SOCRadar: CyberXero, an AI-Augmented Initial Access Broker

Evidence record

Read the original source ↗

Claim-level citations (4)

• supportsCyberXero used AI agent infrastructure in reported Ukrainian intrusions: SOCRadar reports exposed attacker infrastructure containing up to 51 defined Claude Code agents, PentAGI configuration and Cobalt Strike-linked orchestration.

  Key Takeaways and "The AI Augmentation Layer" sections.

• supportsCyberXero used AI agent infrastructure in reported Ukrainian intrusions: SOCRadar reported evidence of four Ukrainian organizations with exfiltrated files and over 628,000 individuals in relevant datasets, but did not establish that all successful intrusions were autonomous.

  Key Takeaways, "Two Pipelines, One Operator" and victimology.

• supportsCyberXero used AI agent infrastructure in reported Ukrainian intrusions: SOCRadar separates file-confirmed exfiltration at four Ukrainian organizations from curated reconnaissance of seven more energy-sector entities without confirmed compromise. Those categories must not be combined into one victim total.

  Victimology, opening paragraph.

• supportsCyberXero used AI agent infrastructure in reported Ukrainian intrusions: SOCRadar describes the same purported authorization narrative across four unrelated victims and two tools in recovered session material. Its interpretation is repeated safety-evasion framing, not proof that the claimed authorization existed.

  The AI Augmentation Layer, paragraph on the fictional authorization protocol.