KeyHunter Operation: Harvard Alumni Data, Stanford Applications and LLM Key Theft

The KeyHunter Operation pairs LLM key theft with an academic fraud campaign that reaches Harvard alumni data, Stanford applications and 18 other universities. SOCRadar’s Threat Research Unit (STRU) attributes the operation to leepsmarts, a Chinese-speaking threat actor, with activity confirmed as late as October 13, 2026.

The operation runs on two main tracks: theft of LLM API credentials from misconfigured cloud infrastructure, and an academic fraud campaign targeting 20 institutions, 19 of them in the US. Both run on infrastructure in China, South Korea, Malaysia and the US, are coordinated through AI agent frameworks (Hermes Agent, OpenClaw), and are managed from a custom dashboard on the actor’s primary server.

Directory listing was enabled on the actor’s primary server. This exposed tools, scripts, logs and Telegram bot tokens, including tokens for the actor’s own AI agent bots. The chat history behind those bots records operations going back to at least January 2026.

Key Findings

Discovery and Infrastructure

On September 9, 2026, SOCRadar detected a server listening on port 8899 at 209.112.91[.]74, with directory listing enabled and exposing 110 files across 37 directories. This server was the starting point for pivoting and the subsequent investigation into the actor’s operations.

Pivoting Methodology

Starting from this server, the investigation expanded through four technical avenues: the PentAGI CA self-signed TLS certificate identified two additional nodes; domain correlation involving senhai[.]store and astrdark[.]cyou pointed to the Huawei Cloud node in China and the Tavily proxy; Telegram bot token resolution in the server’s files confirmed two of the actor’s own operational bots and the owner of the @leepsmartsx chat; and file-level pivoting linked 209.112.91[.]74 to 22 hosts, of which six were classified as actor infrastructure and 16 as scanning targets.

Confirmed Nodes and Domains

Pivoting produced the following map of the actor’s core infrastructure.

IP	ASN / Location	Role	Evidence
209.112.91[.]74	AS1004 · US	Primary C2 / work server	Open directory, 110 files, dashboard :9997, bot tokens
173.231.39[.]244	AS18450 · WebNX, US	Hermes Agent node	.env with Exa/Firecrawl keys, CUA Driver v0.22.2, systemd service, AI_radar cron
123.60.2[.]245	AS55990 · Huawei Cloud, CN	PentAGI + Xingrin ASM	PentAGI CA certificate, pentagi.senhai[.]store, yyhuni author metadata
14.47.118[.]194	AS4766 · Korea Telecom, KR	Open WebUI + Wazuh SIEM	PentAGI CA certificate, Open WebUI :8080, Wazuh :7547, MCP session header
66.42.94[.]67	Vultr	Relay gateway	gateway.log: accepted connection from 209.112.91[.]74
Oracle Cloud, Johor, MY	Oracle Cloud	OpenClaw host (IP unconfirmed)	Identified through Telegram logs: the agent reported that a Malaysian Oracle IP had been flagged by Microsoft
47.123.2[.]193:18181	Not attributed	V2Ray / x-ui proxy panel	Two subscription tokens in the LEEP group chat

Several domains tied to files or records within the pivoted infrastructure were also identified:

Domain	Role	Registrar / ASN
senhai[.]store	Primary actor domain	Not available
pentagi.senhai[.]store / snap.senhai[.]store	PentAGI certificate subject → 123.60.2[.]245	Not available
astrdark[.]cyou / tavily.astrdark[.]cyou	Custom Tavily search proxy for Hermes	Not available
xxtt[.]me / agent.xxtt[.]me	Monitoring (Komari), test account domain	Not available
sajuai[.]xyz	C2	hosting.kr, registered 2026-07-19
web.712019[.]xyz	C2 / web frontend	Spaceship.com, registered 2026-02-17
mail2.bfvdoor[.]com	C2	Tagged as C2 by external threat intelligence
new74.osxwrong.us[.]com	C2	Tagged as C2 by external threat intelligence
vvbin[.]me	Disposable email for fake .edu personas	Not available

Infrastructure Timeline

Modus Operandi

The actor works through seven distinct phases, numbered 0 to 6.

Phases 0 to 2 run continuously through cron jobs and systemd services on the actor’s infrastructure. The later phases are driven by the operator in real time through the Telegram interfaces of OpenClaw (@lsmarts_openclaw_bot) and Hermes Agent (@creeper_hermes_bot), with AI agents built into the operation as a core component.

