AI‑Driven Hack Net Seizes Hundreds of Thousands of Ukrainian Records

A cyber‑crime outfit identified as CyberXero has leveraged a fleet of artificial‑intelligence agents to pilfer more than six hundred thousand records from Ukrainian sources, including data tied to the nation’s energy infrastructure.

According to threat‑monitoring firm SOCRadar, the group deployed exactly 51 autonomous AI agents to coordinate the intrusion, automate credential harvesting, and move data out of compromised systems. The operation resulted in the extraction of roughly 628,000 individual files, many of which contain details about power plants, grid operators and related logistical information.

CyberXero’s methodology blends conventional hacking utilities—such as phishing kits and malware loaders—with AI‑driven scripts that can adapt to security controls in real time. Analysts say the agents are capable of scanning networks, identifying vulnerable endpoints, and even modifying their own code to evade detection, a step beyond the manual scripts used by earlier threat actors.

The breach raises particular concern for Ukraine, whose energy sector has already been a frequent target amid the ongoing conflict. Access to operational data could enable further sabotage, facilitate black‑mail, or be sold on underground markets to parties seeking strategic advantage. Experts warn that the successful use of AI in this context signals a broader shift, where malicious actors can scale attacks with less human oversight, potentially lowering the barrier to entry for sophisticated cyber‑espionage.

Security firms are urging organizations to augment traditional defenses with AI‑aware monitoring tools, while Ukrainian authorities have opened investigations into the source of the leak. SOCRadar’s report suggests that similar AI‑augmented campaigns may emerge soon, prompting calls for international cooperation on cyber‑norms and rapid sharing of threat intelligence to mitigate the growing risk.