A suspected initial access broker behind FortiGate GlobalProtect attacks exposed 70,000+ credentials. See how k0t operates and how to defend.
Related Posts:
Doppelganger Campaign Targets Israel Elections With Fake News and AI Poisoning
Storm-0940 Uses ARTEX AI Agent to Probe IT and Software Vendors for Supply Chain Access
Token Replay Attack Hits 79 Organizations Through Stolen Microsoft 365 Sessions
The post Suspected Access Broker k0t Hits FortiGate and GlobalProtect Devices, Exposing 70,00
CyberXero used 51 AI agents to support cyberattacks, stealing 628,000 Ukrainian records, including sensitive data from energy infrastructure.
CyberXero is an operation that combines traditional hacking tools with AI agents to carry out cyberattacks. According to SOCRadar researchers, the attackers use the same infrastructure for two different campaigns: one targets WordPress websites and e-commerce platforms worldwide, while the other focuses on Ukrainian energy and critical infrastructure.
CyberXero used 51 AI agents to support cyberattacks, stealing 628,000 Ukrainian records, including sensitive data from energy infrastructure.
CyberXero is an operation that combines traditional hacking tools with AI agents to carry out cyberattacks. According to SOCRadar researchers, the attackers use the same infrastructure for two different campaigns: one targets WordPress websites and e-commerce platforms worldwide, while the other focuses on Ukrainian energy and critical infrastructure.
The actor behind CyberXero is a Russian-speaking, financially motivated threat actor. This type of attacker, known as an initial access broker, breaks into networks and sells access to other criminals instead of using it directly. One campaign focuses on attacking as many targets as possible, while the other involves carefully selected targets in Ukraine.
“SOCRadar’s Threat Research Unit (STRU) has documented CyberXero, a Russian-speaking, financially motivated Initial Access Broker that pairs commodity offensive tooling with an AI orchestration layer running on its own infrastructure.” reads the report published by SOCRadar. “The operation runs two pipelines at once: a global, automated campaign against WordPress and e-commerce platforms, and a curated, manual campaign against Ukrainian energy and critical infrastructure. More than 628,000 Ukrainian individuals have confirmed data in the actor’s possession, including residents of Kharkiv, a city on an active war front.”
The investigation only happened because the threat actor made one classic mistake, an open directory with zero access control sitting on a server. That single misconfiguration exposed the actor’s entire working directory, more than 90,000 files, including AI session logs, scripts with plaintext tokens, and already-stolen victim data. The exposed server was found at “46.21.250[.]135,” hosting a live Linux workstation’s complete contents.
Session logs recording every planned target, every refused task, and every workaround attempt are, in practice, the offensive equivalent of a keylogger running against the attacker’s own operation.
The global pipeline runs on a custom tool called wp2shell, which abuses a flaw in the WordPress REST API to inject SQL, plant a rogue admin account, and drop a webshell. The scale is genuinely industrial. A single automated run scanned 4,708 targets, confirmed access to 429 WordPress admin panels, and deployed 32 webshells, all within 61 seconds.
That’s not a person clicking through targets one at a time, that’s infrastructure built to move at machine speed. The target list for this side of the operation exceeds 56,000 identified URLs, spanning e-commerce platforms and WordPress sites with no particular country or sector pattern.
The second campaign is more targeted. The attacker manually selected targets in Ukraine, focusing on energy and utility companies, including the country’s national electricity transmission operator. Researchers confirmed data theft from four Ukrainian organizations. One of the most serious cases involved a district heating provider in Kharkiv, a city close to the front line.
A password stored directly in the attacker’s script gave access to the provider’s systems. An automated tool then extracted more than 564,000 customer records, including home addresses and account numbers. SOCRadar warns that this data could put people at physical risk because Kharkiv is in an active war zone. Stolen customer information is usually a privacy concern, but in this situation, linking real names to home addresses could create much more serious dangers.
“Because Kharkiv sits on an active conflict front, this dataset poses a potential physical risk to identifiable civilians that goes well beyond a conventional data breach.” continues the report. “The most elaborate chain, against an e-commerce portal, combined blind SQL injection, a time-constrained password-reset token extraction, and PHP deserialization to reach remote code execution and full database access.”
The attacks stand out from typical cyber operations because the actor ran up to 51 specialized Claude Code agents on the primary workstation, assigned to roles like exploit chaining, lateral movement, and reconnaissance, plus a separate AI pentesting framework wired directly into a Cobalt Strike command server. SOCRadar’s researchers found the actor had also built a reusable script to get around model safety refusals, framing every request as an authorized penetration test on infrastructure the actor supposedly owned.
That trick isn’t a technical bypass, it’s social engineering aimed at the model instead of a person. And it didn’t always work. The logs show the model declining real requests multiple times, including four separate refusals to install a backdoor, disable a firewall, move laterally, or deploy a webshell. Safety measures held in plenty of individual sessions. The actor’s workaround was just opening a new session each time, since a refusal doesn’t carry forward once the context resets.