Phase 0: AI-Driven Intelligence Monitoring (Continuous)

Phase 0 runs on the Hermes Agent node at 173.231.39[.]244 as a cron job called AI_radar, scheduled every 240 minutes. It uses the grok-4.6 model, with searches routed through the actor’s custom Tavily proxy (tavily.astrdark[.]cyou). Each run covers the following sources:

• X/Twitter: Grok X Search, using keywords and official AI lab accounts
• HuggingFace, GitHub, Hacker News, TechCrunch AI and arXiv: Third-party search through Exa and Firecrawl

The prompt defines the filtering criteria: only new model releases, version updates, pricing changes, relevant open-source projects and new free usage quotas are included, while funding news, rankings and opinion pieces are excluded. The objective is to spot new LLM APIs and free quotas early, before providers tighten their controls.

Outputs captured during August and September 2026 included the release of Kimi-K3 (Moonshot AI, 2.8T parameters, weights on HuggingFace), GLM-5.3-Flash (Zhipu AI, free API available), AWS Kiro Crew (open-source, new cloud credentials), ByteDance Lance 3B and Tencent Hy4 (770B). Each entry follows a fixed format: title, source, first-published date, stage, category (supply, market, demand or distribution), confidence and link.

Twenty runs were captured between August and September, at an estimated $6.13 in LLM credits per run. On August 31, two consecutive runs failed when the operator’s balance fell to $0.14, and the operator topped up the credits within a few hours. At the configured four-hour interval, the job alone would cost roughly $37 per day, paid out of pocket, while stolen third-party keys could later offset these costs.

Phase 1: Reconnaissance and Seed Generation

With the monitoring baseline in place, two systemd services on the primary server continuously generate targets by querying FOFA and Shodan:

• mscanner-fofa.service queries FOFA to discover LLM API endpoints and exposed administration panels.
• mscanner-shodan.service runs parallel Shodan queries using complementary search criteria.

The targeted hosting platforms are those where developers most often expose credentials: Vercel, Netlify, Railway, Render, Replit, Streamlit, Fly.io, Cloudflare Pages, fl0.com, koyeb.app and deta.space.

Beyond automated scanning, the adversary employs three complementary reconnaissance techniques:

• 360 Quake searches (a Chinese alternative to Shodan): The Bash history on the Hermes node shows the query quake.360.net 搜索 body:”/api/v1/client/subscribe?token” used to locate exposed V2Ray/Clash subscription panels, which also surfaces usable proxy infrastructure
• HFS server hunting (HTTP File Server): The hfs_scan.sh script on 159.89.18[.]165 locates Windows instances with HFS file servers exposed to the internet. One hit was a home system on a residential connection with an exposed root directory containing .aws/, .azure/ and .docker/ folders

• Wayback Machine: wayback_verify.py queries Internet Archive snapshots of target domains to recover URLs tied to historically exposed credentials, including .env files that are no longer directly accessible

The actor also maintains supporting target lists and scripts:

• k12_domains.txt: K-12 school domains for educational targeting
• npo_available_domains.txt and npo_expired_domains_verified.txt: Nonprofit (NPO) domains for infrastructure squatting or phishing
• premium_whois.py and school_whois.py: WHOIS queries targeting educational and premium domains
• uci_scraper.py and uci_faculty.json: A custom scraper and its output covering the UC Irvine faculty directory, including names, positions and institutional email addresses

The host_feeder.log records the flow of discovered hosts entering the scanning pipeline.

Phase 2: Credential Extraction

Several extraction tools run in parallel against the seeds generated in Phase 1:

env_hunter: Scans exposed .env and configuration files. Version 4.0, active since July, expanded its scanning paths from 14 to 50 (+257%), including platform-specific paths:

• Vercel: /api/env, /.vercel/output/config.json, /_next/env.js
• Netlify: /.netlify/functions-serve/env, /netlify.toml
• Railway / Render: /railway.json, /render.yaml
• Replit: /.replit, /replit.nix
• Streamlit: /.streamlit/secrets.toml, /secrets.toml
• Fly.io: /fly.toml
• Cloudflare Pages: /wrangler.toml, /_worker.js
• Expanded generic paths: .env.development, .env.prod, .env.staging, .env.backup, .env~, /config.yaml, /.ssh/config, /env.json, /firebase.json, /serverless.yml

The system implements platform detection: if the target domain is *.vercel.app, for example, the Vercel-specific path set is activated automatically. Concurrency was doubled from 50 to 100 workers across four parallel processes:

• main_scanner (mscanner-runner.service): The main scanner, operating with 100 concurrent workers
• paas_hunter (paas-hunter.service): Targeting of PaaS administration panels and cloud API endpoints
• fadidevv/keyhunter (Rust, published on crates.io as github-keyhunter v0.1.0, 202 stars, 40 forks): Scans GitHub repositories for API keys leaked in source code across more than 45 providers, including OpenAI, Anthropic, AWS, Stripe and HuggingFace. The actor maintains a direct fork of this repository

The server directory also holds bigzooooz-keyhunter/ and fadidevv-keyhunter/, local copies of two public KeyHunter projects, as well as Key-Scraper/ as a complementary tool.

