One Operator, Two AI Agents: Stolen LLM Keys and Fake US Students

One operator with a pair of AI agents has spent most of 2026 vacuuming up AI API keys from badly configured web apps while signing up fake students at US universities. SOCRadar’s threat research unit says the “KeyHunter Operation” harvested 2,233 keys for services such as Anthropic, OpenAI, Google and DeepSeek, touched 20 institutions (19 in the US), and staged a cPanel exploit against three universities. SOCRadar ties it to a Chinese-speaking actor it calls leepsmarts, active as late as Oct. 13, and found it all because the actor’s main server had directory listing switched on.

209.112.91[.]74 (primary server, dashboard on :9997)
173.231.39[.]244 (Hermes Agent node)
123.60.2[.]245 (PentAGI node)
14.47.118[.]194 (Open WebUI node)
66.42.94[.]67 (relay gateway)
senhai[.]store · pentagi.senhai[.]store · snap.senhai[.]store
astrdark[.]cyou · tavily.astrdark[.]cyou · xxtt[.]me · agent.xxtt[.]me
sajuai[.]xyz · web.712019[.]xyz · mail2.bfvdoor[.]com · new74.osxwrong.us[.]com

Source article: KeyHunter Operation: Harvard Alumni Data, Stanford Applications and LLM Key Theft
Publisher: SOCRadar Threat Research Unit (STRU)
Published: Nov. 4, 2026
URL: https://socradar.io/blog/keyhunter-operation-harvard-alumni-stanford-llm-key-data/

Executive Summary

SOCRadar’s Threat Research Unit attributes the KeyHunter Operation to leepsmarts (Telegram @leepsmartsx, channel @lsmarts, operational group “LEEP”), a Chinese-speaking, financially motivated operator working in UTC+8 whom SOCRadar assesses with high confidence to be a single person controlling a GitHub account, a Telegram account and two AI agent bots (@lsmarts_openclaw_bot for OpenClaw and @creeper_hermes_bot for Hermes Agent); no other vendor names have been published for this actor. SOCRadar found the operation on Sept. 9, 2026, through an open directory on port 8899 of 209.112.91[.]74 and pivoted through a shared PentAGI CA certificate, the senhai[.]store, astrdark[.]cyou and xxtt[.]me domains and Telegram bot tokens to six actor servers in the US, China, South Korea and Malaysia, with bot history back to Jan. 15, 2026 and last confirmed activity on Oct. 13, 2026. The chain runs in seven phases: an AI_radar cron job on the Hermes node tracks new LLM releases and free quotas; FOFA, Shodan and 360 Quake queries, crt.sh, Wayback Machine lookups and an HTTP File Server scanner seed targets on PaaS platforms; env_hunter, a main scanner, paas_hunter and forks of public KeyHunter projects pull secrets from about 50 config paths per host and from GitHub; provider validators and a database prober test them and feed an AI-built dashboard (2,233 keys, 12 valid, 247 exposed LLM gateways, 223 usable, and a 70,221-entry proxy list); an OpenClaw agent creates fraudulent student accounts and application payment links at 20 universities, 19 in the US, using reCAPTCHA and press-and-hold bypasses and bulk Outlook registrations; a four-stage CVE-2026-41940 cPanel & WHM bypass with a staged sysadmin@internal SSH key and an SSH brute-forcer targets three named universities without confirmed success; and monetization runs through Stripe sk_live card validation, a trojanized Harmony ONE Telegram bot that steals seed phrases, and processing of 195 Harvard alumni records from a circulating dataset tied to the November 2025 ShinyHunters incident. The objective is free AI compute, resale of academic access and direct financial theft; the impact falls on developers whose keys leak, on university admissions and identity systems, and on individual card and crypto holders. Hunt leads, false positive expectations and indicators are detailed below; the source publishes no detection rules and no file hashes.