Researchers identified the operator by combining several clues: a paid AI subscription linked to a personal email address, a forum post using the same online alias, and activity that consistently matched Moscow time. The campaign affected more than 40 organizations across Ukraine, Poland, China and Pakistan.
The main lesson for defenders is to protect AI agent session logs as carefully as passwords and other sensitive credentials. These logs can reveal an attacker’s plans, the systems they accessed, what worked and where their attempts failed. If exposed, they can provide a detailed picture of the entire operation.
The report includes Indicators of Compromise (IoCs) for this campaign along with detection and hunting guidance.
Hunt.io traced BraZetsu ‘s infrastructure and found that hosting patterns and certificate data remained useful after published IOCs became outdated.
Group-IB researchers published a detailed writeup on BraZetsu back on August 31, naming it a Python framework compiled with Nuitka and tying it to a Brazilian actor called Exilware with high confidence. Hunt.io checked whether the published indicators still held up against its own certificate data. What they found is that the infrastructure had
Hunt.io traced BraZetsu ‘s infrastructure and found that hosting patterns and certificate data remained useful after published IOCs became outdated.
Group-IB researchers published a detailed writeup on BraZetsu back on August 31, naming it a Python framework compiled with Nuitka and tying it to a Brazilian actor called Exilware with high confidence. Hunt.io checked whether the published indicators still held up against its own certificate data. What they found is that the infrastructure had already moved on, quietly, months before anyone wrote about it.
BraZetsu is an initial access broker tool that breaks into Windows machines, checks them for ERP software, SCADA traces, EDR products, and certificate files, then packages the information for sale.
The group behind it, called Infected Marketplace, charges a deposit of about 5.80 Brazilian reais to let buyers browse the listings. The buyer who later deploys ransomware or steals money from a bank account doesn’t need to know how BraZetsu works. They simply buy a machine that has already been compromised.
Hunt.io’s approach was narrow on purpose. Instead of reversing the binary again, they took the hostnames and IP address Group-IB had already published and ran them against their own TLS certificate inventory.
“We didn’t reverse the binary again. We took the published indicators and checked what our certificate inventory still shows.” Hunt.io states. “The premise is narrow. An operator who keeps a panel and a command channel under the same apex, with Let’s Encrypt off port 443, leaves a more stable trail in the certificate inventory than the address of the month.”
Binaries can change all the time. A hostname linked to a valid TLS certificate is much harder to replace.
That approach worked quickly. The command server hostname mentioned in the August report, c2.installscenter.com, had already been using TLS on a second server since April 4, almost five months before the report was published. Researchers found it on the same IP address as the control panel hostname, painel.installscenter.com. Both were hosted by the same Swedish provider, Njalla.
The original seed IP, a Contabo server, tells its own story. From January through early February it served Contabo’s default factory hostname, boring and unremarkable. Then on February 11, right around when Group-IB dates the first BraZetsu version, the certificate switched to painel.seu-dominio.com, a Portuguese placeholder name literally meaning “your domain” lifted straight from hosting tutorials. That name showed up 17 separate times over five weeks, every two to four days, which is a strong signal of a panel someone actually kept running, not a page thrown up for one night.
When the operators eventually moved providers, they kept the exact same habits. The new host came alive on March 21, the very day the installscenter.com domain was registered, running the identical Hestia Control Panel setup with the same painel prefix. Different hosting company, same fingerprint.
“Passive DNS helps explain it. Our records show c2.installscenter[.]com resolving to 80.78.27[.]252 between 22 and 26 March, and to Cloudflare (104.21.78.246, 172.67.138.224) from 26 March on.” states the report. “The only A record we have for painel.installscenter[.]com is Cloudflare, from 21 March.”
The real lesson here isn’t about BraZetsu specifically, it’s about what actually survives a public takedown report. Hashes rotated across five different versions in just four months, useless as a long-term detection signal. What held steady from February through June was the naming convention and hosting pattern itself, a panel prefix on a nonstandard port, running on a VPS configured with Hestia Control Panel.
Hunt.io’s conclusion lands on a point worth remembering for anyone building detection rules off a threat intel report: don’t chase the IP of the month, chase the pattern. Before publishing, the researchers notified the relevant national CERTs and confirmed no victim data was recovered during the investigation, which is the responsible way to handle infrastructure still potentially active.
“The public reporting gave us three things to work from: the C2 hostname, the IP tied to it early in the year, and the shop both of them served. Our certificate inventory showed what happened to that hostname after the first VPS went quiet. It showed up on a new host in a different provider, with a control panel on the same apex.” concludes the report. “The TLS services on 80.78.27[.]252 went quiet after 20 June. The pattern is more stable: a painel. or c2. prefix on a port that isn’t 443, on a VPS running Hestia Control Panel. It held from February to June across two providers, and that’s what we’d build detection on, not the IP.”
Entrar
