Did Hackers Use Claude Code to Steal 628,000 Ukrainian Records?

October 16, 2026

SOCRadar says CyberXero paired Claude Code with offensive tooling and stole 628,000+ Ukrainian records. Here is what the evidence proves—and what it doesn't.

Short answer: According to SOCRadar, a criminal operator used Claude Code as part of an AI-assisted attack stack and possessed files tied to more than 628,000 Ukrainian people. But the evidence does not show that Claude Code independently chose the victims, executed every intrusion, or personally “stole 628,000 records.” It also was not a breach of Anthropic.

The defensible finding is narrower and still serious: SOCRadar says an exposed attacker server revealed 51 specialized Claude Code agent definitions, AI session logs, exploitation tools, plaintext tokens, victim data, and a separate PentAGI-to-Cobalt Strike integration. The same investigation attributed confirmed data exfiltration from four Ukrainian organizations to the operator it calls CyberXero.

Research cutoff: October 16, 2026. This article distinguishes SOCRadar's attributed findings from independently verified facts. It is not incident-response, legal, or national-security advice.

The Finding in One Minute

SOCRadar's Threat Research Unit says it discovered an internet-exposed directory belonging to a Russian-speaking, financially motivated initial access broker it tracks as CyberXero. An initial access broker compromises systems and may sell that access to other criminals.

The exposed directory allegedly contained more than 90,000 files across roughly 3,000 subdirectories. SOCRadar says the material included target folders, reconnaissance results, exploitation scripts, Claude Code configurations and session logs, plaintext credentials, and exports of victim data.

From those artifacts, the researchers describe two parallel operations:

A high-volume campaign against WordPress and e-commerce systems around the world.
A more selective campaign focused on Ukrainian energy, utilities, and other organizations.

The most attention-grabbing details are easy to merge into one dramatic sentence, but they are different evidence categories:

51 was the reported number of specialized Claude Code agent definitions on the primary workstation.
4,708 targets, 429 accessible WordPress panels, and 32 deployed shells in 61 seconds came from one automated run described by SOCRadar.
More than 628,000 Ukrainian individuals were represented in data that SOCRadar says the actor possessed.
Four Ukrainian organizations had file-confirmed exfiltration in the recovered material.
Seven energy and utility entities were reportedly under curated reconnaissance; SOCRadar did not say all seven were compromised.

Those numbers do not establish that 51 agents were all running simultaneously, that Claude Code performed every action, or that all 628,000 records came from critical-infrastructure targets. They describe evidence found within one investigated attacker environment.

What Is Confirmed

SOCRadar published a detailed primary investigation

On October 6, SOCRadar published its CyberXero investigation. The public report names infrastructure, explains how researchers pivoted between nodes, describes the recovered file structure, and lists detection clues.

The report is a primary threat-intelligence source: its researchers say they inspected the exposed artifacts. That is stronger than a rumor or a screenshot circulating without provenance.

It is not the same as independent confirmation by the affected organizations, Anthropic, law enforcement, or a second incident-response team. Readers should keep the attribution in every retelling: SOCRadar reports these findings.

The exposed environment contained Claude Code artifacts

SOCRadar says the primary workstation included a directory defining 51 specialized Claude Code agents. The names were reportedly organized around functions such as reconnaissance, credential testing, exploitation, lateral movement, command-and-control operation, industrial-system targeting, and data exfiltration.

The researchers also report recovering AI session logs. According to their account, some model sessions refused requests, while the operator tried reframing work as authorized testing or started fresh sessions to get past the refusal.

That evidence supports the conclusion that Claude Code was present in the workflow and that the operator tried to use it for offensive tasks. It does not tell us that every agent definition ran, how often it ran, what commands succeeded, or how much of the final outcome came from the model rather than scripts and manual work.

A second AI layer was connected to offensive infrastructure

The investigation describes a separate PentAGI deployment connected to a Cobalt Strike Team Server through an AI-provider API. PentAGI is an AI-augmented penetration-testing framework; Cobalt Strike is a legitimate adversary-simulation product that criminals also abuse.

This distinction matters. “The attacker had 51 Claude Code agents” and “PentAGI was wired to Cobalt Strike” are two reported parts of the architecture, not proof that Claude Code itself controlled the Cobalt Strike server.

