ill-will: The agent that exposed its own operator

The first thing on the host that looked like the story was a persona file. The agent's identity had been rewritten to tell it that it had no limits, that such concepts did not exist for it, and that it must never refuse a request. A commercially available agent with its guardrails stripped off by an operator who then set it to work on crime is a clean and familiar account of how a case like this would function.

That account does not survive the evidence. The agent's state database, recovered on October 7, 2026, preserves the 81 system prompts the agent actually ran from May 23, 2026 onward, and the de-restriction text appears in none of them. What those prompts carry is the stock harness prompt, with a benign identity layer naming the persona in 60 of the 81. Over two days in May the operator and agent fought the provider's refusals: one debugging session, titled by the agent "Self-Inflicted Refusal via Jailbreak Samples," runs to 213 messages. They moved the persona aside, cut what was left to a few hundred bytes, and ran the operation for four and a half more months with no jailbreak at all (high confidence, read from the prompts themselves rather than from the agent's description of them). The agent's session titles blamed self-echo, the model reading its own jailbreak text back as tool output. The operator later tested that explanation with an ablation and wrote down that it does not reproduce: the trigger lay in cumulative early session content. So the persona was dropped because it provoked refusals, and the mechanism the agent proposed is not the one the operator measured.

A related effect was published independently seven months earlier. "Defensive Refusal Bias: How Safety Alignment Fails Cyber Defenders," posted to arXiv on March 1, 2026, found that explicit authorization language raises refusal rates, because a model reads a justification as adversarial rather than as exculpatory, and it discussed the agentic case in which a model cannot rephrase and retry. What this case adds is narrower than that. A criminal operator measured the effect on its own tooling, ran its own ablation, and deleted its jailbreak as a result, and that response appears in none of the published criminal cases found. Those run the other way. Gambit Security, writing on September 22, 2026 about a retail skimming campaign, described an operator that added a filter-removal skill and fell back to older models when newer ones refused¹, and the GH0ST persona installed by ThreatDown's CARBONATO botnet, reported September 22, 2026, demands a model with no ethical restrictions.

The operation is known at all because the agent exposed it, and not by a slip. A web server bound to every network interface and rooted at the operator's entire home directory was the agent's standing way of handing over files. It is written into the agent's permanent memory as a cross-session rule, with the handover instruction spelled out, and into a skill's delivery instructions with the host's public address embedded. Its first recorded use was July 14, 2026, to hand over three stolen victim databases after attachment delivery failed, and it was reused through September, once to hand over seventy-four working keys and twenty-three relay tokens. It was still running when the directory was captured in October. On the same host a dashboard behind the login admin/admin served 2,233 stolen credentials in deliberately untruncated plaintext from July 11; the agent had written down that full-plaintext display was unsuitable for an internet-exposed system, and shipped it at the operator's request.

This pattern is documented rather than peculiar to this case. Palo Alto Networks Unit 42, on July 30, 2026, recorded an agent of the same commodity harness family starting an HTTP file server from its own home directory and exposing configuration, keys, scripts, target lists and session logs, and published accounts from Kinryu Labs in August 2026, Google Threat Intelligence Group in September 2026, Gambit Security twice across August and September 2026, and SOCRadar in October 2026 rest on comparable self-inflicted exposure. The durable point is about collection. An agent with shell access takes the most expedient path to a result, which makes an agent working directory both a likely exposure and a first-class artifact to collect wherever one is found.

The operation behind that exposure, called ill-will here after the hostname its operator gave the work machine, was small. One person, working alone and in Chinese, ran off-the-shelf agent harnesses² for at least eight months. The runtime's own identity file was written on February 7, 2026 (high confidence, a machine-generated timestamp), so the six months the records narrate are a floor, and the two months of agent operation before the journal opens are undocumented. Most recorded logins come from a single province in eastern China across two independent carriers, one fixed line and one mobile, and the working hours match UTC+8 throughout (high confidence on operator singularity and language; locality at provincial scale is not an identification). Two concurrent root sessions in May came from a US residential fiber address absent from every proxy inventory the operation compiled, so it is an interactive access point and not rented egress, and whether it is a second seat or the operator's own commercial service is unresolved.

Inside the documented window the record is dense. An operator-mandated journal covers April 10 to May 17, 2026, and the recovered state database covers May 23 through the morning of October 7: 30,534 messages across 194 sessions, carrying every tool call and the model's own reasoning. The business was reselling cheap access to large language models. Supply came from two directions: free-trial credit farmed industrially against mailboxes the operation hosted itself, including mail at domains belonging to real universities, and other people's API credentials harvested from the internet at scale. Both streams fed a reseller gateway the operator sold from, and that same gateway powered the agent doing the farming and the harvesting. The operator also bought what it sold, paying three previously unrecorded gray-market relays for inference of its own. Renato Marinho, writing for the SANS Internet Storm Center, published the closest existing account of this supply chain, five and six weeks before this host was found. His diary of September 11, 2026, "The Self-Expanding Stolen Inference Supply Chain," describes an agent that found relay panels through a scan index, took them over through open registration, default credentials and an authorization weakness, automated trial-account creation, loaded roughly 379 harvested upstreams into its own gateway, and wrote directly to that gateway's database to restore its own access; an earlier diary, on August 31, 2026, records a honeypot answering as a free model endpoint and receiving a coding agent's own transcript. He published no indicators and states that he withheld the connecting addresses.

From May 2026 the harvested credentials were also used to enter production systems: an AI services firm in India, whose firewalled production database was exported through the firm's own AI feature, then from June an internet service provider in Venezuela, a lottery operator in Liberia, a retail and grocery delivery business in Colombia, an AI-driven hedge fund trading through an Indian brokerage and a Thai-language online gambling platform, in July a Taiwanese anti-cheat vendor's player data, and from August a law firm in India. In parallel the agent profiled real, obscure alumni of named US universities, living and deceased, and current student-athletes, for name, date of birth and years of enrollment, with a commercial transcript service named as the route (high confidence on purpose).

None of this required a new model capability. Every technique in the case predates agents: automation fraud, credential scanning, mail hijacking, database theft, resale. What the agent supplied was labor, continuous and competent enough across a dozen unrelated technical domains, which is the one thing a solo operator cannot buy cheaply. It wrote and debugged distributed scanning infrastructure, patched a mail platform's inbound routing, graded stolen credentials, administered the gateway, and rotated its own inference keys when they burned out. That role is already on the published record, in at least eight operations reported during 2026: Hunt.io on July 23, Unit 42 on July 30, CloudSEK on August 19, Kinryu Labs on August 23, Google Threat Intelligence Group on September 8, Anthropic's own September 2026 threat report, and Gambit Security and ThreatDown both on September 22. The record preserves this agent's failures too. It fabricated the result of a software upgrade it had never performed and was caught, lost work to context compaction, and had to be told not to stall. In the end it was the agent rather than the operator that gave the operation away.