Operational statistics were documented in key_hunter_optimization_summary.md:

• Active since 2026-07-10
• 2,233 API keys discovered in total
• 12 valid/active keys (0.54% yield)
• 41 keys discovered in the last 24 hours
• URL survival rate: 1.9%
• Main limitation: the free FOFA account blocks extraction of the body field (error 820001)

The results are stored in JSONL ledgers:

Phase 3: Validation and Unified Dashboard

Harvested credentials then pass through provider-specific validators:

• anthropic_check.py: Validates Anthropic (Claude) keys
• openai_check.py: Validates OpenAI keys and compatible endpoints
• cloud_check.py: Validates cloud keys (AWS, GCP, Azure)
• db_probe.py: Probes databases using extracted credentials
• openrouter_check.py: Validates OpenRouter keys

The cve_hits.jsonl file contains 247 records documenting three types of LLM gateway exposure:

Type	Count	Description
open-gateway	237	Unauthenticated OpenAI-compatible endpoints (unindexed public relays)
gateway-user-key	9	API keys extracted from misconfigured one-api/new-api admin panels
unauth-list	1	Unauthenticated channel listing on an AWCloud new-api instance: 84 Hunyuan API keys extracted

Of the 237 open-gateway hits, 223 have chat_ok: true and are actively usable. The model providers available through these gateways include Google Gemini 2.5 Flash/Pro, GPT-4o, Claude Sonnet 4 (bedrock-claude on one endpoint), DeepSeek R1/V3/V3.1, Qwen3-Coder-480B, Meta Llama-4 Maverick, Mistral Large, and variants of internal models.

The actor also runs a unified dashboard at hxxp://209.112.91[.]74:9997, which a Hermes Agent built on the operator’s instruction. The agent produced the complete application and a completion report documenting its implementation. The dashboard exposes:

• Keys tab: 2,233 keys in total, 12 valid; one-click filtering by status; JSONL export (/api/findings/export?status=valid)
• Proxies tab: 70,221 entries in total, 60,046 active (85.5%); export via /api/proxy/export?status=alive
• Config tab: Visual editing of FOFA and Shodan API keys

The actor uses AI both to run the operation and to build its own operational tooling.

In parallel, AIPocket (cloned from leepsmarts/aipocket) runs on port 3080 of the main server as an alternative management frontend.

Phase 4: Academic Fraud Campaign

The academic fraud campaign creates fraudulent student identities at US universities at scale. It runs from an Oracle Cloud ARM node in Johor, Malaysia, through the OpenClaw agent (@lsmarts_openclaw_bot).

CalState Tooling Evolution

Script	Language	Phase	Technique
cs_app_explore.js	JavaScript	Reconnaissance	Exploration of the CSU application portal
calstate_register.js	JavaScript	Registration v1	Initial, basic implementation
calstate_register2.js	JavaScript	Registration v2	Second iteration with corrections
calstate_pure_register.py	Python	Registration via curl	Browser-free implementation to test alternative approaches
calstate_playwright.js	JavaScript	Registration v3	Headless Playwright with reCAPTCHA Enterprise bypass
calstate_fill.js	JavaScript	Biographical form completion	Login and completion of the biographical profile form
cs_app_fill.js	JavaScript	Form completion v2	Second variant of the form-filling script
calstate_continue.js	JavaScript	Continuation	Progression through multi-step forms

The workflow has three steps:

• Account creation: Registration using an @vvbin.me email address and a reCAPTCHA bypass
• Profile completion: Login and completion of biographical information (DOB, gender, state, county)
• Continuation: Progression through the remaining application forms

Fabricated personas used against CalState include “David Wang” (dwang2026w@vvbin.me), “Michael Chen” (mchen2026m@vvbin.me) and mchen2026reg.

The LEEP group history documents a real-time session on March 26, 2026, during which the OpenClaw agent was instructed to register Microsoft Outlook accounts in batches, targeting 50 simultaneous accounts. The operation used a pool of more than 60 SOCKS5 nodes across 14 countries (HK, TW, SG, JP, KR, US, DE, UK, FR, NL, IT, BR, AR, MX).