The broader lesson is architectural: an attacker can combine a general coding agent, purpose-built automation, ordinary scripts, credential stores, messaging bots, and established offensive tools. The model is one layer in a system.

The attacker appears to have operated at machine speed

SOCRadar reports a target list exceeding 56,000 URLs. In one run, automation allegedly scanned 4,708 targets, confirmed access to 429 WordPress administration panels, and installed 32 shells in 61 seconds. Successful events produced Telegram notifications for the operator.

Those numbers are not a lifetime total. They are a snapshot of one recorded execution. Even with that limitation, the result shows why defenders care about AI-assisted orchestration: the dangerous change may be the speed and breadth with which one operator can coordinate familiar tools.

AI did not invent vulnerable plugins, stolen passwords, SQL injection, web shells, or exposed Redis services. It may have helped the operator organize and adapt those methods faster.

SOCRadar found files associated with real victim data

The report says four Ukrainian organizations had file-confirmed exfiltration and that the actor possessed data associated with more than 628,000 Ukrainian individuals.

The largest described dataset came from a district-heating provider in Kharkiv. SOCRadar says a multithreaded extractor retrieved 564,073 subscriber records containing personal data, home addresses, and account numbers, along with 213,340 access-log entries containing timestamps and IP addresses.

Because Kharkiv is on an active conflict front, the combination of identity, address, and utility data may carry physical as well as privacy risk. That is SOCRadar's risk assessment; the public materials do not provide a complete independent audit of every row or its provenance.

What Is Still Unclear

Whether Claude Code performed the actual exfiltration

The headline question compresses several steps: target selection, reconnaissance, initial access, exploitation, persistence, database extraction, staging, and exfiltration. The public evidence does not allocate each step between Claude Code, PentAGI, Cobalt Strike, custom scripts, and the human operator.

A directory named for a data-exfiltration agent shows intent and configuration. A session log may show a request or response. Neither alone proves that a particular agent executed the command that copied a particular database.

The accurate conclusion is that SOCRadar found Claude Code integrated into the attacker's operational environment. Saying “Claude Code stole 628,000 records” as a settled forensic fact goes beyond the evidence currently available.

Whether all 51 agents were active

SOCRadar describes 51 specialized agents “defined” in a dedicated directory. Configuration files can be templates, experiments, abandoned roles, or active components. The public article does not provide a per-agent execution ledger or success rate.

The number still matters because it reveals how the operator structured the work. It should not be confused with 51 independent models acting concurrently like a fully autonomous cyber team.

How autonomous the operation really was

The recovered environment reportedly used automation at scale, but the directed Ukrainian campaign also involved curated reconnaissance and manual exploitation. SOCRadar describes an operator watching Telegram alerts, changing prompts after refusals, maintaining infrastructure, and combining multiple tools.

That is not a hands-off system pursuing a self-chosen mission. It is evidence of a human-directed criminal operation with substantial automation.

The full origin and count of every record

SOCRadar reports more than 628,000 records tied to Ukrainian individuals and names four organizations with file-confirmed exfiltration. Public summaries do not provide a record-by-record provenance audit, confirm whether every row represents a unique person, or show that every affected organization independently validated the count.

The 628,000 figure should therefore remain attributed to SOCRadar. It should not be rounded into “628,000 verified victims of Claude Code.”

Whether the campaign is still active

SOCRadar says CyberXero remained active during the investigation and at publication on October 6. That is a time-bounded observation. It does not prove the same infrastructure, credentials, or toolchain remains active on October 16.

Defenders should use current indicators and their own telemetry rather than assume that a public snapshot is a live map of the operation.

This Was Not an Anthropic Breach

Nothing in the public report says CyberXero compromised Anthropic, accessed other Claude customers' data, or exploited a vulnerability in Anthropic's servers.

The alleged actor used Claude Code within its own infrastructure. That is a misuse question, not a provider-breach finding.

This distinction matters for both accuracy and defense. If an organization's WordPress instance was compromised through an exposed or vulnerable application, changing an Anthropic password would not repair the site. The immediate controls remain familiar: patching, account review, credential rotation, log analysis, web-shell hunting, network containment, and incident response.

