CyberXero, a Russian-speaking initial access broker, has combined widespread web exploitation with targeted reconnaissance against Ukrainian energy and critical infrastructure organisations. Active since at least July 2026, the threat actor has affected or compromised more than 40 organisations, raising concerns about the growing use of AI-assisted tools in cyber operations.The campaign exploited vulnerable WordPress and e-commerce systems globally while targeting VPN services and other critical network infrastructure in Ukraine. Confirmed data theft from four Ukrainian organisations exposed more than 628,000 records. CyberXero also used Claude Code, PentAGI and Cobalt Strike, deploying up to 51 specialised AI agents to support its operations.This week’s Orpheus Weekly Intelligence Summary examines the implications of AI-augmented cyber threats and the defensive measures organisations should prioritise. The report also covers significant data breaches, third-party infrastructure compromises and emerging threats to critical infrastructure. Download the full report for the latest intelligence and recommended defensive priorities.
CyberXero Targets Ukrainian Critical Infrastructure with AI-Augmented Tooling