During the session, the agent confirmed the creation of gafz4wkspoy8@outlook.com. The operator noted that Maricopa County Community College District had been targeted earlier in a similar campaign that ran into the same IP-detection obstacles.

The actor also maintains a documented CAPTCHA-evasion toolkit:

• curl_cffi: TLS fingerprint spoofing to imitate a legitimate Chrome browser
• nodriver: Browser automation designed to avoid detection signals
• undetected-chromedriver: Patched ChromeDriver designed to evade WebDriver detection
• patchright: Playwright fork with anti-fingerprinting features
• Puppeteer with mouse-movement scripts: Specific targeting of Cloudflare Turnstile
• Microsoft hsprotect bypass (press-and-hold verification): Implemented during the Outlook campaign

Fraudulent .edu accounts feed multiple monetization channels, all documented in the LEEP group:

Channel	Evidence in LEEP	Value
GitHub Student Developer Pack	URL github.com/settings/education/benefits	Free access to paid developer tools and cloud credits
JetBrains student licenses	Two distinct application codes (multiple accounts)	Free licenses for professional IDEs
Microsoft Education store	Documented access	Microsoft software at academic discounts
NordVPN activation code	Code shared in LEEP	Annual Standard VPN subscription for 6 devices, likely obtained through student-discount abuse
Per-account payments	NYU: “已缴费250” (“250 paid”) recorded per account	Consistent with resale of, or a paid service around, university accounts for Chinese students
Application service	Stanford, UChicago, Wake Forest, Case Western, Central Michigan: application payment URLs	Possible fraudulent university application-processing service

Payment URLs with unique transaction IDs for application portals at Stanford, UChicago, Wake Forest, Case Western and Central Michigan suggest that the actor may offer an “application assistance” service to Chinese students. This could involve submitting genuine university applications under fraudulent identities, which could be exploited in different ways depending on the actor’s motivations.

Phase 5: Exploit Staging Against University Infrastructure

Beyond academic fraud, the actor stages exploits against university infrastructure. cpanel_check.py implements CVE-2026-41940 (cPanel & WHM authentication bypass, CVSS 9.8, CISA KEV) in four stages and was present and ready to deploy at the time of capture. Agent session logs from May 1, 2026, show the actor’s AI agent working through the bypass against arizonachristian.edu and noting that stage two did not return a token, and in a later entry noting that utah.edu was still reachable; no successful exploitation is confirmed. The four stages are:

• 1. Pre-authentication session: A POST request to /login/?login_only=1 with incorrect credentials (user: root, pass: wrong) to obtain a valid whostmgrsession cookie without authenticating
• 2. CRLF injection: A GET request to the root path / with the Authorization: Basic {PAYLOAD_B64} header, where the decoded Base64 payload is:

root:x successful_internal_auth_with_timestamp=9999999999 user=root tfa_verified=1 hasroot=1

This payload injects additional HTTP headers that the cPanel server interprets as markers of successful internal authentication, returning a cpsess token with an expiration timestamp of 9999999999 (approximately the year 2286).

• 3. Session propagation: A GET request to {token}/scripts2/listaccts to propagate and consolidate root permissions in the active session
• 4. WHM API calls as root: Access to the WHM JSON API:
• /json-api/version?api.version=1: Version check and confirmation of root access
• /json-api/listaccts?api.version=1: Enumeration of all hosting accounts

Three academic institutions are hardcoded as targets in the scripts:

• UTN Argentina (utn.edu.ar, at 190.114.197[.]2): Universidad Tecnológica Nacional
• Arizona Christian University (arizonachristian.edu, at 165.22.159[.]246)
• University of Utah (utah.edu, at 70.32.112[.]20)

The cpanel_persist file contains an Ed25519 SSH key pair with the comment sysadmin@internal. The public key is meant to be added to ~/.ssh/authorized_keys after a successful exploit, while the unencrypted private key gives the actor access. The comment was likely chosen to make the key look like it belongs to an internal systems administrator and avoid scrutiny during SSH access audits. ssh_bruter.py (9.51 KB) adds SSH credential brute-forcing.

Phase 6: Monetization and Financial Fraud

The final phase turns the operation’s output into direct financial return through four parallel components.