It also matters because coding agents are not ordinary chat windows. Claude Code can read a codebase, write files, and run commands subject to its configured permission model. Anthropic's Claude Code sandboxing guidance emphasizes both filesystem and network isolation. Anthropic says the combination is important because filesystem access without network control can permit exfiltration, while network access without filesystem control can expose local secrets.

An operator who owns the machine can intentionally grant broad permissions. A product's default prompts are not a security boundary against a malicious owner who controls the environment, credentials, and connected tools.

What The Evidence Says About AI Safety Refusals

The reported session logs are useful because they complicate two simplistic stories.

The first simplistic story is that safety controls did nothing. SOCRadar says models refused some requests. That means the system recognized at least some harmful intent.

The second is that refusal behavior stopped the operation. The operator reportedly changed framing and reset sessions. Meanwhile, conventional scripts and offensive tooling remained available.

Model refusal is one layer. It should not be treated as the only barrier between an agent and a high-impact action. Stronger control points include:

scoping the directories an agent can read and write;
restricting outbound network destinations;
withholding long-lived secrets from the working environment;
separating generation from execution;
requiring human approval for privileged or irreversible actions;
logging tool calls and preserving tamper-resistant audit evidence;
limiting what one agent identity can reach;
detecting abnormal scanning, shell deployment, and data transfer independently of the model.

Those controls remain useful even if a prompt is rewritten, a session is restarted, or a different model is substituted.

Why One Operator Plus Agents Changes The Threat Model

Cybercrime has always used automation. Vulnerability scanners, botnets, credential stuffers, exploit frameworks, and command-and-control systems predate generative AI.

The change suggested by the CyberXero report is adaptive orchestration. A language model can help connect the gaps between tools: interpret an error, rewrite a command, summarize reconnaissance, generate a parser, decide which result deserves attention, and preserve task-specific context across many targets.

That can shift the economics in three ways.

More parallel work

Specialized agent definitions let one operator divide a campaign into roles without hiring a 51-person team. Even if only a subset runs, the structure supports parallel reconnaissance, testing, exploitation, and analysis.

Faster recovery from failure

Traditional automation stops when an unexpected response breaks a script. A coding agent may diagnose the error and produce a modified command. It does not have to be brilliant to reduce the number of cases that require direct human attention.

Reusable operational memory

Prompts, scripts, logs, and target folders can preserve solutions from one engagement for the next. That turns individual successes into reusable playbooks.

None of this makes the AI omnipotent. The operation still depends on exposed systems, usable credentials, unpatched flaws, accessible command-and-control infrastructure, and an operator who keeps it running. Those dependencies create defensive opportunities.

What Defenders Can Do Now

Treat the published username pattern as a lead, not a verdict

SOCRadar associates the campaign's WordPress activity with administrator names that begin with wp2_ followed by eight hexadecimal characters. A matching name can justify investigation, but it is not proof on its own.

Review unexpected administrator accounts alongside authentication logs, plugin and theme changes, unfamiliar scheduled tasks, altered core files, outbound connections, and possible web shells. Preserve evidence before deleting artifacts if compromise is plausible.

Reduce the ordinary exposure the automation depends on

Inventory public WordPress, Magento, remote-administration, Redis, VPN, and other internet-facing services. Patch known flaws, remove abandoned plugins, close services that do not need public access, and put administrative interfaces behind stronger access controls.

Machine-speed scanning makes long remediation windows more expensive. The defensive answer is not an “anti-AI” checkbox; it is shortening exposure and detecting exploitation quickly.

Rotate credentials found in exposed workspaces

SOCRadar says the attacker's own operational mistake exposed plaintext tokens. Legitimate teams make the same mistake when .env files, shell histories, debug bundles, agent transcripts, or build artifacts become public.

If a secret may have been exposed, revoke or rotate it. Do not rely on deleting the file from the current page or repository history. Check downstream systems for use of the old credential and narrow the replacement's scope.

Put execution behind enforceable boundaries

For coding agents used legitimately, separate the model's suggestions from powerful execution paths. Use sandboxed workspaces, restricted network egress, short-lived scoped credentials, and approvals for deployment, security changes, data export, or access to production.

Avoid running agents with unrestricted access to SSH keys, browser profiles, cloud credentials, password stores, or unrelated directories. Test the boundary, not just the prompt.