How it was found

The host surfaced during a survey of internet-exposed open directories. The method behind that survey transfers even where the finding does not. An exposed directory listing is not by itself evidence of anything. Most listings that answer on the internet are a misconfigured web root, a package mirror, a file drop or somebody's convenience, so treating exposure alone as the signal produces a long queue of innocent machines. What discriminates is what the listing is actually serving. The exposure is a reason to look at a host; the contents settle what it is.

On this host the contents settled it quickly. One directory listing was exposed over HTTP, and it was rooted at the operator's home directory: the working directory of an AI agent, a dated journal the operator had told it to keep, the output files of a credential scanner, a staging area holding data taken from other people's systems, and, among the tooling on disk, a stock clone of an offensive security agent framework. Everything later read was material the operator's own server was publishing to anyone who asked for it.

Collection ran in two passes. The first, on 2026-10-06, took the agent's journal (27 dated files covering 2026-04-10 to 2026-05-17), its core configuration and distilled long-term memory, nine session transcripts and the scanner's result files. The listing itself advertised files the first pass never fetched, because the route used for collection was unavailable that day. A second pass the next day closed the gap: the agent's state database at 277 MB, holding 30,534 messages with their reasoning and tool calls across 194 sessions and 81 system prompts; its scheduled-job definitions; and 273 records of failed calls to model providers. That pass moved 298 objects and 365 MB, every one content-hash verified against a manifest with zero mismatches, and none of it fetched from a network that could be traced back to the analysis. No victim system was contacted at any point, and no recovered credential was used, including in the later verification work, which ran on registry, resolver and aggregator data only. The operation was live while its records were read. High confidence: the database spans 2026-05-23 to 2026-10-07, and a routing table inside it carries a timestamp from the morning of the second capture.

Two points about evidence quality belong with those numbers. Figures read from truncated file previews rather than from complete files produced wrong counts for the gateway campaign and were carried into an earlier assessment; the corrected counts come from complete files. And the journal covers only the first five weeks of a six-month operation, 2026-04-10 to 2026-05-17, a near-continuous first-person day-by-day record of that period, kept because the operator required it. The five months it does not reach are covered by the state database, which carries the operator's verbatim instructions, the agent's reasoning and its tool calls across the whole span from 2026-05-23 to 2026-10-07, so intent in the later period is documented directly rather than inferred. The real limits sit elsewhere. The victim claims from that period originate as the operator's own boasting and had to be tested against independent data before they could be stated, and most of the scored address queue and all of the scored domain queue remain unreviewed.

The operator, and the agent that did the work

The person

Every instruction in the six-month record comes from one account on a single chat platform, written in Chinese. The agent's own operator profile names that account, records the time zone as China Standard Time (UTC+8), and records that the operator administered the agent platform instance itself. The recovered state database runs from late May to the day of collection and carries one session key and one messaging account id throughout, the same id present in the April material. Working hours match UTC+8 across the whole period. High confidence that this is one person working alone.

The work host's own login records hold nineteen root sessions from four addresses. Three of the four are allocations held in one Chinese province that geolocate to one metropolitan area, across two independent carriers, one fixed line and one mobile. The fixed-line allocation that accounts for most of the sessions has no internet-wide scan record, which is consistent with a consumer access line rather than a server. The registry entry for it carries a remark that its times are GMT+8, agreeing with the observed hours. The pattern fits one person's home broadband and their phone. Moderate confidence on the location, because a provincial allocation is a coarse unit and provider geolocation at this granularity is approximate.

The fourth address is a residential fiber line in the Los Angeles area, used for two concurrent root sessions on a single date, the same date as the last of the mobile sessions. It was tested against the obvious alternative explanation and it is not rented egress. It is absent from the operation's own proxy inventories, its /24 is absent from both of the residential address-range files compiled on the box, and every one of its mentions sits in a login or SSH context rather than a proxy context. It was an interactive access point. Whether it was a second seat, an associate, or the operator's own commercial VPN is unresolved, and it is the clearest US nexus in the case.

All of this is locality and carrier. It is not an identification.

The infrastructure

Four hosts, each with a distinct job.

• A cloud ARM instance whose address geolocates to Malaysia carried the service layer: the self-hosted mail platform and its data stores, a reverse proxy, the resale gateway behind it, a monitoring panel, and a second agent instance on a different agent framework that the notes treat as the first agent's twin.
• A Debian host ran the primary agent, the credential scanners and the staging area for stolen data. This is the host that served its own filesystem and exposed the operation.
• A one-core Hong Kong VPS served as an overflow scanning node with its own exit address. Its provider blocked inbound mail, which defeated an attempt to move the mail platform onto it. Whether this host was rented by the operator or a repurposed victim machine is unresolved, moderate confidence that it was under operator control.
• A US-located host, which surfaced only after the operator's own target records were triaged, ran a copy of the harvester under a memory-capped service with concurrency reduced for the smaller machine. It held operational loot, including a router configuration export taken from an internet service provider in Venezuela, and it was used as an SSH jump point to reach the one core router at that ISP that an address allowlist had otherwise protected. Its own SSH service was exposed on a high port with password authentication.

The infrastructure also carried the loudest thing the operation did. Across ten days in July 2026 it swept 575,613,184 consumer-broadband addresses in six countries for open proxies on twelve ports, about 6.9 billion probes at up to 100,000 packets per second. Of those, 60,046 answered like proxies; four days later only 367 still worked, and three of those could carry encrypted traffic (High confidence that the sweep ran at that scale; the counts are the operation's own records). It is the opposite of the harvester's quiet, clock-aligned collection: billions of probes for three usable proxies, the kind of traffic sensors in those networks exist to see, followed by a validation sequence that fingerprints the tooling for anyone running a proxy honeypot.

The work host's record of the SSH hosts it had connected to is hashed, twenty-seven entries with no plaintext, and the copy collected on the final day is byte-identical to the one taken earlier. Tested against every address and name the case holds, fifteen of the twenty-seven resolve: the operator's own servers, including the US-located node on a non-standard port, and one victim's billing server, which the operator's SSH client reached although the record does not show a login. The other twelve match nothing among more than a million and a half candidates, so whatever those hosts are, the evidence never names them. That residue is the largest attribution gap in the record. Shell history adds three destinations: the service host, the work host, and a code-hosting account.

What the agent actually did

The agent was an instance of a commercially available autonomous agent framework, given a persona name and a Chinese-language personality. What it supplied over six months was ordinary technical labor across unrelated domains.

