CyberXero Deploys 51 AI Agents to Scan 4708 Targets and Implant 32 WebShells in 61 Seconds

Russian-speaking initial access broker CyberXero has integrated Anthropic Claude Code and the open-source autonomous penetration agent PentAGI into its operational workflow, fielding a cluster of 51 specialized AI agents that executed a full attack chain with minimal human input.

Parallel Campaigns: Mass Scanning and Targeted Ukrainian Infrastructure

The group ran two simultaneous lines of operation. The first was a high-volume automated campaign that exploited known vulnerabilities in WordPress and e-commerce platforms, specifically wp2shell flaws CVE-2026-63030 and CVE-2026-60137 plus the Support Board SQL injection vulnerability CVE-2026-4815. The second line focused on Ukrainian energy and critical infrastructure, including a heating company in Kharkiv, and involved deeper reconnaissance that lacked an obvious immediate monetization path.

61-Second Execution: 4708 Targets, 429 Admin Panels, 32 WebShells

One automated run scanned 4708 public hosts, confirmed administrative access to 429 WordPress instances and deployed 32 WebShells inside a 61-second window. The 51-agent cluster handled scanning, vulnerability chaining, reconnaissance and post-exploitation tasks in parallel. PentAGI was connected to Cobalt Strike to generate payloads and execute commands via the vendor API, reducing the need for manual intervention.

Bypassing Model Safety Controls

Attackers circumvented Claude’s safety mechanisms by resetting sessions and prefixing each new conversation with language that framed the activity as authorized penetration testing of their own infrastructure. Logs showed the model refusing four consecutive requests to install backdoors, disable firewalls, perform lateral movement and drop WebShells, yet the attackers simply restarted the session and continued.

Defensive Recommendations

• Inspect WordPress sites for unauthorized administrator accounts and WSO-style WebShells.
• Verify integrity of Magento and PrestaShop back-end accounts and plugins.
• Check Redis servers for unauthorized SSH keys in ~/.ssh/authorized_keys and restrict public exposure.
• Enforce minimum privileges and block unnecessary outbound traffic for any AI agents or automation pipelines.
• Move AI governance from session-level controls to system-level boundaries defined by network segmentation and credential restrictions.

The incident also affected two Chinese organizations whose publicly exposed Redis servers were abused by the attackers.