One Operator, 51 Agents: What CyberXero’s Leaked Logs Teach Utilities

Alright, mi gente. This week’s story starts with a criminal leaving the front door open.

Not your front door. His.

SOCRadar found an exposed open directory serving the live Linux working folder of an actor called CyberXero. More than 90,000 files. Engagement folders, toolkits, recon output, AI agent configs, session logs, victim database exports. From that one mistake they mapped eight nodes of his infrastructure across Europe and Tencent Cloud.

And as of SOCRadar’s October 6 publication, he was still active.

Who we’re talking about

CyberXero is a Russian-speaking, financially motivated initial access broker. An IAB. He breaks in and sells the door. He doesn’t need to understand your plant. Somebody else buys the access and decides what to do with it.

SOCRadar does not tie him to a nation-state. So I won’t either. Infrastructure first showed up in July 2026. Named targets: Ukraine, Poland, China, Pakistan. Sectors: energy and utilities, e-commerce, telecom, government.

Two pipelines, one workstation

Mira, this is the part that matters.

He ran two operations off the same box.

The first is opportunistic and global. Mass WordPress and e-commerce compromise, payment data, access volume for sale. His in-house tool, which SOCRadar calls wp2shell, chains WordPress core bugs to create a rogue admin and drop a webshell disguised as a plugin. In one automated run it scanned 4,708 targets, confirmed 429 reachable admin panels, and deployed 32 shells in 61 seconds. Sixty-one seconds, familia.

The second is directed, curated, and Ukraine-focused. Seven Ukrainian energy and utilities entities under deep recon, including the country’s national transmission system operator and its largest private energy holding. One target list alone held 95 subdomains for those two: email, VPN, network dispatch systems, data platforms.

The worst case was a password, not a zero-day

Four Ukrainian organizations had file-confirmed exfiltration.

The ugliest one was a district heating provider in Kharkiv. A hardcoded credential sitting in the actor’s own script gave him direct access. His extractor pulled 564,073 subscriber records, with names, home addresses, and account numbers, plus 213,340 access-log entries. Across the four orgs, more than 628,000 Ukrainians now have data in his hands.

In a frontline city, a list of who lives where is not just a privacy problem. SOCRadar flags the physical risk to civilians. I agree.

Now, claro, let’s be precise. That was a data breach. Nobody reported a grid attack, a blackout, or anyone touching heating plant setpoints. The recon against the transmission operator was IT-facing. And SOCRadar’s best guess is that he was brokering access to a buyer interested in Ukrainian critical infrastructure, but they found no evidence a sale actually happened.

Serious enough without inventing a Stuxnet.

The AI layer

Here’s where the headlines come from.

On his main workstation sat a swarm of 51 specialized Claude Code agents. Job descriptions, basically. Recon, subdomain mapping, credential testing, exploit chaining, exfiltration, C2. One of them is literally named scada-attacker.

Read that name as intent. Someone is organizing for industrial targets. It is not proof that agent ever hit a control system, and SOCRadar doesn’t claim it did.

On the team server, a second layer: PentAGI, an open-source AI pentesting framework, wired into Cobalt Strike through an AI provider API for payload generation. His config even assigned models and token budgets by role. That’s deliberate spend, not someone playing with a chatbot.

The session logs tell an honest story about guardrails. Sometimes the model refused and the refusal held. It declined to install a backdoor, disable a firewall, move laterally, or deploy a webshell, and it rejected a forged ownership token. Other times he got around it with a rehearsed “this is my own infrastructure, authorized pentest” story, or by opening a fresh session when one said no.

So model safety is not useless. It’s also not a control you get to outsource your defense to.

And those session logs? They worked like a keylogger for his whole operation. Every target, every task, every refusal. If your team runs coding or ops agents with real access, treat those logs like a credential vault.

Fast and loud, for now

Sixty-one seconds for 32 shells is loud. Cisco Talos made the same point this week in their agentic IR guidance: a lot of public “AI attacks” so far look more like noisy pentests than quiet red teams. Bursts of SQL injection, non-browser clients, WAF alerts piling up in seconds instead of hours.

That noise is a gift today. Don’t count on it next year.

Bottom line

AI didn’t invent a new OT exploit here. It compressed what used to take a small team into one guy and a workstation, and pointed it at the boring stuff utilities still leave lying around. A few things to take home:

Your public WordPress is on the critical path. Patch to the July 2026 fixed releases and look for rogue admins named wp2_ plus eight hex characters, or plugin folders starting with wp2shell_.
Hardcoded passwords still beat fancy AI. Hunt them in scripts, portals, and billing or customer systems, and rotate what you find.
IT access is an OT problem when it’s for sale. Make sure a web or CRM breach can’t reach engineering workstations, VPN concentrators, or historians.

Raise the cost of every step. Fundamentals still win.

Stay sharp out there, familia.

Javier