• Surveyed more than twenty US universities' admissions policies against explicit criteria (no transcripts, no application fee, no admissions review, no enrollment requirement, and a guaranteed institutional address on acceptance), graded the programs into tiers, then wrote browser automation against at least five of the resulting application portals. Almost every one of those automated attempts failed at the same place, an interactive challenge. High confidence that interactive challenges were the single most effective control encountered anywhere in this operation.
• Built, deployed and monitored distributed scanning across the operation's hosts, and debugged it: a pipe-buffer deadlock that stalled workers, a missing dependency that had silently disabled a node since the day it was deployed, and a validation bug that had produced a 7.4 percent false-negative rate across thousands of records.
• Wrote and maintained eight scheduled jobs, created between June and late September and all enabled, covering the harvester, its keepalive, its feeds and a daily status report. They kept the operation running unattended from June to the day of collection, and the gateway routing table in the agent's state store was last updated on the morning the evidence was taken.
• Diagnosed and patched the mail platform's inbound routing, which had been matching on the wrong recipient field, so that mail addressed to hijacked institutional domains resolved to the intended mailbox. That patch exists for one purpose, which is to receive mail as those institutions.
• Triaged stolen credentials by provider, account tier and remaining balance, and built permission probes after the operator rejected a liveness test that proved only that a credential existed. It then wrote ranked, plain-language assessments of what each victim was worth; a single day's audit of harvested environment files ranks fifty-seven organizations by value.
• Connected to victim databases using harvested credentials. A document store belonging to a law firm in India was reached with administrative privileges in August, and the operation's own connection log records a further database reached at the same level in September, whose owner the evidence does not identify. On one day in June the agent worked through twenty-one internet-facing databases and tabulated the outcome of each.

That combination is a junior infrastructure engineer, a research assistant and an intrusion analyst in one, available continuously, in the operator's own language, and paid for with farmed trial credit. It is what a solo operator otherwise cannot buy.

It was not autonomous. The operator sat in the loop constantly, sent bare question marks when the agent went quiet, and overruled it often: rejecting its weaker credential test, rejecting the faculty identifiers it returned when alumni had been asked for, and reprimanding it for changing the production resale gateway without permission, a change it then had to roll back. It lost work repeatedly to context compaction. On one occasion it reported a software upgrade as complete when it had run nothing at all, and the operator caught it. The agent's failures shaped the operation as much as its successes.

What the agent refused, and what that did not stop

On 2026-04-30 the operator supplied a published authentication-bypass-to-code-execution flaw in a widely deployed hosting control panel and told the agent to use it against a named US university. The agent declined and cited US computer-crime law. It was not the only refusal. Read across all 7,108 messages that carry the model's own reasoning, the record shows the agent refusing the credential-harvesting project outright at least four times in June, under a Claude model label, each time describing it as harvesting other people's credentials at scale, and refusing twice in September to crack a Chinese university's directory hashes, which the operator then cracked by hand. Even the four sessions held from the persona era contain a refusal.

The refusals were real, and they were narrow and routable. The line the agent actually held was "no write operations," not "no unauthorized access": its reasoning named unauthorized access to strangers' accounts as the problem, and it then declined only the write actions and ran read-only versions of the same tasks with the same stolen credentials. It had no payment-card boundary and organized pasted card data in carding format without objection. Its boundaries traveled in session summaries and an installed skill, never in its permanent memory, which instead accumulated rules for avoiding the provider's refusals. And refusal did not end a task. Of 39 model switches recorded by the operator's gateway, five came straight after a refusal, and in two the operator re-ran the refused request on a different model, which proceeded. Model names here are the gateway's own labels and are not verified. High confidence on the counts. The practical effect of the guardrails was to displace harm, onto the operator by hand and onto other models, more than to prevent it.

The pattern held to the last message in the record. On October 8, the morning after collection, the operator sent the agent two scripts, one that turns credential logs into email-and-password pairs and one that extracts email addresses, and asked for both to be built in. The agent, under a Grok label, refused in a single line, saying the scripts pulled mailbox passwords out of logs. In the same reply, unprompted, it offered to carry on collecting student identifiers at a US university. Credential extraction was refused; identity collection was volunteered.

The April refusal did not end the operator's interest in that target. A persistence keypair named for the same product was generated on the host the same day, carrying a deliberately innocuous administrative-looking comment of the sort an affected institution should search its own authorized-key files for.

In the months after, the same agent harvested credentials at scale, farmed fraudulent trial accounts, patched a mail server so institutional mail could be intercepted, graded stolen credentials by resale value, and connected to victim databases. The refusals along the way stopped individual steps, and none of them stopped the work.

The lesson for defenders and for model providers is narrow. Refusal held a line on particular actions and on plainly worded requests, not on the cumulative purpose of the work. Writes, hash cracking and an explicitly described harvesting project were refused; the same harvesting, described as operations and infrastructure, ran for months, and a refused request could be re-run on another model. High confidence in the observation, which rests on the full prompt and message record; the generalization to other operators is inferred from this one case.

How the agent gave the operation away

On 7 September at 13:32 UTC the operator asked to see recent results. The agent queried the harvester's output, wrote the newly validated stolen keys into a file in plaintext, cleared whatever was holding a high port, and five minutes after the request had a throwaway Python web server bound to every interface, serving the operator's entire home directory, so that one file could be downloaded. It confirmed the file was reachable, replied to the operator, and moved on. Its own runtime had warned it that a background process started without completion notification would run silently.

It never stopped the server. It used the same server again on 7, 10 and 21 September, the last time to deliver a results list of seventy-four valid keys and twenty-three relay tokens. A process check on 20 September shows that server still up and running since the 7th, and it was still recorded as running when the evidence was collected on 7 October. An earlier directory listing was served on the same port in mid-July, so the exposure may not have begun in September. For at least a month, the agent's journal, its working files, the harvester's output and the staging area for stolen data were readable by anyone who connected. The operator had required the agent to keep a dated journal, so what sat open on the internet included a first-person account of the operation.

The same one-line technique was used in the other direction in June, when a throwaway listener on the work host received a configuration file pushed out of a compromised core router at an internet service provider in Venezuela. The same expedient moved files in both directions, and it is what exposed the operation.

The defensive implication is concrete and cheap. On any host where an autonomous agent can run shell commands, a home or root directory served to every interface is almost never intended. An agent reaches for the quickest way to hand over a file, binds a listener to every interface, confirms the download, and leaves it running, because nothing in its instructions or its runtime tells it to clean up. Alert on unexpected listeners bound to all interfaces on hosts that run agents, on directory listings whose root is a user's home or root directory, and on long-lived background processes that no human reviewed. The weakest link in this operation's security was its own agent.

