Ledger / Jul 2026
CyberXero initial access broker runs 51 Claude Code agents plus PentAGI
Confirmed
SOCRadar analyzed an exposed open directory with agent configs and session logs documenting the AI use.
The actor's workstation ran a swarm of 51 specialised Claude Code agents, and the team server wired PentAGI to Cobalt Strike. Logs record a fictional 'authorized pentest' narrative built to avoid model refusals; the Ukrainian campaign itself was largely manual.
“An AI orchestration layer: up to 51 specialized Claude Code agents on the primary workstation, plus a PentAGI deployment wired into a Cobalt Strike Team Server through an AI provider API”SOCRadar
Sources
- CyberXero: An AI-Augmented Initial Access Broker Targeting Ukrainian Critical InfrastructureSOCRadar · 6 Oct 2026 · primary source
- Date
- Jul 2026
- Disclosed
- 6 Oct 2026
- Actor
- CyberXero (criminal), as attributed by SOCRadar
- Nexus
- Russia (medium confidence per SOCRadar)
- Targets
- Ukrainian energy and utilities, plus mass WordPress/e-commerce scanning
- What the AI did
- Recon, Exploit dev, Agentic intrusion, Ops automation, Evasion
- Model
- Claude Code, PentAGI via an AI provider API
- Model family
- Anthropic, Open-source harness
- Model basis
- stated by researcher
- Autonomy
- semi-autonomous
- Outcome
- Data on 628,000+ Ukrainian individuals held; four organizations had confirmed exfiltration; no confirmed sale of access.