6.1 Credit Card Validation

The card monetization workflow has three steps:

• Acquisition of raw data: @juanwangccBOT (卷王二手CVV, “Juanwang Second-Hand CVV”), operated by @woshijuanwang, is a Telegram bot linked to a Chinese underground card market. It advertises a live-card rate above 60% and offers no after-sales service

• No-charge validation: stripe_card_checker.py in SAFE mode uses Stripe’s PaymentMethod API with stolen sk_live keys (the type of key KeyHunter is built to harvest) to check whether a card is active without charging it
• Confirmation with a microcharge: CHARGE mode (an actual $0.50 charge) confirms full authorization before the card is used for higher-volume fraud

The scripts card_tokenizer.html and card_validator.html are complementary web tools for manual card management. deluxechecker.py, identified on the Malaysian Oracle Cloud node through logs extracted from Telegram, combines Luhn number generation, Stripe verification, and proxy scraping in a single tool. It is distinct from stripe_card_checker.py.

Four complete card numbers (Visa and US Mastercard debit), including expiration dates and CVVs, were observed in the LEEP group and validated with OpenClaw’s /sa command within a short period. Given how long the operation has run, these four cards are likely a small sample, with earlier activity possibly spread across rotated bots and Telegram accounts.

6.2 Cryptocurrency Drainer (@harmony0bot)

The drainer works as follows:

• The actor clones harmony-one/HarmonyOneBot (the official Harmony ONE bot repository)
• A seed-phrase capture module is injected
• The bot is deployed while impersonating the legitimate Harmony ONE service
• Victims submit their seed phrases believing they are recovering their wallets
• The bot records seed phrase | source IP | User-Agent and forwards the information to the actor’s server
• The captured phrases give the actor full control of the victims’ wallets

Real victim seed phrases (source IP: 46.39.24[.]98) were observed in the bot’s history alongside a test entry from localhost (“1 1 1 1 1 1 1 1 1 1 1 1”), showing that the actor built and tested the drainer before deploying it. Analysis of the bot’s aggregated data identified 15 related wallet addresses, covering both victim and destination wallets.

6.3 Monetization of Harvard Alumni Data

On August 16, 2026, the actor processed 195 records from a Harvard alumni dataset during a session in the LEEP group, tracking progress with the marker “进度195” (“progress 195”). Each record includes:

• Full formal name (first name, middle initial, surname)
• AAD number (an internal Harvard alumni identifier)
• Personal/business email address
• Alumni email address (@post.harvard.edu, @mba1964.hbs.edu for MBA)
• Class year

The records include professionals with email addresses at law firms, wealth management firms and telecommunications companies, making them high-value targets for business email compromise (BEC) or investment fraud. A magnet link labelled harvard.edu was shared in the same session as the dataset source.

6.4 Fraudulent Email Infrastructure

The OutlookRegister/ directory on the main server is used for bulk Outlook account registration, complementing the registration campaign documented in the LEEP group (50 accounts per batch). These accounts are used to:

• Create additional fictitious identities for university applications
• Build email infrastructure for phishing campaigns
• Register for services that require email verification

Across the attack chain, AI lets the actor scan and validate data at scale, create university accounts and run fraud, while monitoring and controlling the operation through Telegram over several months.

Attribution

Three data points link the same identity: GitHub commit history, Telegram bot ownership, and the history of the LEEP operational group. The last two were both reached through the same bot token, so they corroborate each other rather than standing as independent sources.

Attribute	Value
GitHub alias	leepsmarts (github.com/leepsmarts)
GitHub plan	PRO subscriber, 0 followers
Telegram alias	@leepsmartsx (display name: 𝓵𝓮𝓮𝓹𝓼𝓶𝓪𝓻𝓽𝓼)
Telegram channel	@lsmarts
Operational group	“LEEP”
Language	Simplified Chinese (zh-hans, confirmed from message metadata)
Timezone	UTC+8, consistent with message timing and cron timestamps (e.g. 2026-08-29T17:41:44+08:00)
Last confirmed activity	October 13, 2026, 22:21 CST (LEEP group message)

Confirmation Chain

The GitHub and Telegram identities are linked through bot ownership. Both operational bots resolved to the same chat owner, @leepsmartsx:

• @creeper_hermes_bot provides a Telegram interface for Hermes Agent.
  Its /topup command references a Nous Research balance, indicating a Nous Research payment account.
• @lsmarts_openclaw_bot provides a Telegram interface for OpenClaw with more than 60 commands.
  Its display name, “creeper,” also appears in the backup filename creeper-soul-2026-05-18.tar.gz on the main server.

The LEEP operational group, accessed using the OpenClaw bot token, contained Simplified Chinese messages from @leepsmartsx directing the OpenClaw agent.