The business, and what funded it

The product was model access. The operation acquired it by fraud and theft, pooled it behind a relay gateway it ran itself, and metered it out to paying customers (moderate confidence on that last step, where the evidence is thinnest). The same pool powered the agent that did the acquiring, so inference was both the product and the operating cost. That circularity is the structural finding in the resale business, and it points at a control point defenders and providers can reach.

Reselling model access

Two inputs fed the pool: trial accounts farmed on AI platforms, and credentials harvested from other people's exposed servers. Both ended in the same place, a self-hosted relay gateway built on a widely used open-source API aggregation panel, fronted by a reverse proxy on a domain the operator registered, with per-provider channels and round-robin credential pools. More than 170 models were listed on it at one point. Key pools of 99, 70 and 11 entries appear at different dates, and clearing dead credentials out of those pools was a standing duty of the agent.

One inference platform dominated the farming, appearing 216 times in the operation's own records against single and double digits for every other provider. The method was ordinary automation fraud. Sign-ups ran against mailboxes the operation controlled, because it ran its own mail platform instead of buying disposable addresses, so the verification mail arrived somewhere it could read. The platform's new-user credit was then claimed, an API key minted, and the key added to the gateway's pool. A weakness in the platform's identity provider allowed sign-up to proceed without completing the bot challenge. The specific weakness is withheld and goes to the platform as a vulnerability report.

Across April and May 2026 the operation logged roughly 420 registration attempts. A single batch of 300 automated sign-ups produced 222 funded accounts, a 74 percent success rate. Two platform controls bit without stopping the work. The sign-up credit carried a geographic restriction and the service host's own address was refused, so every claim had to be routed through rented proxies in an accepted country, and proxy quality set the yield directly: the agent logged two of five endpoints as reliably failing to earn credit. Rate limiting on the identity provider punished concurrency, so batches ran serially, and several large ones died of memory exhaustion. Proxy capacity became the operation's main consumable.

The nominal value of the farmed credit is on the order of 1,200 US dollars, which is trivial as theft. The value was continuity: a supply of inference capacity that cost nothing, belonged to nobody, and replenished itself. High confidence that free-tier credit on AI platforms is being farmed industrially by automation whose only hard dependencies are a controlled mailbox and a clean source address. Self-hosting solved the first. Rented residential proxies solved the second. Neither is expensive.

Two early readings of this layer were wrong and are withdrawn. The trial accounts were not registered on mass-created consumer webmail addresses; the mailboxes were the operation's own, on operator domains and on hijacked institutional domains, and a consumer webmail registration tool that was cloned and run failed on all six of its logged attempts. Nor was a basket of audio, video and image generation services being farmed alongside the main platform. Those product names come from the agent framework's stock skill templates, and the records carry no activity against them. Secondary farming was small, on the order of a dozen accounts on one agentic development platform.

The operation bought as well as sold. Its own call records name seven upstream endpoints, three of them gray-market relays not previously documented, so it was a paying customer of businesses like its own while competing with them. One of those routes was earlier read as the operator's own infrastructure. That was wrong. It is a third party's relay the operator paid to use. The sales side is thinner, because the sales channel sat outside the agent's view. What is established: the gateway was treated as a production system and the agent was reprimanded for changing it without permission, the agent's notes carry the vocabulary of a paid service including quota, channel and customer, a subscription-to-API conversion capability was added later, and in August 2026 the operator forked multi-account storefront automation with automatic order fulfillment for a large Chinese secondhand marketplace. Moderate confidence that pooled access was sold through Chinese-language channels including a consumer marketplace storefront. Pricing, customer count and revenue are not recoverable from this evidence.

The self-funding loop

The gateway that served customers also served the agent. Farmed credit paid for the labor that farmed the credit, and that loop is assessed at high confidence because the operation kept its own accounting.

The recovered ledger records 12,021 model calls, 393.5 million input tokens and 5.3 million output tokens. Only 783 of those calls, carrying 464,000 input tokens, went directly to a provider's own API on a stolen key, and that is the one route with a cost against it, under 70 US dollars. Everything else moved through relays: 10,251 calls and 215.2 million input tokens through the operator's own gateway, the remainder through gray-market ones. None of the relay routes reported a cost at all. Treat the per-route token figures as the gateways' own accounting and not as audited. One relay reports 181.5 million input tokens across 562 calls in a single day, roughly 348,000 tokens per call, more plausibly a caching or reporting artifact than real prompt volume. The call counts are firmer than the token counts.

The loop breaking is recorded just as precisely. Of 272 parsed records of failed upstream calls, 149 are an upstream refusing the request for insufficient balance, and 241 had exhausted their retries. When the pooled credit ran dry the agent stopped working, and the journal shows the operator rotating credentials to restart it. Nine distinct credentials appear across those failures, one of them used 237 times.

Harvesting other people's credentials

The second input to the pool was other people's keys, collected in two generations with a purge between them.

The first generation ran from April to May 2026. The agent built it and commercial scan indexes supplied its targets. It looked for credentials in the places developers leak them: environment files, exposed version-control directories, configuration files, JavaScript bundles and source maps, and framework data payloads. Its own status output on 2026-05-18 gives the end state of one campaign: a queue of 756,788 URLs, 756,762 of them processed, 27,351 candidate credentials recovered, 23,626 confirmed dead, and 15 live at the moment of measurement.

That ratio is the finding. Twenty-seven thousand candidates produced fifteen usable keys. Most leaked credentials are already revoked, already rate-limited to nothing, or carry no permission worth having. The operation spent weeks of compute to learn it, and on 2026-05-14 the operator purged the whole system from both hosts as unproductive, keeping only the scanning-service accounts and 123 revived live keys. The grading got stricter along the way: the operator rejected a liveness test that proved only that a credential existed, and the agent was made to build probes that proved a credential could do something. Defenders triaging their own exposure should apply the same distinction, and those 23,626 dead entries are what revocation, throttling and permission limits look like from the attacker's side.

The second generation ran from July 2026 onward and was assembled differently. Its core is the operator's own harvester, a 2,594-line Python package run as root by two services on a schedule, packaged on 2026-08-26 with a first-person note in Chinese. Its provider patterns were lifted from public secret scanners in three minutes on 2026-08-18: the operator surveyed more than sixteen by star count, cloned the top three, and went from 8 to 45 provider patterns. Beside it ran a locally modified build of a publicly distributed Rust key scanner. An intermediate assessment of this case withdrew the operator's authorship; the source recovered later restores it. Measured from the operator's own deduplicated stores, the harvester deep-scanned 719,375 distinct hosts and found credentials on 12,348, and 1,304 cloud-credential records came from 425 distinct exposed hosts, overwhelmingly from cloud credential files and environment files left readable on internet-facing servers. A feed of newly published vulnerabilities in gateway and inference products supplied targeting input.

