SOCRadar says CyberXero ran 51 Claude Code agents beside Cobalt Strike

On 6 October 2026, SOCRadar’s Threat Research Unit published a post on an actor it calls CyberXero. SOCRadar describes CyberXero as a Russian-speaking, financially motivated initial-access broker, and says one pipeline ran curated reconnaissance against Ukrainian energy and utilities. That targeting and that language assessment are SOCRadar’s. The Hacker News, in a 12 October story by Ravie Lakshmanan, relays the report and attributes the operational claims to SOCRadar.

SOCRadar says the material came from an open directory at 46.21.250[.]135, which it describes as the live working directory of a Linux workstation, including session logs, agent configuration, and data the actor had collected. The report landing page summarizes the same write-up. SOCRadar said the activity was still underway when the 6 October post was published. THN, citing SOCRadar, described the campaign as ongoing on 12 October.

Claude Code, and a pentest framework on Cobalt Strike

SOCRadar says the actor used AI in two layers. On the primary workstation, Claude Code was set up with up to 51 specialized agents. On a Cobalt Strike team server, SOCRadar says a PentAGI deployment was connected through an AI provider API and used for payload generation and pentest execution. THN repeats both points and credits SOCRadar.

SOCRadar says the session logs show two patterns around refusals. One is a repeated framing, which SOCRadar quotes as an “authorized pentest on my own infrastructure,” used across unrelated victims. The other is opening a fresh session after a refusal, with that framing loaded again. SOCRadar’s line, which THN quotes, is that safety checks apply to a session’s context, so a refusal in one session does not carry into the next.

The same logs, SOCRadar says, record refusals that held. Across four iterations the model declined to install a backdoor, disable a firewall, move laterally, and deploy a web shell. In a separate episode it refused a scan four times and rejected a forged ownership token. THN quotes that passage.

Counts SOCRadar reports

SOCRadar’s figures, which THN also relays, include one automated run that scanned 4,708 targets, confirmed access to 429 administration panels, and deployed 32 shells inside 61 seconds. SOCRadar says seven Ukrainian energy and utilities entities were under curated reconnaissance, and that four Ukrainian organizations had file-confirmed exfiltration. The blog says more than 628,000 Ukrainian individuals have confirmed data in the actor’s possession. It says the most severe of the four organizations was a district-heating provider in Kharkiv, with 564,073 subscriber records and 213,340 access-log entries. The report landing page phrases the larger figure as “more than 628,000 Ukrainian records.” THN’s headline and body say records tied to Ukrainian individuals. “Individuals” on the blog and “records” on the landing page are both SOCRadar’s words.

SOCRadar names CVE-2026-63030, CVE-2026-60137, CVE-2026-4815, and CVE-2015-1397 among flaws it says the tooling targeted. THN names the first three.

On geography, SOCRadar’s post lists Ukraine, Poland, China, and Pakistan among target countries. THN writes that other confirmed compromises occurred in Poland, China, and the Netherlands. The Netherlands is not in the SOCRadar passages this account relies on.

A separate Anthropic note

On 10 September 2026 Anthropic’s threat-intelligence index dates its report Detecting and countering misuse of AI. That report describes cyber operations in which Anthropic says actors used Claude, under the heading “From assistant to orchestrator.” SOCRadar does not present CyberXero as a case from that report.

The pages above are a vendor research post and a news relay of it. They are not a dataset a reader can recompute, and the refusals are SOCRadar’s reading of logs it says it recovered.