Discover how the CyberXero group utilized automated tooling and AI assistants to target Ukrainian infrastructure, scanning thousands of sites and breaching hundreds of admin panels within seconds to exfiltrate over 628,000 records.
The use of artificial intelligence in attacks
The group uses the Claude Code tool to plan and execute its attacks. To avoid the restrictions set by the AI's creators, the hackers falsely claim to be performing approved security checks.
In practice, the attackers exploit known vulnerabilities in WordPress plugins, such as Support Board. Their actions are largely automated: in one case alone, 4.708 targets were scanned, resulting in the successful compromise of 429 admin panels in just 61 seconds.
The accidental revelation of the perpetrators
Evidence of CyberXero's activities came to light when researchers discovered a digital folder of the perpetrators that was open and accessible on the internet. Inside the folder were tools for the attacks, ready-made programs (scripts) and the personal data they had stolen from their victims.
Research shows that the group systematically targets infrastructure with security vulnerabilities, combining automated technology with the selection of specific targets.
Top comments (0)