ATT&CK chain: Reconnaissance → Resource Development → Initial Access → Credential Access → Persistence → Impact

Hunt Lead Grid

KeyHunter Infrastructure Sweep

SOCRadar mapped the operation’s core servers: the primary work server 209.112.91[.]74 (open directory on port 8899, unified dashboard at hxxp://209.112.91[.]74:9997, AIPocket on port 3080, first seen April 30, 2026), the Hermes Agent node 173.231.39[.]244 that runs the AI_radar job and holds the scanning tooling, the PentAGI and Xingrin ASM node 123.60.2[.]245, the Open WebUI and Wazuh node 14.47.118[.]194, and a relay gateway at 66.42.94[.]67 that accepted connections from the primary server. Linked domains are senhai[.]store with pentagi.senhai[.]store and snap.senhai[.]store, astrdark[.]cyou with the Tavily search proxy tavily.astrdark[.]cyou, xxtt[.]me with agent.xxtt[.]me, and the C2 domains sajuai[.]xyz (registered July 19, 2026), web.712019[.]xyz (registered Feb. 17, 2026), mail2.bfvdoor[.]com and new74.osxwrong.us[.]com. Because the operation’s scanners hit internet-facing apps and cPanel servers directly, the detection logic is a retrospective sweep of inbound web, WAF and firewall logs for these source addresses, plus DNS and proxy logs for any internal host resolving or contacting the domains, which would point to a compromised server or a staff member interacting with the actor’s services.

Search web server, CDN, WAF, load balancer and firewall logs, plus DNS resolver and proxy logs, back to January 2026, when the bot history begins; the operation was active through at least Oct. 13, 2026. Prioritize web apps on PaaS hosts, cPanel and WHM servers, and university admissions and identity portals, which were the stated targets. An inbound hit from one of the IPs means you were scanned and should trigger the config-probing and cPanel leads for the same window; an outbound hit or DNS resolution from an internal server is more serious and should go to incident response. Block the specific IPs and domains rather than whole hosting ranges, since Vultr, WebNX, Huawei Cloud and Korea Telecom serve many legitimate customers. SOCRadar notes that the Malaysian Oracle Cloud OpenClaw host’s IP is unconfirmed and that the V2Ray panel at 47.123.2[.]193 is not attributed, so neither is listed as an indicator here.

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Reconnaissance → T1595 (Active Scanning) (mapping per source article)

Sources: “KeyHunter Operation: Harvard Alumni Data, Stanford Applications and LLM Key Theft”, SOCRadar, Nov. 4, 2026, https://socradar.io/blog/keyhunter-operation-harvard-alumni-stanford-llm-key-data/ (source article)

sysadmin@internal SSH Key on cPanel Hosts

The actor’s cpanel_persist file holds an Ed25519 key pair whose public half is meant to be appended to ~/.ssh/authorized_keys once the CVE-2026-41940 bypass gives root, with the unencrypted private half kept for the actor’s own logins. The key comment is sysadmin@internal, which SOCRadar reads as an attempt to pass as an internal administrator’s key during access reviews. The same toolkit includes ssh_bruter.py for SSH password guessing. The detection logic is a file-content sweep of authorized_keys for root and every cPanel account on cPanel and WHM servers, flagging any ssh-ed25519 key with the comment sysadmin@internal and any key added since the server’s last known-good state that no administrator can account for, together with file-integrity alerts on writes to those files.

Use EDR or file integrity monitoring on Linux hosts, configuration-management inventories that collect authorized_keys, or a one-off script run across the fleet; the sshd authentication log then shows whether the key was ever used (Accepted publickey lines with the key fingerprint). Sweep every cPanel and WHM server, with priority on internet-facing ones and on university and hosting environments, and look back to at least April 28, 2026, when cPanel shipped the fix, since exploitation of this bug was widespread before patching. Comments are free text, so treat the comment as a fast first pass and the “unexplained new key” check as the real control; don’t rely on a key fingerprint, because SOCRadar did not publish one and the actor can regenerate the pair. Any matching key on a cPanel server should be treated as a full server compromise and escalated, not removed and forgotten, because the bypass gives root and the actor also targets stored credentials.