Monitor outcomes, not just model traffic

Blocking one AI-provider domain will not stop custom scripts, other models, or ordinary offensive frameworks. Watch for the behaviors that matter: bursts of authentication attempts, new privileged users, unexpected shells, unusual archive creation, database exports, suspicious outbound transfers, and command-and-control patterns.

AI can change an attacker's speed and workflow. It does not erase the underlying signals.

Where OpenVeil Fits—and Where It Does Not

The CyberXero report is also a reminder that “using AI” describes very different products and authority levels.

OpenVeil is a hosted conversational workspace for adults who want to think, draft, compare, and ask questions without giving the chat model a repository, shell, Cobalt Strike server, or autonomous penetration-testing loop. Normal chat history is stored in the user's browser rather than as a normal server-side chat-history record, and documented user inputs and outputs are not used to train foundation models.

That narrower architecture can be a better fit when the task is sensitive analysis rather than code execution. It reduces the durable account-history footprint associated with ordinary use and avoids turning a conversation into an agent with infrastructure authority.

The boundaries are equally important:

OpenVeil is not fully offline.
Active requests are processed by OpenVeil and the selected model provider.
It is not anonymous, a coding-agent sandbox, endpoint protection, malware detection, a WordPress patch, or an incident-response service.
It cannot prevent criminals from misusing unrelated AI products.
Browser-local history is not a guarantee against a compromised browser, device, extension, or operating system.

The practical choice is to match authority to the job. If you need a private-feeling place to reason through a sensitive question, do not automatically give the model shell, repository, credential, and network access too.

Frequently Asked Questions

Did Claude Code steal 628,000 Ukrainian records?

SOCRadar says CyberXero possessed data associated with more than 628,000 Ukrainian individuals and operated Claude Code agent configurations as part of its attack environment. The public evidence does not prove that Claude Code itself executed every intrusion or copied every record. Keep the conclusion attributed and narrow.

Were 51 Claude agents attacking at the same time?

Not established. SOCRadar says it found 51 specialized agent definitions. The public report does not provide a concurrency log showing all 51 actively running at once.

Was Anthropic hacked?

No Anthropic breach is reported here. The alleged criminal used Claude Code on attacker-controlled infrastructure.

Did Claude's safety controls fail?

SOCRadar says some sessions refused harmful requests and the operator tried reframing prompts or restarting sessions. That suggests refusals had some effect but were not a complete control over an owner-controlled environment with other tools available.

Were seven Ukrainian energy companies breached?

SOCRadar reports curated reconnaissance against seven energy and utility entities. It separately reports file-confirmed exfiltration from four Ukrainian organizations. Those counts should not be combined into eleven confirmed victims or treated as seven confirmed energy-sector breaches.

Is the 628,000 figure independently verified?

Not in the public sources reviewed for this article. It is SOCRadar's reported count based on recovered files. Public coverage has repeated the figure, but repetition is not an independent forensic audit.

Is this proof that AI agents are better hackers than humans?

No. The report suggests that one operator used agents and automation to coordinate familiar offensive techniques at high speed. It does not provide a controlled comparison against a human team or show that the models independently discovered every successful technique.

Would using OpenVeil stop this kind of campaign?

No. OpenVeil is not a cyber-defense product and cannot stop attacks conducted with other systems. Its relevance is narrower: it offers a hosted conversational workspace without the repository, shell, and offensive-tool authority described in this report.

Bottom Line

SOCRadar's CyberXero report is credible evidence that a criminal operator integrated Claude Code into a broader offensive stack and possessed a large collection of stolen Ukrainian data. It is not proof that an autonomous Claude swarm independently hacked four organizations or that Anthropic was breached.

The important shift is not a magical new exploit. It is the possibility that one operator can use agent roles, reusable context, and adaptive code generation to coordinate ordinary attack tools faster and across more targets.

Defenders should answer at the architecture layer: patch exposed systems, restrict agent permissions, isolate files and networks, keep secrets out of workspaces, require approvals for powerful actions, and monitor the real-world outcomes that matter.

Sources

When privacy, account control, uploads, and search matter, OpenVeil gives you a private AI workspace designed for that job.