Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
1 IOC
CyberXero Uses 51 AI Agents to Target Ukrainian Critical Infrastructure and Mass-Exploit WordPress
Malware Families
Excerpt
CyberXero, a Russian-speaking initial access broker, has combined common hacking tools with an AI orchestration system to target Ukrainian critical infrastructure and websites worldwide. SOCRadar’s Threat Research Unit disclosed the operation on October 6, 2026, describing two parallel campaigns supported by infrastructure controlled by the attacker. One campaign automates attacks against WordPress and ecommerce platforms globally. The other involves carefully selected,…
Read the original report →Diamond Model
Adversary
Infrastructure(1)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →1 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| IP | 46.21.250.135 | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…