CyberXero Blends AI Automation With Targeted Attacks on Ukraine

A Russian-speaking initial access broker known as CyberXero combined broad AI-assisted exploitation with a more selective campaign against Ukrainian energy and critical infrastructure, according to SOCRadar.

The operation ran two pipelines. One automated attacks against WordPress and e-commerce targets at global scale. The other used manual selection against Ukrainian organizations. SOCRadar said the actor possessed confirmed data tied to more than 628,000 Ukrainian individuals, including residents of Kharkiv.

Researchers discovered the operation through a single configuration error that exposed details of the attack infrastructure. The case illustrates how AI can augment an access broker without replacing conventional tools or operator judgment. Automation handles volume, while humans reserve attention for higher-value targets.

Critical-infrastructure defenders should expect this blended model to spread. Reducing internet exposure, rapidly patching known flaws and monitoring identity changes remain central, but detection programs also need to recognize unusually fast, coordinated activity across many systems.