Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
8 IOCs
CyberXero: An AI-Augmented Initial Access Broker Targeting Ukrainian Critical Infrastructure
Threat Actors
Malware Families
Excerpt
CyberXero: An AI-Augmented Initial Access Broker Targeting Ukrainian Critical Infrastructure SOCRadar’s Threat Research Unit (STRU) has documented CyberXero , a Russian-speaking, financially motivated Initial Access Broker that pairs commodity offensive tooling with an AI orchestration layer running on its own infrastructure. The operation runs two pipelines at once: a global, automated campaign against WordPress and e-commerce platforms, and a curated, manual campaign…
Read the original report →Diamond Model
Adversary(1)
Infrastructure
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →8 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| CVE | CVE-2026-4815 | Medium | Score 51/100 | First seen |
| SHA256 | a5ae0aab352871bc0b038b3aa43b03eb223425628c884af7b9fc592cd34eb86c | Medium | Score 53/100 | First seen |
| CVE | CVE-2015-1397 | Medium | Score 51/100 | First seen |
| SHA256 | 71e21094c1ac1cf0275c91ed377965e248bca1c12711f6dd20e2682681fc1192 | Medium | Score 53/100 | First seen |
| SHA256 | 59c535f47ab4d35f6d9fc8b8aec4a72438ea0b89e5a4dcea74b05d2d32cfa483 | Medium | Score 53/100 | First seen |
| CVE | CVE-2026-63030 | High | Score 78/100 | First seen |
| SHA256 | 92a789444708fa1cb4cc5a89e0aa6cc7a279b62a7b8a4d2857255a18197d0090 | Medium | Score 53/100 | First seen |
| CVE | CVE-2026-60137 | High | Score 74/100 | First seen |
IOC Relationship Graph
Building graph…