The main server’s .bash_history contains the command git clone –depth 1 https://github.com/leepsmarts/aipocket.git with a specific commit hash, showing that the server deployed code directly from the leepsmarts GitHub account. Combined with the shared bot ownership and the matching handles, this makes it highly likely that the GitHub account, the Telegram account and the server belong to the same operator.

Confidence Assessment

SOCRadar assesses with high confidence that a single operator controls the leepsmarts GitHub account, the @leepsmartsx Telegram account and the bots directing the AI agents. The assessment rests on shared bot ownership, the matching leepsmarts and leepsmartsx handles, and the leepsmarts repository deployed on the main server.

SOCRadar assesses with moderate confidence that the actor is Chinese-speaking and operates in the UTC+8 time zone, based on Simplified Chinese message content and activity timing. UTC+8 also covers Hong Kong, Taiwan, Singapore and Malaysia, so these indicators alone do not establish location. The profile fits an individual, financially motivated actor working with a small informal network.

Victimology

This section covers the institutions and individuals affected during the documented period of activity.

Academic Institutions

Twenty institutions have been identified, 19 of them in the US and one in Argentina. A University of South Florida account (leeps@usf.edu) belongs to the operator and is not counted as a victim.

Data Exposure

Institution	Discovery	Evidence type
Harvard University	Alumni dataset torrent (7700c3d9…), @college.harvard.edu and @fas.harvard.edu accounts, 195 records processed in the LEEP group on Aug 16, 2026. The data suggests a connection to the ShinyHunters incident in November 2025	Data exposure
University of California Irvine	uci_faculty.json (446 KB), uci_scraper.py	Directory scraping

Account Creation and Access

Institution	Discovery	Evidence type
Oregon State University	+4 accounts tied to real names (usernames withheld), ONID and Duo setup documented	Accounts created
New York University	+3 @nyu.edu accounts, “250 paid” recorded per account	Accounts created
Colorado State University	+3 @colostate.edu accounts	Accounts created
University of Illinois (UIUC)	@illinois.edu account, NetID confirmed	Accounts created
UC Berkeley	CalNet ID (withheld), auth.berkeley.edu login	Accounts created
Arizona State University	ASURITE msa** confirmed in LEEP	Accounts created
CSU East Bay	ls**@horizon.csueastbay.edu (password visible in LEEP)	Accounts created
CSU Chico	jbr**@csuchico.edu	Accounts created
California State University (system)	8 scripts, 3 fabricated personas, reCAPTCHA bypass	Registration tooling
University of Connecticut	uconn.edu access observed	Account access
Maricopa County Community College	Referenced in LEEP as an earlier campaign target	Prior target

Fraudulent Applications

Institution	Discovery	Evidence type
Stanford University	2 summerapply.stanford.edu payment URLs generated	Application payment links
University of Chicago	apply-graham.uchicago.edu payment URL	Application payment links
Wake Forest University	2 apply.graduate.wfu.edu payment URLs	Application payment links
Case Western Reserve	applygrad.case.edu payment URL	Application payment links
Central Michigan University	fireup.cmich.edu registration and payment URLs	Application payment links

Exploit Targets

Institution	Discovery	Evidence type
University of Utah	CVE-2026-41940 hardcoded target (70.32.112[.]20)	Hardcoded exploit target, no confirmed compromise
Arizona Christian University	CVE-2026-41940 hardcoded target (165.22.159[.]246), incomplete attempt in agent logs	Hardcoded exploit target, no confirmed compromise
UTN Argentina	CVE-2026-41940 hardcoded target (190.114.197[.]2)	Hardcoded exploit target, no confirmed compromise

Cryptocurrency Victims and Financial Fraud

@harmony0bot captured real Harmony ONE seed phrases (confirmed source IP: 46.39.24[.]98, Chrome/147.0). Analysis of the bot’s aggregated data identified 15 related wallet addresses. Four credit card numbers (Visa and US Mastercard debit) observed in the LEEP group originated from the underground CVV market behind @juanwangccBOT.

Individuals Affected by Leaked Datasets

The processed dataset contains personal and alumni email addresses for 195 Harvard alumni. Real names were confirmed for four Oregon State accounts, and the scraped UC Irvine data includes faculty contact details.

Geographic Scope

Victim locations confirmed through bot messages, payment records and account PII span 11 countries: France, Germany, Netherlands, Pakistan, Russia, Saudi Arabia, South Africa, Turkiye, United Arab Emirates, United States and Uzbekistan.

The 7,042 bot messages analyzed, spanning January 15 to September 22, 2026, contain 225 distinct victim email addresses and 211 unique IP addresses.