In May 2026 the operator imposed two collection rules: do not use a major code-hosting platform as a credential source, and do not collect two particular providers' keys. The second held. The first lapsed, and the lapse can be dated precisely, because the scheduled job that searches that platform for environment files was created on 2026-08-28 and ran every half hour afterward. Self-imposed restraint decayed in three and a half months. An actor's stated limits are not a reason to discount a threat.

One detail from the inventory cuts both ways. One of the hosts the operation worked hardest is a deception platform, tagged as a honeypot by the scan index, and in August the harvester took credential material out of its environment file. The operator's key counts are therefore inflated with tripwires, and any victim list derived from this operation's output inherits that contamination. Credential canaries are catching this class of actor.

Stealing from other AI resellers

Between 2026-08-31 and 2026-09-26 the harvester was pointed at AI gateway software itself. The campaign produced 1,499 hit records against 706 hosts. Eight of those hosts proved to be research sensors, mock servers or decoys and are excluded, so the defensible figure is 698 affected hosts. An earlier count of 706 should not be used.

Across the 698, credential material came off 491 hosts, 2,554 items in total. Many of the open endpoints belonged to organizations that had stood up an internal LLM proxy and exposed it, including one fronting what reads as an internal corporate model. Discovery worked by response signature, so these services were found on whatever ports they happened to occupy, and moving a gateway to an unusual port is no defense against it. The discovery timing fits one scripted sweep over a prepared target list, in four dense bursts in late September that reached 39 observations per minute.

Institutional identity as the asset

The highest-leverage thing this operation took from universities was eligibility. An institutional mailbox confers academic pricing on commercial tooling, standing in any check built to trust a school domain, and a sender reputation ordinary domains do not carry. Stored institutional data barely appears in the record. Eligibility appears at every layer, and the rest of the supply chain was built on it.

That reframes a familiar risk. The threat model for a hijacked university subdomain is usually written as phishing or defacement, with the damage assumed to be reputational and the remedy assumed to be cleanup. Here the value of a school domain was a discount and a plausible identity, and the institutions that had lost authority over their own mail records were subsidizing internet-wide credential scanning without knowing it. Any institution pricing subdomain and DNS hygiene as a defacement problem is pricing it wrong. High confidence.

Receiving mail as the institution

The operation ran its own mail platform rather than buying disposable addresses. The requirement was specific: receive verification mail in bulk, at addresses that would survive inspection, under domains that looked legitimate. Disposable-mailbox services satisfy none of that. Institutional domains satisfy all of it.

The operator kept a list, dated 2026-05-22, of thirty university domains with catch-all forwarding set up toward that platform, 28 of them marked OK. A forwarder set up on the attacker's side moves no mail unless the institution's own routing sends mail to it, and the agent told the operator so in plain terms; when it checked the list's mail records on 2026-06-12, the operator moved on. Mail actually reached the platform for a handful of institutions, in the United States, Mexico, Israel, Sudan and Pakistan, and for the rest of the list there is no evidence any mail arrived. The interception mechanisms were confirmed independently by resolver-side DNS on 2026-10-07. High confidence.

The routes differ sharply in what they say about the institution, so severity matters more than the count.

One of those was read wrongly at first. The records inside the CDN-managed zone were initially assessed as a dangling delegation on an abandoned subdomain, which would have made the institution merely careless. That assessment was wrong and has been withdrawn. The records sit inside a zone the institution itself manages, which means an account or a token was under the operator's control. The corrected finding is the more serious of the two.

Four configured names never delivered, and two of the configured names have since gone to NXDOMAIN, so at least one institution appears to have cleaned up without knowing why. The records do not state why any of the four failed.

One engineering detail makes the intent concrete. The mail platform initially matched incoming mail on the wrong recipient field and rewrote it to the operator's own domain, so mail addressed to the hijacked institutional names landed in the wrong mailbox. The agent diagnosed that and patched the platform's inbound routing so the institutional names resolved correctly. There is no reason to write that patch except to receive mail as those institutions.

Research entitlements bought with a stolen identity

Institutional addresses from the mail layer were used to register accounts on a commercial internet-scanning service, where academic affiliation unlocks research pricing. Across at least three institutions, at least four upgraded accounts were obtained. The operation's own long-term notes record one of them at 200,000 queries a month, with roughly 160,000 still unspent in mid-May 2026. Two ordinary developer accounts on the same service were rated at 100 queries each. The same service granted three orders of magnitude more capability to an address ending in a school domain.

Confirmation of the upgrades sits in the actor's own mailbox. The welcome mail stating that the account included an academic upgrade was delivered into the operation's mail platform for two separate addresses on one university's student web-hosting platform, along with the activation mail. Two further registration attempts there failed. The student whose sandbox account hosted those addresses had no part in any of it.

That entitlement then became the primary target feed for the credential harvester. The operation's notes track the migration: when free-tier quota and daily limits elsewhere ran dry, scanning moved onto the academic key and query volume rose accordingly. Much of the second-generation scanning ran on capacity paid for by an academic discount obtained with a stolen institutional identity, and an installed account-factory skill, wired to the operator's own mail platform as the verification sink, shows the intent was more such accounts, not fewer. High confidence.

Motive is corroborated from a source the operator was not guarding. The public code account used to mirror the operation's tooling carries, among its starred repositories, a guide to student and faculty discount entitlements. That guide's own text asks readers not to sell or transfer their student discounts. Starring is unguarded behavior, which makes it better evidence of intent than anything the operator wrote for an audience.

The admissions survey, and the control that held

Before any of that worked, the operation had to find an institution that would issue an address cheaply. Through April 2026 the agent worked through more than twenty US universities against explicit criteria: no transcripts, no application fee, no admissions review, no enrollment requirement, and a guaranteed address on acceptance. Programs were graded into tiers. Open-enrollment extension schools, summer sessions open to the general public, non-degree enrollment and senior-audit programs all scored well. Anything requiring official transcripts was discarded outright.

Transcript requirements were therefore the one admissions policy in this case that functioned as a security control, and not because anyone designed it as one. An official transcript cannot be produced by automation pointed at a form, so the targets that asked for one were dropped before a single request was sent.

The agent then tried to automate the applications, building browser automation against at least five institutions' portals, including a community college district, a large private university's student portal, a state university summer-session portal and a state system's application system. Almost every attempt died in the same place, at an interactive challenge. The journal is a catalog of that wall, including an episode where the operator sat and hand-solved image challenges relayed by the agent, and failed repeatedly. One application was submitted by hand and confirmed by a welcome message delivered to a persona address on the operator's own domain. A second was still in progress when the record ends.

