News Summary

• Cybersecurity researchers have disclosed details of a two-pronged initial access campaign targeting WordPress sites, e-commerce platforms, and critical infrastructure entities in Ukraine.
• The activity, which brings together commodity offensive tools like Cobalt Strike with an AI orchestration layer powered by Anthropic's Claude Code, has been attributed to a Russian-speaking initial access broker codenamed CyberXero.
• The campaign is estimated to have resulted in confirmed exfiltration from four Ukrainian organizations, leading to the harvesting of more than 628,000 records tied to Ukrainian individuals.