SOCRadar
A cybersecurity company focused on external threat intelligence and digital risk protection, offering dark web monitoring and attack surface management services.
Timeline (last 90 days)
On October 6, 2026, SOCRadar released an investigation report, stating that it found more than 628,000 records related to Ukrainian individuals in the hands of an attacker named CyberXero.
A single automated website attack pipeline execution scanned 4,708 targets, confirmed 429 accessible WordPress admin panels, and deployed 32 web shells, all completed within 61 seconds.
CyberXero is classified by SOCRadar as an economically motivated initial access broker (IAB), with its operations divided into two lines: automated attacks against WordPress websites and online stores worldwide, and targeted attacks against Ukraine's energy and critical infrastructure.
CyberXero exposed its working directory on the internet with no access control; researchers found more than 90,000 files, including plaintext tokens, victim database exports, and AI agent session logs, and based on this mapped eight infrastructure nodes.
SOCRadar found evidence of data theft from four Ukrainian organizations, while seven other energy-sector organizations were in the reconnaissance phase but not yet confirmed to have been breached.
All Facts (5)
A single automated website attack pipeline execution scanned 4,708 targets, confirmed 429 accessible WordPress admin panels, and deployed 32 web shells, all completed within 61 seconds.
50%UnverifiedCyberXero is classified by SOCRadar as an economically motivated initial access broker (IAB), with its operations divided into two lines: automated attacks against WordPress websites and online stores worldwide, and targeted attacks against Ukraine's energy and critical infrastructure.
50%UnverifiedSOCRadar found evidence of data theft from four Ukrainian organizations, while seven other energy-sector organizations were in the reconnaissance phase but not yet confirmed to have been breached.
50%UnverifiedOn October 6, 2026, SOCRadar released an investigation report, stating that it found more than 628,000 records related to Ukrainian individuals in the hands of an attacker named CyberXero.
50%UnverifiedCyberXero exposed its working directory on the internet with no access control; researchers found more than 90,000 files, including plaintext tokens, victim database exports, and AI agent session logs, and based on this mapped eight infrastructure nodes.
50%