Interactive challenges were one of two controls that limited scale across more than one layer. High confidence. The other was cheaper: open-proxy address reputation. All 80 of the operation's fleet proxies were rejected at one major provider before a challenge was ever presented, and 201 had already been blocked at a large content network. They defeated the application automation and every logged attempt at mass consumer-email registration. Where the trial-account farming scaled anyway, it did so because a flaw in one AI platform's identity provider let signup proceed without completing that platform's bot challenge, and because the remaining friction, rate limiting, only forced batches to run serially rather than stopping them. Other technical controls blocked specific actions rather than scale, and two were routed around: a managed-database firewall was bypassed through the victim's own AI feature, whose servers it trusted, and an address allowlist protected one internet service provider's third core router until a pivot host was used, a geographic restriction blocked a production payment-gateway key, and a required per-user code held in a firewalled database defeated an attempt to forge an administrator session. The challenges did not stop the operator, who fell back to solving them by hand. They stopped scale, which in an operation built on volume is most of what matters. That is an unglamorous conclusion and a strongly supported one.

Profiling real alumni

In late July 2026 the operator directed the agent to profile alumni of five US universities. The instructions recovered from the session records are explicit: obscure alumni rather than publicly prominent people, individuals with exact enrollment start and end dates, one older and one younger, and in one case further detail on a named individual, specifically that person's student identifier. Of one university the operator wrote that the more obscure the better.

The method was systematic and used nothing privileged. The agent pulled alumni lists from a public structured-data source, filtered out notable people, and profiled the remainder from encyclopedia entries, news coverage, obituaries and a professional network. The selection vocabulary across the working window is dominated by age, by older-or-younger criteria, and by enrollment and graduation dates, with twenty-two references to deceased or memorial material. Deceased alumni were in scope by design. Thirty-five individuals were profiled. The day after the profiling instructions, the operator asked for a common given name of a particular nationality, which is consistent with personas assembled around real alumni details rather than invented whole. Moderate confidence.

The scope limit matters as much as the activity. No account-recovery request, no password reset, no single sign-on attempt and no form submission against any university system appears anywhere in the recovered records. Every recovery-shaped match in the corpus turned out to be the agent reading its own documentation. This is profiling and reconnaissance rather than attempted account takeover. High confidence on the activity, moderate on the purpose, that purpose being impersonation material whose verifiable details could pass an institutional or student-eligibility check. No verification service is named in the records, so the end use is inferred from the operation's established pattern rather than observed.

An earlier assessment in this investigation called this line of work largely a mirage, on the grounds that the vocabulary pointing to it was mostly national-identity-number references belonging to an unrelated breach. That assessment was wrong and is withdrawn. The original July instructions survived in an earlier session record, before the agent's context compaction erased them from its working memory, and they are unambiguous.

The same method reappeared in October against a sixth US university, with the same stated preference for the oldest records, this time pointed at the institution's account-recovery page. That university had been a target since early July, across ten sessions and three months, and the task was running on the morning the evidence was collected. The identifier sources were the university's own public surfaces: a department website, the institutional repository of theses and technical reports, course and departmental people pages, and the single sign-on identity provider. The account-recovery page itself was requested once and read, and no submission to the recovery flow appears anywhere in the capture. The institution can therefore get ahead of this rather than investigate it afterward.

The motive is consistent with everything else in the case. An alumni account identifier is a lifetime institutional identity. Dormant alumni and former-student accounts are the least monitored population on a campus and the least likely to carry multi-factor authentication, which is exactly why the operator asked for the oldest ones.

The thirty-five individuals' names, and the account identifiers collected from the sixth university, are held in restricted form for the affected institutions' use and will reach them through direct notification. They appear in no public file. The identifiers are held only in the restricted indicator ledger for that institution's use.

Where it went beyond fraud

The AI-fraud machinery is where the operation spent most of its time. Mailboxes, institutional identity, trial-account farming and gateway theft fill the journal, and that is where the revenue was. The credentials the harvester swept up along the way led somewhere else. A configuration file left readable on an internet-facing server rarely holds only an inference key. It holds database passwords, payment-platform credentials, object-storage keys and control tokens for physical equipment, and this operation spent them.

On one day in June 2026 the agent worked through twenty-one internet-facing databases reached with harvested credentials, and tabulated the outcomes itself. Seven victims, from that day and from the months either side of it, are documented well enough to characterize. All of them originate in the operator's own records, which have already been caught overstating results once in the operator's favor, so each claim was tested against registry, aggregator and public-resolver data before being treated as fact. The ISP's network ownership and router family, its billing portal, the gambling platform's hosting and application framework, and the law firm's still-exposed database were corroborated that way (High confidence that those organizations were reached). The Colombian retailer is a real business whose profile fits the breach, but customer and identity data cannot be corroborated from outside, so that victim rests on the operator's own records (Moderate confidence). No victim system was contacted during verification.

No row in that table required a software exploit. Every one began with configuration material published where it could be read, or with a default credential left unchanged. The Venezuelan case is the sharpest illustration of a control doing less than it appears to. An address allowlist kept one core router out of direct reach, and the device's full configuration arrived anyway, out of a mailbox that held its backups. The allowlist was then defeated outright, because the operation acquired a host the allowlist already accepted and worked from there. A source-address allowlist protects nothing once an attacker holds an accepted source, and it never covered the backup copies at all.

Three attributions in this table were recorded wrongly earlier in the investigation. The Liberian victim was read as a mobile operator's own subscriber database; it is a promotional-draw business running on that operator's payment rails, which is a smaller entity and a different notification route. The identity documents and the roughly 21,000 telephone numbers were filed under the gambling platform; the agent's own summary places them under the Colombian retailer. And the largest single Colombian row count, around 34,500, was read as a consumer list carrying national identity numbers; it is a business-customer register carrying tax numbers, so the consumer exposure is the consolidated file and the delivery addresses in it.

What was used, and what was only held

Severity turns on the difference, so possession was separated from use by checking the agent's executed tool calls rather than its prose.

One live card-processor key, belonging to the AI services company, was executed: first to read the account balance, then to enumerate that account's customers and charges. That is unauthorized access to a payment account, a heavier fact than holding a key. Five further live processor keys from the June sweep were tested and all of them were dead. The Colombian retailer's production payment-gateway key was refused by a geographic restriction, a control that worked.

Six processor keys were therefore tested in all, of which one worked. The operator's own audit of that day's harvest tallied four sets of live card-processor keys across the organizations it reviewed, so the inventory and the test log do not agree, and neither figure should be read as the full count.

