Threat Overview
SOCRadar published its primary CyberXero investigation October 6, 2026, and The Hacker News reported it October 12. The researcher-documented operation combines mass exploitation of WordPress/e-commerce platforms with targeted intrusions against Ukrainian critical infrastructure. SOCRadar recovered attacker working files and documented a `wp2shell` chain against WordPress REST batch handling, rogue administrators named `wp2_` plus eight hexadecimal characters, malicious plugins `wp2shell_<8hex>`, WSO webshells, Redis rogue-replication/SSH authorized-key persistence, and Cobalt Strike staging. The operator used Claude Code agents and PentAGI for orchestration; **AI use is not itself a detection indicator**. SOCRadar reports confirmed data exfiltration from four Ukrainian organizations and additional compromises elsewhere, but customer exposure cannot be inferred from these facts.
References
Impacted Systems
- **Products/platforms:** Internet-facing self-managed/hosted **WordPress** REST API installations targeted by `wp2shell` (research associates CVE-2026-63030 and CVE-2026-60137); **Support Board WordPress plugin** with CVE-2026-4815 (research cites version **3.8.7**); **Magento Community Edition** (historical CVE-2015-1397); **Redis** instances exposed to attacker reachability.
- **Roles:** WordPress web/application servers, e-commerce backends, Redis data services, and Windows endpoints targeted in follow-on Cobalt Strike activity.
- **Exposure:** Internet-accessible REST endpoints, vulnerable plugins/applications, or externally reachable/misconfigured Redis; some directed intrusions also used previously exposed credentials.
- **Version caveat:** SOCRadar does not establish a single complete affected/fixed version matrix for all product families in this campaign; exact WordPress/Magento/Redis build applicability and fixes require vendor verification. **Do not infer all versions are vulnerable.**
Why this matters
The actor industrialized opportunistic access to public websites and e-commerce systems, with demonstrated rogue WordPress accounts/webshell persistence and separate targeted critical-infrastructure intrusions. This can affect diverse MSSP customers with externally exposed CMS, e-commerce, or Redis services.
Exploitation Status
**SOCRadar-confirmed from recovered attacker artifacts:** one automated execution scanned 4,708 targets, accessed 429 WordPress admin panels, deployed 32 shells, and recovered data associated with more than 628,000 Ukrainian individuals; four Ukrainian organizations had file-confirmed exfiltration. **Researcher assessment:** the operator is a financially motivated IAB; the directed Ukraine activity's ultimate buyer/objective remains unresolved. **No customer-specific finding is asserted.**
What this hunt looks for
AzureDiagnostics and CommonSecurityLog for URI-bearing WAF/perimeter data; Defender DeviceFileEvents/DeviceProcessEvents/DeviceNetworkEvents on onboarded web/Redis/Windows hosts; Syslog if Redis/SSH audit details are forwarded; SecurityEvent for audited Windows service/process behavior. WordPress admin database and GitHub/Redis native inventory are not directly inspected by these Sentinel queries.
Required logs
AzureDiagnostics, CommonSecurityLog, DeviceFileEvents, DeviceNetworkEvents, DeviceProcessEvents, SecurityEvent, Syslog
Hunt 1: First pass — wp2shell plugin and rogue-admin markers in WAF requests
AzureDiagnostics
| where TimeGenerated >= ago(30d)
| extend Uri=tolower(strcat(tostring(column_ifexists("requestUri_s",""))," ",tostring(column_ifexists("originalRequestUriWithArgs_s",""))))
| extend Detail=tolower(tostring(column_ifexists("details_message_s","")))
| where Uri matches regex @"wp2shell_[0-9a-f]{8}" or Uri matches regex @"wp2_[0-9a-f]{8}" or Detail matches regex @"wp2shell_[0-9a-f]{8}"
| project TimeGenerated, Resource, ClientIP=tostring(column_ifexists("clientIP_s","")), Uri, Detail, Action=tostring(column_ifexists("action_s",""))
| order by TimeGenerated descHunt 2: Firewall/proxy — WordPress REST batch and wp2shell requests
CommonSecurityLog
| where TimeGenerated >= ago(30d)
| extend Uri=tolower(tostring(column_ifexists("RequestURL","")))