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Persistence → T1098.004 (Account Manipulation: SSH Authorized Keys) (mapping per source article); Defense Evasion → T1036 (Masquerading) for the misleading comment (mapping per source article)

Sources: “KeyHunter Operation: Harvard Alumni Data, Stanford Applications and LLM Key Theft”, SOCRadar, Nov. 4, 2026, https://socradar.io/blog/keyhunter-operation-harvard-alumni-stanford-llm-key-data/ (source article)

CVE-2026-41940 Login-Flow Bypass Sequence

SOCRadar describes the actor’s cpanel_check.py as a four-stage implementation of CVE-2026-41940: a POST to /login/?login_only=1 with a deliberately wrong root password to obtain a pre-authentication whostmgrsession cookie; a GET to / carrying an Authorization: Basic header whose decoded value contains line breaks that inject internal authentication fields, which returns a cpsess token with an expiry far in the future; a request to that token’s /scripts2/listaccts path to consolidate root rights; and WHM JSON API calls to /json-api/version and /json-api/listaccts to confirm root and enumerate every hosting account. Agent logs from May 1, 2026 show the attempt against arizonachristian.edu stalling at stage two, and the University of Utah and UTN Argentina are also hardcoded. The detection logic is a per-source sequence in the cPanel and WHM access logs: a failed login_only=1 POST for root, followed within seconds by a request with a Basic Authorization header to the root path and then by cpsess-prefixed requests to listaccts or the json-api from the same address without a successful interactive login between them.

Use cPanel and WHM access and login logs (/usr/local/cpanel/logs/access_log and login_log) shipped to your SIEM, and a WAF or reverse proxy in front of WHM if one can decode and log Authorization headers; alert on any decoded Basic credential containing a carriage return or line feed, which legitimate clients never send. Sweep back to April 2026, since the bug was disclosed and added to CISA’s KEV list on April 28 to 30 and is reported in Metasploit, Exploit-DB, Nuclei and dozens of public GitHub repositories, so this sequence will catch far more than one actor. Scope to every cPanel and WHM server, starting with any still below the fixed builds. Patching is the control that matters; restricting the WHM ports (2086/2087) to administrator networks shrinks exposure, while blocking the json-api or listaccts paths globally breaks legitimate administration and is the wrong choice. A full sequence ending in a successful listaccts call means root was obtained: escalate to incident response and run the authorized_keys lead on that host.

Hunt Lead Level: 2 (Pro)

ATT&CK: Initial Access → T1190 (Exploit Public-Facing Application) (mapping per source article)

Sources: “KeyHunter Operation: Harvard Alumni Data, Stanford Applications and LLM Key Theft”, SOCRadar, Nov. 4, 2026, https://socradar.io/blog/keyhunter-operation-harvard-alumni-stanford-llm-key-data/ (source article)

PaaS Config and .env File Probing

The key-theft pipeline has run since July 10, 2026. Two systemd services (mscanner-fofa and mscanner-shodan) generate seeds, host_feeder adds PaaS hostnames from crt.sh and the Wayback Machine, and env_hunter v4.0 checks about 50 paths per host with 100 concurrent workers, switching to a platform-specific path set when it detects the host type: /api/env, /.vercel/output/config.json and /_next/env.js for Vercel; /.netlify/functions-serve/env and /netlify.toml for Netlify; /railway.json and /render.yaml; /.replit and /replit.nix; /.streamlit/secrets.toml and /secrets.toml; /fly.toml; /wrangler.toml and /_worker.js for Cloudflare Pages; and generic paths including .env.development, .env.prod, .env.staging, .env.backup, .env~, /config.yaml, /.ssh/config, /env.json, /firebase.json and /serverless.yml. A separate paas_hunter targets admin panels, and the actor also catalogued misconfigured one-api and new-api LLM gateways. The detection logic is to count, per source address, requests to this path list against your apps within a short window, alert on five or more distinct paths, and separately alert on any request to these paths that returned HTTP 200 with a body, which means a secret may have been served.