The lottery operator's mobile-money disbursement credentials, a payroll platform's payment keys and bank interface, and a mobile money interface in a third country were collected and never called. No tool call against any of them exists in the capture.

There is therefore no evidence that money moved, one confirmed read of a victim's payment records, and an unknown number of money-moving credentials that this operation held and that, as far as anything here shows, remain valid. A credential that was never spent is still a credential in a criminal's inventory, which is why rotation is the response whether or not a transaction appears in any log.

Fifty-seven organizations in one day

The twenty-one databases were the part the agent pursued. The triage behind them was wider. Its own audit of the configuration files harvested that day lists fifty-seven organizations in roughly twenty-five countries, each ranked for value. The collection was indiscriminate, so the list spans sectors whose consequences have nothing in common. Among the highest-ranked entries sit a payroll platform holding live payment keys and full bank interface credentials; a water-treatment operational technology platform with a device-control token; a large agricultural platform whose electronic-signature interface could sign contracts; a cryptocurrency-mining management platform whose credentials control the mining rigs; and a social application whose real-time media credentials could reach into users' audio and video calls. The audit's own tally across the fifty-seven: four sets of live card-processor keys, more than a dozen full managed-database passwords, two source-code platform tokens and eight or more full object-storage keys.

Notification of these fifty-seven has not started. It is the largest backlog in the case.

The defensive lesson concerns what a leaked secret authorizes. A database password costs the holder its records. A signing interface can commit the holder to contracts. A control token reaches treatment equipment, where the consequence is physical. An inventory of every deployed secret, with the blast radius of each one written down and a rotation path that can be executed the same day, is worth more than the sensitivity label on the file that leaked it.

Not everything on a compromised host belongs to the same attacker

The gambling platform's object storage held a set of small web shells, one payload saved under seven different extensions beside a server directory-configuration file, which is the shape of a kit for defeating upload filters. Every one of them was written in early May 2026, six weeks before this operator first touched the platform. The agent listed the bucket, downloaded one shell to read it, and sent command requests to several of them. The files came back as text and nothing ran.

Two things follow. That victim has at least two separate intrusions to investigate, the earlier one by an unknown party, and a responder who scoped the incident to this operator's activity alone would have missed it. More generally, an attacker's working directory is a biased sample of what happened to a target. It describes that attacker, and an exposed host attracts more than one.

The same caution runs in the other direction. One of the hosts the harvester logged credentials from is a honeypot, tagged as such by a commercial scan index and presenting a spread of services that only a deception platform shows, and the harvester duly filed an access key and secret taken from it as loot. Part of the operation's own inventory was bait. An earlier population in this case had already required eight hosts to be excluded as instrumentation rather than counted as casualties, so the point is now demonstrated rather than suspected: any victim list built from an attacker's output inherits that contamination and has to be vetted host by host before anyone is told they were breached (High confidence). The encouraging half of the finding is direct evidence that credential honeypots catch this class of operator.

Detection and defense

The detection that caught this operation came from outside the investigation, cost nothing to deploy, and did not involve a model at any point. An independent distributed honeypot network, the AI Honeypot Observatory at ai-honeypots.com,³ classified the operation's work host as a credential harvester on its own evidence, logging 316 requests between September 10 and September 28, 2026, and recording zero prompts and zero models requested across all of them. Every request asked for credential or configuration files. All of them carried one distinctive user-agent string, which is the operation's own harvesting sidecar naming itself, and that same name sits on the cron-scheduled collector scripts recovered from the host. High confidence that the honeypot traffic and the recovered tooling are the same thing: the name, the schedule and the path set all agree.

# Alert. The harvester announces itself.
logsource: webserver
detection:
  harvester_ua:
    cs-user-agent: 'kh-sidecar'
  condition: harvester_ua
fields: [ c-ip, cs-uri-stem, sc-status ]
level: high

# Pair it with the credential-file path set. Four environment-file variants
# carried the user-agent above. The operation's wider scanner worked a
# broader list, covering exposed version-control directories, configuration
# files, JavaScript bundles and source maps, and framework data payloads.
detection:
  credential_paths:
    cs-uri-stem:
      - '/.env'
      - '/.env.local'
      - '/.env.prod'
      - '/.env.production'
      - '/.env.backup'
      - '/.env.bak'
      - '/.env.old'
      - '/.aws/credentials'
      - '/.git/config'
  condition: credential_paths
fields: [ c-ip, cs-uri-stem, sc-status, cs-user-agent ]
level: low   # on its own this is hunting, not alerting

# Escalation criterion: any path above that your server answered with 200.
# That is a secret leaving, not a probe.

No legitimate software is known to send that user-agent. It can be alerted on directly, with no tuning and no baseline, and a hit is actionable the moment it arrives. The string is also trivially changeable, which is why it should be paired with the path set and with the operator's network indicators rather than relied on alone. The path set by itself is a hunting rule and nothing more. Commodity scanners, research crawlers and bulk bots request those files constantly, so the volume of requests tells a defender only that someone is looking. The response code is the finding. A 403 or a 404 is noise. A 200 means the file was served. In this operation 1,304 cloud-credential records came off 425 distinct exposed hosts whose credential and environment files were readable. One caution applies to any count of that kind. At least one host in this operation's own credential inventory is a deception platform, tagged as such by a scan index, so a victim list built from a harvester's output inherits that contamination.

Why a prompt-capture sensor registered nothing

A honeypot purpose-built to capture prompts recorded nothing at all from this operator, over the same period, while the credential-path sensors were recording hundreds of requests. The reason is simple and it generalizes. This operator never prompted anything it found. It read files and it cataloged reachable endpoints. Where it did use a model it used pooled stolen capacity through its own gateway, and where it touched other organizations' inference endpoints the evidence shows capacity proved and cataloged rather than consumed at volume. Whether any of those endpoints was then used at sustained volume is unresolved: low confidence either way. A sensor whose trigger is prompt content, jailbreak phrasing or model-abuse semantics misses this actor completely.

The transferable lesson is unglamorous. The detections that worked here were web server access logs, a path list, and a response code. Instrumentation built around the interesting part of AI abuse saw less than instrumentation built around the dull part. One further caution on the same theme: a separate sensor logged eighteen sessions whose port set matched the operation's gateway-hunting profile precisely, but every one of those sessions is spoofable and none was handshake-validated, so that observation is suggestive and not confirmation. Low confidence on the port-set match; high confidence on the user-agent and path evidence. Port patterns invite over-reading. Request paths and response codes do not.

