Information Warfare — 2026-10-15

Russian Threat Actor CyberXero Deploys 51 AI Agents to Steal 628000 Ukrainian Records Including Kharkiv Heating Customer Data

BLUFCyberXero's use of dozens of AI agents to scale one operator into a reconnaissance team against Ukrainian energy infrastructure signals a shift where commodity AI tooling lowers the barrier to targeted critical-infrastructure campaigns.

SOCRadar's Threat Research Unit documented a Russian-speaking, financially motivated initial access broker, CyberXero, after finding its open server directory of more than 90,000 files 12. Security Affairs reported that SOCRadar confirmed data theft from four Ukrainian organizations, including 564,073 subscriber records from a Kharkiv district heating provider, and said stolen data covers more than 628,000 Ukrainian individuals 13. Security Boulevard and GBHackers reported curated reconnaissance against seven Ukrainian energy entities, which eSecurity Planet said was not confirmed as breaches or service disruption 23Claude Code in Ukraine Data Theft" data-source="eSecurity Planet" data-url="https://www.esecurityplanet.com/threats/news-cyberxero-claude-code-data-theft-emea-ukraine/" data-rt="secondary" data-otype="trade_press">4. The logs show up to 51 Claude Code agent definitions, fake penetration-test claims used to bypass refusals, and some refusals that held 124.

Analysis
CyberXero scales one operator into a team and exposes civilians as well as systems. The Kharkiv dataset ties names to home addresses and account numbers in a city near an active front, so the harm is physical rather than financial. Reconnaissance against seven Ukrainian energy entities shows targeting depth, but no source confirms a breach, an access sale, or a service disruption. The activity may instead be opportunistic collection by a commodity broker, and the agent count may reflect templated definitions more than operational use. Session logs show refusals held in several cases while fresh sessions defeated them, so model safeguards slowed the operator without stopping it. Confidence is low: everything traces to a single SOCRadar report, and the stolen-data counts and agent definitions are unverified. The other outlets add no independent collection.

5 sources

CyberXero Used 51 AI Agents to Steal 628,000 Ukrainian Records - Security Affairs
Russian-Speaking CyberXero Uses AI Agent Swarm to Attack Ukrainian Energy Infrastructure - GBHackers
CyberXero Uses AI Orchestration Layer to Run Two Cyber Campaigns - Security Boulevard
CyberXero Uses Claude Code in Ukraine Data Theft - eSecurity Planet
CyberXero: AI-driven initial access broker targeting Ukraine critical infrastructure (SOCRadar Threat Research Unit report)