What sets this campaign apart is its use of an AI orchestration layer built on Anthropic's Claude Code, combined with commodity offensive tooling such as Cobalt Strike. Rather than relying solely on conventional tradecraft, the attackers appear to have used the AI component to coordinate and scale their initial access efforts across multiple victim types.

Key points from the disclosure:

• The campaign is described as two-pronged, meaning it pursued more than one infection or intrusion path.
• Targeted sectors include WordPress installations, e-commerce platforms, and critical infrastructure organizations in Ukraine.
• The toolset blends widely available offensive tools (Cobalt Strike) with an AI orchestration layer powered by Claude Code.
• More than 628,000 Ukrainian records were stolen over the course of the activity.

The researchers have attributed the campaign to CyberXero. As with any initial access operation of this kind, organizations in the affected sectors should review their exposure, particularly internet-facing WordPress and e-commerce systems, and monitor for signs of Cobalt Strike activity in their environments.

Source: The Hacker News
Has your organization reviewed its WordPress and e-commerce attack surface in light of this campaign?