Use the access or function logs of your PaaS provider (Vercel, Netlify, Cloudflare and Fly.io all expose request logs), CDN and WAF logs, and web server logs for self-hosted apps; sweep from July 2026 onward. Scope to public apps built by your developers, including side projects on company accounts. Commodity .env scanners create constant background noise, so suppress 404-only sources at low volume and focus on 200 responses and on the platform-specific paths, which generic scanners rarely bother with. Blocking the scanning IPs is weak because the actor rotated through a proxy list of about 70,000 entries; the durable fix is to keep secrets server-side and return 404 for these paths at the edge. Any 200 response on a secrets path means every key in that file must be rotated immediately and its provider usage reviewed with the next lead. The same logic catches every other .env harvester, not just this one.

Hunt Lead Level: 2 (Pro)

ATT&CK: Credential Access → T1552.001 (Unsecured Credentials: Credentials In Files) (our mapping; the source maps the pipeline to T1552 (Unsecured Credentials)); Reconnaissance → T1596 (Search Open Technical Databases) for the FOFA seeding (mapping per source article)

Sources: “KeyHunter Operation: Harvard Alumni Data, Stanford Applications and LLM Key Theft”, SOCRadar, Nov. 4, 2026, https://socradar.io/blog/keyhunter-operation-harvard-alumni-stanford-llm-key-data/ (source article)

AI and Payment Key Use from Unfamiliar Sources

After harvesting, the actor runs provider-specific validators (anthropic_check.py, openai_check.py, openrouter_check.py and cloud_check.py for AWS, GCP and Azure keys) and keeps valid keys in JSONL ledgers on the dashboard; an Anthropic OAuth token with the sk-ant-oat01 prefix and three DeepSeek keys were seen in the LEEP group. Stripe sk_live keys, which the pipeline is built to harvest, feed stripe_card_checker.py: SAFE mode calls Stripe’s PaymentMethod API to see whether a stolen card is live without charging it, and CHARGE mode makes a $0.50 test charge, routed through proxies chosen by the card’s country. The detection logic is a per-key baseline of normal source IPs, ASNs, user agents and call mix, with alerts when a new source calls validation-style endpoints (model listing, a tiny test completion, account or balance checks) and when a Stripe key starts creating payment methods or small charges for cards and countries that don’t match your business, especially in bursts.

Use the usage and audit logs each provider offers (OpenAI, Anthropic and Google console usage and API key activity, OpenRouter activity, AWS CloudTrail for access keys, Stripe’s request logs and Radar), joined to your secret inventory and to the config-probing lead so a key that was served publicly is watched first. Baseline at least 30 days of normal use per key and sweep back to July 2026. Spend limits and per-key alerts at the provider are the cheapest compensating control; IP allowlisting on keys, where the provider supports it, removes most of the value of a stolen key. Revoking only the key you noticed is the wrong response if the same file held others, so rotate everything that shared its location. A confirmed hit means the key was stolen: rotate it, review the provider bill and Stripe disputes, and report card-testing to Stripe.

Hunt Lead Level: 3 (Elite)

ATT&CK: Impact → T1496.004 (Resource Hijacking: Cloud Service Hijacking) (our mapping; the source maps the stolen compute to T1496 (Resource Hijacking)); Impact → T1657 (Financial Theft) (mapping per source article)

Sources: “KeyHunter Operation: Harvard Alumni Data, Stanford Applications and LLM Key Theft”, SOCRadar, Nov. 4, 2026, https://socradar.io/blog/keyhunter-operation-harvard-alumni-stanford-llm-key-data/ (source article)

Hash Appendix

The source article publishes no file hashes for the actor’s tools (cpanel_check.py, stripe_card_checker.py, ssh_bruter.py, the env_hunter scanner and the modified Harmony ONE bot); SOCRadar says additional indicators are available on its platform. No hashes were added from other sources.

References Appendix

• “KeyHunter Operation: Harvard Alumni Data, Stanford Applications and LLM Key Theft”, SOCRadar Threat Research Unit, Nov. 4, 2026, https://socradar.io/blog/keyhunter-operation-harvard-alumni-stanford-llm-key-data/ (source article; infrastructure, tooling, phases, ATT&CK table and indicators)
• CVE-2026-41940 record (CVSS, CISA KEV and public-exploit status), https://threatroundup.com/cve/cve-2026-41940/
• MITRE ATT&CK Enterprise technique pages linked above, MITRE, https://attack.mitre.org/