Operation Master

Campaign
3 incidents First seen 2026-09-28 Last seen 2026-10-31
Overview

A joint operation by international law enforcement agencies has disrupted a sophisticated, AI-powered cyber campaign targeting multiple sectors and countries across Europe and beyond. The Russian-nexus threat group, codenamed CyberXero, used TrickBot and Cobalt Strike malware to breach critical infrastructure entities in Ukraine, as well as finance, retail, defense, energy, and other sectors globally. According to reports, the operation resulted in confirmed exfiltration of sensitive data from four Ukrainian organizations, with over 628,000 records compromised. The incident highlights the growing threat posed by financially motivated initial access brokers leveraging AI-powered tools to evade detection and maximize their gains.

Investigate in CTI Graph Login required Open in Dashboard
Threat ecosystem
Actors Malware Campaigns CVEs
Tap a node for a quick look · double-tap to open its profile
At a glance
peak priority 170
Activity by month (incidents)
2026-092026-10
Sectors targeted
energy · 2finance · 2retail · 2telecommunications · 2automotive · 1defense · 1education · 1government · 1health · 1technology · 1
Countries targeted
BR · 3AE · 2AR · 2BE · 2BO · 2CA · 2CL · 2CN · 2CO · 2CR · 2CU · 2AO · 1
Origin
BR · 2CN · 2AR · 1AT · 1BE · 1BG · 1
Kinds of incident
AI-Enabled Attack · 2Cyberattack (general) · 2Exploited Vulnerability · 2Malware & Botnets · 1Ransomware & Extortion · 1State-Sponsored & Espionage · 1
Techniques seen in incidents
Exfiltration · 2Lateral Movement · 2Phishing · 2Ransomware · 2Reconnaissance · 2Social Engineering · 2T1059.001 - PowerShell · 2T1588.001 - Malware · 2Credential Stuffing · 1Data Breach · 1Espionage · 1Impersonate · 1Privilege Escalation · 1T1059.006 - Python · 1
Related malware
Cobalt Strike · 2TrickBot · 1
Related actors
The Gentlemen · 1
Related CVEs
CVE-2026-0257 · 2CVE-2020-1938 · 1CVE-2021-4034 · 1CVE-2022-28368 · 1CVE-2023-7028 · 1CVE-2024-1086 · 1CVE-2026-4815 · 1CVE-2026-60137 · 1CVE-2026-63030 · 1
Incident timeline
2026-10-31
BleepingComputer Dailysecu AlienVault OTX The Hacker News Security Affairs AlienVault OTX AlienVault OTX Ransomware Live Dark Reading Dark Reading AlienVault OTX Chosun Economy AlienVault OTX Datanet SecurityWeek AlienVault OTX
2026-10-22
Tecnonews The Hacker News AlienVault OTX Tecnonews Dark Reading
2026-09-28
Hackers Exploit GlobalProtect Flaw and Turn Stolen Data Into 2.4 Million Fraud Messages
AlienVault OTX