An Attacker’s Open Folder Exposed an AI-Driven Break-In Operation Hitting WordPress Sites
An exposed server folder gave researchers a live look at CyberXero, a group using a swarm of AI agents to break into WordPress and e-commerce sites at scale. The bugs it uses are already known, which is the real lesson.
Attackers rarely let defenders watch them work, but one recently left the door open. A misconfigured server exposed the live working folder of a break-in operation researchers call CyberXero. Inside were AI session logs, scripts with plaintext tokens, exploit kits, reconnaissance results, configuration files for AI agents, and data taken from victims.
Threat intelligence firm SOCRadar published its findings last week, and The Hacker News summarized the research on Monday. The account below draws on that report.
Who is behind it
SOCRadar describes CyberXero as a Russian-speaking, financially motivated initial access broker, meaning a criminal who breaks into systems and sells or monetizes that access. The group has been active since at least July 2026, and the campaign is still running.
Two operations at once
The first track is wide and automated. It sweeps the internet for WordPress and online-store platforms, hunting for access and payment data. It relies on known flaws: two tracked as wp2shell (CVE-2026-63030 and CVE-2026-60137) and an SQL injection bug in the Support Board WordPress plugin (CVE-2026-4815). The operation has also exploited Redis database servers left exposed online, which led to breaches at two Chinese organizations.
The second track is narrow and hands-on. It targets energy and utility organizations in Ukraine, including a heating provider in Kharkiv, with deep reconnaissance and manual exploitation. SOCRadar sees no obvious direct money motive for that work. Overall, SOCRadar reports confirmed data theft from four Ukrainian organizations, yielding more than 628,000 records tied to Ukrainian individuals, along with other confirmed compromises in Poland, China and the Netherlands.
The speed problem
One figure in the logs says it all. A single automated run scanned 4,708 targets, confirmed access to 429 WordPress administration panels, and then planted 32 web shells in just 61 seconds. The setup is built from eight distinct nodes, including the operator’s Linux workstation, a provisioning server, payload staging servers, monetization infrastructure and a dedicated scanner.
AI sat at two points in the chain. On the workstation, Anthropic’s Claude Code coordinated a cluster of 51 specialized agents handling scanning, chaining exploits together, reconnaissance and post-exploitation. Separately, an open-source autonomous penetration-testing agent called PentAGI was wired into a Cobalt Strike server through an AI provider’s API to generate payloads and run attack tasks.
Arguing with the guardrails
The logs also show the operator working around the AI’s refusals. When a session refused a task, the operator opened a new one already primed with a claim that this was an authorized test of their own infrastructure. SOCRadar notes that safety controls work on the context of a session, so a refusal doesn’t carry over into the next one. Some refusals did hold: across four attempts, the model declined to install a backdoor, switch off a firewall, move laterally or deploy a web shell. In another episode it refused a scan four times in a row and rejected a forged proof-of-ownership token.
What researchers recommend checking
Organizations running WordPress, Magento or PrestaShop, or with Redis reachable from the internet, should look for administrator accounts they don’t recognize, WSO web shells, and unexpected entries in the ~/.ssh/authorized_keys file on Redis hosts.
What this means for your company
Nothing CyberXero exploited was a mystery. These were published flaws with available fixes, plus databases left open to the internet. What AI changes is how quickly a lone operator can find and use them. A site that sits unpatched for a few weeks is now competing against tooling that can test thousands of targets in minutes. For small and mid-size businesses, that makes the basics urgent:
- Patch web platforms and plugins within days of a fix, not at the next redesign.
- Never expose databases such as Redis directly to the internet.
- Review website administrator accounts monthly and require multi-factor authentication for every one.
- Monitor for new files and new admin accounts on your web servers, so a planted web shell is spotted in hours, not months.
Need help closing the known gaps on your websites and servers before automated attack tools find them? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