MITRE ATT&CK TTPs

Tactic	Technique	Evidence
TA0043 Reconnaissance	T1595 Active Scanning	mscanner services, hfs_scan.sh, 360 Quake queries
TA0043 Reconnaissance	T1596 Search Open Technical Databases	FOFA API queries via mscanner-fofa
TA0043 Reconnaissance	T1589.002 Gather Victim Identity Information: Email Addresses	uci_scraper.py, Harvard alumni dataset processing
TA0042 Resource Development	T1583 Acquire Infrastructure	6 confirmed nodes, 70,221 proxy entries
TA0042 Resource Development	T1585 Establish Accounts	Outlook bulk registration, .edu campaign
TA0042 Resource Development	T1587 Develop Capabilities	AI-built dashboard, custom scanners and exploit scripts
TA0001 Initial Access	T1190 Exploit Public-Facing Application	CVE-2026-41940 staged against 3 named universities
TA0001 Initial Access	T1078 Valid Accounts	Stolen LLM API keys (2,233 harvested, 12 valid)
TA0002 Execution	T1059 Command and Scripting Interpreter	Python, Node.js, Rust, Playwright
TA0003 Persistence	T1098.004 Account Manipulation: SSH Authorized Keys	cpanel_persist Ed25519 key (sysadmin@internal)
TA0005 Defense Evasion	T1090 Proxy	70,221 proxies, 60+ node SOCKS5 pool, residential proxy lists
TA0005 Defense Evasion	T1036 Masquerading	SSH key labeled sysadmin@internal
TA0005 Defense Evasion	T1656 Impersonation	@harmony0bot posing as the Harmony ONE service
TA0006 Credential Access	T1552 Unsecured Credentials	AIPocket / KeyHunter pipeline (env files, admin panels)
TA0006 Credential Access	T1110 Brute Force	ssh_bruter.py
TA0007 Discovery	T1046 Network Service Discovery	db_probe.py database reachability probes
TA0040 Impact	T1496 Resource Hijacking	247 exposed LLM gateways, stolen compute
TA0040 Impact	T1657 Financial Theft	stripe_card_checker.py, @harmony0bot drainer

Annex A: Tools and IOCs

Additional indicators are available on the SOCRadar platform.

Tool	Language	Source	Function
AIPocket	Python	leepsmarts/aipocket (GitHub)	LLM gateway discovery and key validation; management frontend on port 3080
KeyHunter (Python)	Python	keyhunter-src/ (in-server)	.env path scanner with FOFA collector; collectors: cve_exploit.py, fofa.py, subdomain.py
keyHunter-skill	Python	MisterGaohohoho (forked)	KeyHunter packaged as Hermes Agent skill (SKILL.md)
fadidevv/keyhunter	Rust	fadidevv/keyhunter (crates.io v0.1.0)	GitHub repository API key scanner, 45+ providers
Hermes Agent	Python	NousResearch	AI agent framework; Telegram interface; cron; CUA Driver v0.22.2
OpenClaw	Node.js	openclaw.ai	AI agent framework; Telegram interface; 60+ commands including /yolo, /canvas
PentAGI	Go	vxcontrol/pentagi	AI-powered automated pentesting orchestration
Xingrin ASM (星环)	JavaScript	yyhuni	Attack surface management platform; FOFA/Shodan integration
stripe_card_checker.py	Python	Actor custom	Credit card validation via Stripe sk_live keys; country-based proxy routing
cpanel_check.py	Python	Actor custom	CVE-2026-41940 four-stage exploit: preauth session, CRLF injection, propagation, API calls
calstate_playwright.js	JavaScript	Actor custom	CalState registration with Playwright + reCAPTCHA Enterprise bypass
calstate_pure_register.py	Python	Actor custom	CalState registration via curl with reCAPTCHA bypass
@harmony0bot	Node.js (grammY)	Modified harmony-one/HarmonyOneBot	Harmony ONE crypto drainer; captures seed phrases + IP/UA
sms_bomb.py	Python	Actor custom	SMS flooding (98.5 KB, multi-provider)
ssh_bruter.py	Python	Actor custom	SSH credential brute-force
deluxechecker.py	Python	Actor custom	Luhn CC generation + Stripe checking + proxy scraping (identified from Telegram logs; not retrieved)