| where Uri contains "/wp-json/batch" or Uri contains "wp2shell_" or Uri matches regex @"wp2_[0-9a-f]{8}"
| project TimeGenerated, SourceIP, DestinationIP, DestinationHostName, DestinationPort, Uri, DeviceAction
| order by TimeGenerated descHunt 3: Endpoint — wp2shell and WSO PHP webshell files
DeviceFileEvents
| where TimeGenerated >= ago(30d)
| where FolderPath matches regex @"(?i)wp-content[/\\]plugins[/\\]wp2shell_[0-9a-f]{8}" or FileName in~ ("WSO-Shell.php")
| project TimeGenerated, DeviceName, FileName, FolderPath, ActionType, InitiatingProcessFileName, SHA256
| order by TimeGenerated descHunt 4: Endpoint — reported campaign SHA256 hashes
let Hashes=dynamic(["92a789444708fa1cb4cc5a89e0aa6cc7a279b62a7b8a4d2857255a18197d0090","a5ae0aab352871bc0b038b3aa43b03eb223425628c884af7b9fc592cd34eb86c","71e21094c1ac1cf0275c91ed377965e248bca1c12711f6dd20e2682681fc1192","59c535f47ab4d35f6d9fc8b8aec4a72438ea0b89e5a4dcea74b05d2d32cfa483"]);
DeviceFileEvents
| where TimeGenerated >= ago(30d)
| where SHA256 in~ (Hashes)
| project TimeGenerated, DeviceName, FileName, FolderPath, SHA256, ActionType
| order by TimeGenerated descHunt 5: Endpoint — web-service child processes consistent with shell execution
DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where InitiatingProcessFileName in~ ("php","php-fpm","apache2","httpd","nginx","java","tomcat","redis-server")
| where FileName in~ ("bash","sh","curl","wget","python","python3","nc","ncat","powershell.exe","cmd.exe")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName
| order by TimeGenerated descHunt 6: Network — SOCRadar-confirmed infrastructure and C2 ports
let IOCs=dynamic(["46.21.250.135","45.88.106.2","212.193.31.189","42.193.227.214","91.208.184.148","45.88.106.78","49.234.12.182","42.193.100.94"]);
DeviceNetworkEvents
| where TimeGenerated >= ago(30d)
| where RemoteIP in (IOCs)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemotePort, RemoteUrl, ActionType
| order by TimeGenerated descHunt 7: Network — firewall contacts to reported CyberXero infrastructure
let IOCs=dynamic(["46.21.250.135","45.88.106.2","212.193.31.189","42.193.227.214","91.208.184.148","45.88.106.78","49.234.12.182","42.193.100.94"]);
CommonSecurityLog
| where TimeGenerated >= ago(30d)
| where SourceIP in (IOCs) or DestinationIP in (IOCs)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, RequestURL, DeviceAction, DeviceProduct
| order by TimeGenerated descHunt 8: Linux Syslog — Redis rogue replication and SSH authorized keys
Syslog
| where TimeGenerated >= ago(30d)
| where SyslogMessage contains "SLAVEOF" or SyslogMessage contains "REPLICAOF" or SyslogMessage contains "authorized_keys" or SyslogMessage contains "wp2shell_"
| project TimeGenerated, Computer, ProcessName, Facility, SyslogMessage
| order by TimeGenerated descHunt 9: Windows persistence — reported UpdSvc and Cobalt Strike IEX stager
SecurityEvent
| where TimeGenerated >= ago(30d) and EventID in (4688,4697)
| extend Cmd=tostring(column_ifexists("CommandLine","")), Proc=tostring(column_ifexists("NewProcessName","")), Raw=tostring(column_ifexists("EventData",""))
| where Cmd contains "42.193.227.214:8033" or Cmd contains "UpdSvc" or Raw contains "UpdSvc" or (Proc endswith "powershell.exe" and Cmd contains "IEX" and Cmd contains "DownloadString")
| project TimeGenerated, Computer, Account, EventID, Proc, Cmd, Raw
| order by TimeGenerated descDetection Notes
**Highest signal:** exact `wp2shell_<8hex>` plugin directories, rogue `wp2_<8hex>` usernames in captured request/audit text, exact SOCRadar hashes, and C2 connections on reported ports. **Expected noise:** generic WordPress REST batch traffic, legitimate Redis replication, shell execution by web automation, and scanner IP hits blocked by perimeter controls. **Blind spots:** WAF body capture, native WordPress admin account logs, Redis command audit, Linux host EDR, and service-creation audit may be absent. An IP match alone is not proof of compromise.
Visibility is limited to ingested Microsoft Sentinel tables and retention; a clean result does not establish absence of compromise. Queries have not been executed against customer workspaces.
