight is not that attackers are careless. It is that this is the failure mode we can see, so it is the one that gets written about. Every campaign documented this way is a campaign that made one specific mistake, and the ones that did not make it are not in anybody's blog. The research pipeline for threat intelligence has a bias built into it, and three in a fortnight is a good moment to notice.

What it runs

The tooling is a mix of the completely ordinary and the new.

Cobalt Strike does the command and control, as it has for a decade. Alongside it SOCRadar describes an AI orchestration layer: up to 51 specialised agents built on Anthropic's Claude Code, covering reconnaissance, exploitation, lateral movement and exfiltration, plus a separate PentAGI integration wired to Cobalt Strike through an AI provider's API.

Two things are worth keeping straight here.

First, the reporting is explicit that this connects AI assistance to established offensive tools rather than replacing an intrusion with one autonomous system. Fifty-one agents is a number about task decomposition, not about autonomy.

Second, the disclosure we make whenever this comes up: this site is written with Claude's assistance, which is stated on our editorial policy page. That is a reason to report this precisely, not a reason to skip it.

Two pipelines

The structure is what makes it an access broker rather than a crew with a target.

One pipeline is automated and global, pointed at WordPress and e-commerce sites. In a single run SOCRadar describes it scanning 4,708 targets, confirming access to 429 WordPress administration panels, and deploying 32 shells in 61 seconds.

The other is manual and specific, aimed at Ukrainian energy and infrastructure organisations.

That division tells you how the business works. The automated side produces inventory — access to sell, in volume, to whoever wants it. The manual side is where attention is spent, and attention is the expensive input. An access broker does not need to know what the buyer wants; it needs a catalogue.

The number to be careful with

Reporting carries a figure of more than 628,000 records.

It comes from seven infrastructure targets, and one bulletin notes the origin and full impact of the dataset are unclear. Treat it as reported rather than verified. Where a record count has not been confirmed against the organisations it supposedly came from, it is a claim about what was in a directory, not a count of affected people.

SOCRadar says the operation was still active at publication, which is its own warning: access obtained during the investigation period may already have been sold.

What to do

  • If you run WordPress with an administration panel reachable from the internet, you are in the automated half of this. Put it behind authentication at the edge, enforce multi-factor on administrator accounts, and check for shells in upload directories.
  • Shells deployed at a rate of thirty-two a minute are not placed by hand. Look for file creation in web-writable paths rather than for a person.
  • For infrastructure operators in the region: the manual pipeline is the one to read SOCRadar's indicators for.
  • Treat an access broker compromise as a timer. The point of the intrusion is to sell it, so the gap between the breach and the consequence can be weeks.

What is not established

  • Whether the 628,000-record figure is accurate, or what it contains.
  • Who bought anything, and what they did with it.
  • Whether the automated WordPress activity and the Ukrainian targeting are the same operator throughout, or a shared toolkit.
  • How many organisations are affected. Scans and confirmed panels are not the same as compromises.
  • Anything about the operator's identity beyond the language assessment.