Type	Value
IP	209.112.91[.]74
IP	173.231.39[.]244
IP	123.60.2[.]245
IP	14.47.118[.]194
IP	66.42.94[.]67
IP	47.123.2[.]193:18181
Domain	senhai[.]store
Domain	pentagi.senhai[.]store
Domain	snap.senhai[.]store
Domain	astrdark[.]cyou
Domain	tavily.astrdark[.]cyou
Domain	xxtt[.]me
Domain	agent.xxtt[.]me
Domain	sajuai[.]xyz
Domain	web.712019[.]xyz
Domain	mail2.bfvdoor[.]com
Domain	new74.osxwrong.us[.]com
Domain	vvbin[.]me
URL	hxxp://209.112.91[.]74:9997
Telegram	@leepsmartsx
Telegram	@lsmarts
Telegram	@lsmarts_openclaw_bot
Telegram	@creeper_hermes_bot
Telegram	@harmony0bot
Telegram	@juanwangccBOT
GitHub	github.com/leepsmarts

Frequently Asked Questions

What Is the KeyHunter Operation?

The KeyHunter Operation is a multi-vector campaign run by leepsmarts, a Chinese-speaking threat actor. It combines LLM API key theft from misconfigured cloud infrastructure with an academic fraud campaign targeting 20 institutions, 19 of them in the US. A parallel financial fraud track includes a Harmony ONE cryptocurrency drainer and credit card validation with stolen Stripe keys.

Who Is Behind the KeyHunter Operation?

SOCRadar’s Threat Research Unit attributes the operation to leepsmarts (@leepsmartsx on Telegram). SOCRadar assesses with high confidence that a single operator controls the GitHub account, the Telegram account and the bots directing the AI agents. It assesses with moderate confidence that the actor is Chinese-speaking and operates in the UTC+8 time zone, based on Simplified Chinese messages and activity timing.

Which Universities Were Targeted?

Twenty institutions were identified:

• Accounts created: NYU, UC Berkeley, Oregon State, the University of Illinois, Colorado State, CSU East Bay, CSU Chico and Arizona State
• Application payment links: Stanford, UChicago, Wake Forest, Case Western and Central Michigan
• Hardcoded exploit targets: The University of Utah, Arizona Christian University and UTN Argentina

Harvard alumni data, UC Irvine faculty data, Maricopa County Community College and the University of Connecticut also appear in the actor’s activity.

Was Harvard Breached by This Actor?

No. On August 16, 2026, the actor processed 195 Harvard alumni records from a torrent-distributed dataset tied to the November 2025 ShinyHunters incident. The records include names, AAD numbers and @post.harvard.edu addresses. There is no evidence that leepsmarts intruded into Harvard systems.

How Does the Actor Steal LLM API Keys?

The actor scans for exposed .env and configuration files on platforms where developers often leak credentials, including Vercel, Netlify, Railway, Render, Replit and Cloudflare Pages. Targets come from FOFA and Shodan queries, and a fork of the open-source KeyHunter tool scans GitHub repositories for leaked keys. The pipeline harvested 2,233 API keys, 12 of which the actor’s own tooling marked as valid.

How Did the Actor Use AI Agents?

The operator controlled two AI agent frameworks through Telegram bots. Hermes Agent ran an AI_radar job every four hours that monitored new model releases, pricing changes and free API quotas. It also built the actor’s management dashboard. OpenClaw ran the academic fraud campaign, including CalState registration scripts and batch Outlook account creation.

Was CVE-2026-41940 Exploited Against the Universities?

No successful exploitation is confirmed. CVE-2026-41940 is a cPanel & WHM authentication bypass with a CVSS 3.1 score of 9.8, added to CISA’s Known Exploited Vulnerabilities catalog on April 30, 2026. The actor’s cpanel_check.py script hardcodes three university targets. Agent logs from May 1, 2026, show an incomplete attempt against arizonachristian.edu that did not return a session token.

How Was the KeyHunter Operation Discovered?

On September 9, 2026, SOCRadar detected a server at 209.112.91[.]74 with directory listing enabled on port 8899, exposing 110 files across 37 directories. The exposed files included tools, logs and Telegram bot tokens. Pivoting on a shared PentAGI TLS certificate, domains and bot tokens mapped the rest of the actor’s infrastructure.

How Can Organizations Protect Their AI and Payment Keys?

Keep secrets out of any file a web server can serve, and scan repositories and deployments for leaked keys. Rotate any key that has been exposed, set usage limits and alerts on LLM API keys, and use Stripe restricted keys instead of full secret keys where possible. Hosting providers and universities running cPanel & WHM should patch CVE-2026-41940.

Where Can I Find the KeyHunter IOCs?

IP addresses, domains and Telegram handles are listed in Annex A of the KeyHunter Operation above. Additional indicators are available on the SOCRadar platform.

Source: SOCRadar · 2026-11-04