CyberXero ran 51 Claude Code agents against WordPress sites and Ukrainian utilities

The entry points are known flaws ^[3]. That keeps the defense ordinary: patch, then look for what was planted before the patch. SOCRadar says to check for WordPress administrator accounts that should not exist, WSO web shells, and SSH keys in ~/.ssh/authorized_keys on Redis hosts that nobody expected to find there ^[13].

The exposed logs show the pace of the planting. The automated run confirmed access on 9.1% of the 4,708 targets it scanned ^[5][15] and placed 32 web shells in 61 seconds, one every 1.9 seconds ^[5][16]. In our view that is machine pace.

SOCRadar describes eight nodes, among them the actor's Linux workstation, a provisioning server, monetization infrastructure, payload staging servers and a scanner ^[6]. The campaign pairs Cobalt Strike with an AI orchestration layer built on Claude Code ^[1]. AI runs at two independent stages. On the workstation, Claude Code drives a cluster of 51 specialized agents for scanning, exploit chaining, reconnaissance and post-exploitation ^[7]. On the Cobalt Strike Team Server, PentAGI, an open-source, self-hosted agent for autonomous penetration testing, reaches Cobalt Strike through an AI provider API for payload generation and pentest execution ^[8].

The refusal problem is where the logs are most specific. "Model safety controls act on the context of a session, not on the model weights, so a refusal in one session does not carry into the next," SOCRadar said ^[10]. It added: "When an agent refused a task, the actor reopened a fresh session, with the authorization framing preloaded and tried again." ^[11]

Some refusals did hold. Over four iterations the model would not plant a backdoor, turn off a firewall, move laterally or drop a web shell; in another episode it turned down a scan four times running and would not accept a forged ownership token ^[12].

The two pipelines have different jobs. The opportunistic one is built for access and payment data and is monetized through access sales or payment-data theft ^[14]. The directed one is built for deep reconnaissance and manual exploitation against Ukrainian energy and utilities ^[18].

Confirmed exfiltration covers four Ukrainian organizations and more than 628,000 records tied to Ukrainian individuals ^[17]. The Hacker News's account does not say which pipeline produced those records, or whether the Kharkiv heating provider is one of the four organizations. Other confirmed compromises are in Poland, China and the Netherlands ^[17], and the Redis route breached two Chinese entities ^[13].

Every figure here comes from SOCRadar's report as relayed by The Hacker News. The Russian-speaking, financially motivated profile and the July 2026 start date are SOCRadar's assessment ^[2]. SOCRadar says the campaign remains ongoing ^[4].