[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fd5kNXSgMLNm1iF-O3hUTg15m21kTkO3ew1rV01QFyRY":3},{"article":4,"iocs":51,"watch_terms":52,"solutions":53,"lesson":142},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"127b0ef4-21bf-497d-8ce7-9a0972a2ac55","CyberXero Uses Claude Code in Campaign That Stole Over 628,000 Ukrainian Records","cyberxero-uses-claude-code-in-campaign-that-stole-over-628-000-ukrainian-records-7e4ca9","Cybersecurity researchers have disclosed details of a two-pronged artificial intelligence (AI)-augmented initial access campaign targeting WordPress sites, e-commerce platforms, and critical infrastructure entities in Ukraine. The activity, which brings together commodity offensive tools like Cobalt Strike with an AI orchestration layer powered by Anthropic's Claude Code, has been attributed","Cybersecurity researchers have uncovered a sophisticated, AI-augmented campaign dubbed CyberXero, which has successfully stolen over 628,000 Ukrainian records. This operation leverages commodity offensive tools like Cobalt Strike alongside an AI orchestration layer powered by Anthropic's Claude Code to target WordPress sites, e-commerce platforms, and critical infrastructure within Ukraine.","CyberXero campaign uses Claude Code to steal over 628,000 Ukrainian records.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fcyberxero-uses-claude-code-in-campaign.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEgCjQWPc2H2EsKbjYztfxdp2ffZz6TGQNJ9BuALJB44sWqXbCxEa61fu5CZ4w1rS0llVr3hQP4H_Vg5Fj87Jrs5IoUDpBmochh3rA5bMMr3V4hUT22HTPgLUeX9WhGIQuFm4zF-Kf3zIzSNsQGQlP_gkSSSV-hu5rp5CHX_1T83TOeWsYia_xbuHLlwAxDv\u002Fs1600\u002Fclaude-hacker.jpg","2026-10-12T07:26:12+00:00","2026-10-12T08:00:19.371186+00:00",8,[17,20,23,26],{"name":18,"type":19},"CyberXero","threat_actor",{"name":21,"type":22},"Claude Code","product",{"name":24,"type":25},"Anthropic","vendor",{"name":27,"type":22},"Cobalt Strike","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":28,"icon":30,"name":31,"slug":32},null,"Nation-state","nation-state",[34,36,41,46],{"category":35},{"id":28,"icon":30,"name":31,"slug":32},{"category":37},{"id":38,"icon":30,"name":39,"slug":40},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":42},{"id":43,"icon":30,"name":44,"slug":45},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":47},{"id":48,"icon":30,"name":49,"slug":50},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[24,21,27],{"controls":54,"vendors":141},[55,84,113],{"slug":56,"name":57,"problem":58,"products":59},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[60,68,76],{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":85,"name":86,"problem":87,"products":88},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[89,97,105],{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"slug":50,"name":114,"problem":115,"products":116},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[117,125,133],{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",[],{"slug":143,"title":144,"body":145,"framework_refs":146,"framework_notes":161},"ai-augmented-cyberxero-campaign-exfiltrates-628000-ukrainian-records","AI-Augmented CyberXero Campaign Exfiltrates 628,000+ Ukrainian Records","The CyberXero campaign demonstrates how threat actors are weaponizing AI orchestration tools like Claude Code to dramatically accelerate and scale attacks against poorly secured web platforms, including WordPress sites and e-commerce infrastructure. By combining commodity tools such as Cobalt Strike with AI-driven automation, attackers can identify and exploit misconfigurations and unpatched vulnerabilities at machine speed, reducing the window defenders have to respond. The scale of 628,000 stolen records underscores the catastrophic impact of inadequate vulnerability management and weak configuration hardening on public-facing systems. This matters because AI augmentation lowers the skill barrier for sophisticated campaigns, meaning even moderately resourced threat actors can now execute operations that previously required nation-state-level expertise.",[147,148,149,150,151,152,153,154,155,156,157,158,159,160],"CIS Control 7 – Continuous Vulnerability Management","CIS Control 12 – Network Infrastructure Management","CIS Control 13 – Network Monitoring and Defense","CIS Control 3 – Data Protection","NIST SP 800-53 SI-2 (Flaw Remediation)","NIST SP 800-53 CM-6 (Configuration Settings)","NIST SP 800-53 AU-12 (Audit Record Generation)","NIST SP 800-53 SC-7 (Boundary Protection)","NIST CSF DE.CM-1 (Network Monitoring)","GDPR Article 32 – Security of Processing","GDPR Article 33 – Notification of Personal Data Breach","OWASP Top 10 A05:2021 – Security Misconfiguration","OWASP Top 10 A06:2021 – Vulnerable and Outdated Components","ITIL 4 – Vulnerability Management Practice",{}]