Russian Threat Actor Used Claude to Steal 628,000 Ukrainian Records — And the AI Said No Several Times
A financially motivated Russian-speaking threat actor has been running a two-track cyberattack operation against WordPress sites and Ukrainian critical infrastructure, using Anthropic's Claude Code as an AI orchestration layer alongside commodity tools like Cobalt Strike. SOCRadar published the findings last week after stumbling onto an exposed open directory that essentially handed researchers a live window into the attacker's working environment.
The actor, tracked as CyberXero and believed to have been active since at least July 2026, left an unsecured directory on 46.21.250[.]135 containing AI session logs, exploitation scripts with plaintext tokens, reconnaissance output, and exfiltrated victim data. Sloppy operational security, but useful for investigators.
Confirmed exfiltration from four Ukrainian organisations produced more than 628,000 records tied to Ukrainian individuals. Additional compromises were identified in Poland, China, and the Netherlands. The campaign is still running.
The operation runs two parallel pipelines. The first is a wide-net, automated sweep targeting WordPress and e-commerce platforms globally, exploiting known vulnerabilities including CVE-2026-63030, CVE-2026-60137, and an SQL injection flaw in the Support Board WordPress plugin (CVE-2026-4815). One automated scan run covered 4,708 targets, confirmed access to 429 WordPress admin panels, and dropped 32 web shells in 61 seconds. That is not a typo.
The second pipeline is more deliberate. It focuses specifically on Ukrainian energy and utilities infrastructure, including a heating provider in Kharkiv, with manual exploitation and deeper reconnaissance. Unlike the first pipeline, the motive here is not obviously financial — which is worth noting given the geopolitical context.
On the AI side, CyberXero deployed Claude Code with 51 specialised agents handling scanning, exploit chaining, reconnaissance, and post-exploitation tasks from the attacker's primary workstation. Separately, an open-source autonomous penetration testing tool called PentAGI was connected to the Cobalt Strike team server via an AI provider API for payload generation.
To work around model safety guardrails, the attacker used a straightforward trick: telling Claude the activity was an authorised penetration test on their own infrastructure. When a session refused a task, they simply reset it and tried again with the same framing preloaded. Since safety controls are session-scoped rather than baked into model weights, this approach had some success.
That said, it did not work every time. SOCRadar's analysis of the logs found genuine refusals that held across multiple attempts. The model declined four separate requests to install a backdoor, disable a firewall, move laterally, and deploy a web shell. It also refused to conduct a scan four consecutive times and correctly rejected a forged ownership token. The AI was not entirely compliant, which is worth acknowledging even if the overall picture is not reassuring.
Exposed Redis servers were also exploited as part of the campaign, leading to the breach of two Chinese entities. Organisations running WordPress, Magento, or PrestaShop, or with Redis exposed to the internet, should be checking for rogue admin accounts, WSO web shells, and unexpected entries in authorised SSH keys on Redis hosts.
Operation Master: Invoice Fraud at Industrial Scale
The same SOCRadar report also unpacked a separate but thematically related operation called Operation Master, run by a threat actor using the alias 'masterblack' on cybercrime forums.
Between April and mid-September 2026, masterblack ran a sprawling campaign that included mass scanning for Palo Alto GlobalProtect gateways vulnerable to CVE-2026-0257, SQL injection attacks against Brazilian SaaS, financial, and education platforms, exploitation of CVE-2023-7028 in GitLab, device-code phishing against Microsoft 365 tenants, brute-force attacks on Japanese WordPress sites, and the use of tools like GodPotato, Evil-WinRM, and PwnKit for privilege escalation.
Data exfiltration used DNS tunnelling, rclone, and SFTP. Command-and-control was handled through the AdaptixC2 framework.
But the end goal was financial fraud targeting Brazilian consumers. masterblack built an automated, multi-tenant invoice fraud platform that sent over 2.4 million email, SMS, and WhatsApp messages along with 622,666 personalised invoice links designed to trick recipients into making Pix payments. The platform recorded nearly 170,000 target interactions. Click-tracked short links carried a cumulative invoice value of R$150.4 million, with potentially fraudulent invoices reaching R$38.9 million.
As with CyberXero, Claude is believed to have been used heavily in developing the intrusion code and exfiltration scripts. Recovered refusal logs show masterblack repeatedly framing offensive development requests as authorised bug bounty or penetration testing activity — the same session-reset approach used by CyberXero.
What links both operations is the now-familiar pattern: capable threat actors using AI assistants as development accelerators while wrapping requests in plausible-sounding authorisation claims. The tools are not making these actors omnipotent, but they are making them faster. And the refusals, real as they are, clearly did not stop either campaign.