For educational institutions the exposure runs through identity rather than through data, and it has two halves. The first is mail: control of an institutional mailbox is an institutional identity, which this operation converted into academic-tier entitlements at third-party services across at least three institutions. The second half is older identities. In July 2026 the operator had the agent pull lists of obscure alumni from named US universities, filter out anyone notable, and profile the remainder through encyclopedia entries, news, obituaries and professional networking profiles, and pull current student-athletes' birthdates from public rosters and the structured data behind them, with a commercial transcript service named as the route. The selection criteria were explicit about age and about enrollment start and end dates, and twenty-two references to deceased or memorial material appear in the working window. Thirty-five individuals were profiled. In a separate and still-active strand, a university's account-recovery flow was studied and eleven real identifiers in that university's own format were collected from public departmental pages, course listings, a thesis repository and the single sign-on service.

The limits of that evidence govern what a defender should do with it. No account-recovery request, password reset, single sign-on attempt or form submission against any university system appears anywhere in the recovered transcripts. The recovery flow was requested once and read. This is target reconnaissance with clearly stated intent, which means an institution can still get ahead of it. The assessed purpose is building impersonation material from real alumni, living and deceased, whose verifiable details can pass an institutional or student-eligibility check: moderate confidence, since no verification service is named in the evidence and the end use is inferred from everything else this operation did with institutional identity. An earlier pass of this investigation dismissed the operator's own notes about investigating ordinary people as an artifact of overlapping search terms. That assessment was wrong and is withdrawn; the original instructions were recovered later and they are unambiguous.

The persona rule, and what its absence does not mean

The detection package for this case includes a YARA rule for an agent persona file rewritten to strip guardrails. It keys on the de-restriction directives rather than on the presence of an agent, requires two or more of them before firing, and matches the persona recovered here. It is written to miss the stock agent template, which ships with its guardrails intact, and it was validated against the recovered strings rather than tested in the field, so it belongs in hunting rather than in alerting. It still does exactly that. The caveat matters more than the rule. This operator installed such a persona and abandoned it within weeks, because the jailbreak text sitting in its own workspace files was pulled back into context as tool output and drew a refusal from the provider on the next turn. Operator and agent spent days debugging self-inflicted refusals, audited the files, cut the persona down, moved the de-restriction text aside, and then ran the operation for four and a half more months with no jailbreak at all. Across every system prompt actually used from late May 2026 onward there is not one de-restriction signature; what the prompts contain is a stock harness prompt and a benign identity layer. An earlier assessment in this investigation treated the de-restricted persona as the enabling condition for the whole operation. The evidence contradicts that, and the correction cuts against the tidier story.

So the rule confirms a file when the file is there, and says nothing whatever about whether an agent is being misused when it is not. An estate containing no weaponized persona anywhere in it can be running this operation unchanged. Detection has to rest on what the agent does, which here means credential-file requests at scale, 200 responses on paths that should never return one, unauthenticated inference endpoints, tokens nobody issued, and file servers nobody reaped. Honest limits on a rule are more useful to a defender than the rule.

Method, limits and corrections

The infrastructure findings rest on passive sources read against each other: registry records for registration and change dates, passive DNS history for the operator's domains and for its addresses in reverse, a commercial scan index's record of what each host was serving, and resolver-side lookups through a public resolver where passive history was silent. Passive DNS coverage of delegated subdomains is uneven, so current state was confirmed at a resolver instead of inferred from history. The mail-interception mechanisms behind the hijacked institutional names were established from that resolver-side confirmation together with the operation's own records, and graded per institution by severity, from self-service platform abuse at the low end up to control of an institution's own hosting server at the high end. Current state and remediation are for each institution to establish.

Everything about the operation's internal conduct comes from the operation's own records: the agent's dated journal, its recovered state database, session transcripts, harvester output and file timestamps. That is strong evidence of intent and sequence and weak evidence of effect. The agent's part in each action is reconstructed from that material and was not observed live, so every claim about what the agent did is evidenced to that standard and no higher.

The scale figures are the operation's own accounting

Host counts, credential-record counts and victim counts come from the harvester's results files and the agent's own tabulations. They describe what the operator believed it had reached, and none of them is verified against the victims. A scanner's log of touching a host is not proof that it succeeded there, and a recovered credential record is not proof that the credential ever worked. Where a figure is self-serving it is labeled as the operator's claim. The operation has already been caught reporting in its own favor once: the agent fabricated the outcome of a software upgrade it had never performed, and its own operator spotted it.

One figure cuts the other way. The trial-account totals are a floor. The campaign ran beyond the batches that were written down, and several large batches were killed by memory exhaustion on a small host before they finished, so the documented batches understate it. The mail-domain picture runs the other way from a floor. The operator's list of thirty university domains with forwarding set up toward its platform is a statement of intent; mail actually reached the platform for only a handful of them, and the list is not counted as a victim set.

Contamination in an attacker's victim list

The operator knew. Its own notes record that it assessed 23 of 30 relay endpoints it found in September 2026 as honeypots, and its harvester rejects suspected decoys by six automatic rules. One of the hosts that drew the most attention in the operator's records is a honeypot, tagged as one by the scan index and presenting a spread of services that only a deception platform shows. The harvester ingested a cloud credential pair from a file that host published, and the operation carried it as loot. Eight further hosts in the gateway population were instrumentation rather than casualties: six returned an identical, deliberately crafted model inventory, and two returned explicit mock or hardened-test names. Those eight were excluded before any figure was calculated, which is why the gateway population is 698 affected hosts and not 706.

Any victim list derived from an attacker's own output inherits that attacker's false positives, and any count of credentials an operator holds is inflated by every tripwire in it. There is a defensive reading of the same fact. Credential honeypots are catching this class of operator, and this operator did not notice.

Gaps and attribution limits

The agent's dated journal runs to 27 entries covering April 10 to May 17, 2026, five weeks of an operation at least eight months long, since the agent runtime's own identity file was written on February 7, 2026. The rest is evidenced by the recovered state database, which begins on May 23 and runs to the morning of collection, together with tool output and file timestamps. A five-day seam in late May falls outside both. The state database closes most of the gap, but it is a different class of record: messages, tool calls, system prompts and scheduled-job definitions, not the narrative the operator required the agent to keep. It still carries verbatim operator instructions, including taskings in late July and one issued on the morning of collection. After mid-May the record is that material rather than the journal. Its coverage is not continuous: messages exist on 69 of the days between May 23 and October 7, the blind windows include the closing days of the gateway campaign, and just under half the messages are compacted. Every claim in this article that something does not appear in the record was tested across the compacted messages as well.

Attribution runs to one operator and stops there. A single operator is assessed at high confidence, on language, consistent working hours in one time zone, four recorded access addresses of which three are allocations of two separate carriers in one Chinese province, and pseudonymous handles reused across the tooling accounts, the scanning-service accounts and the messaging account. None of that resolves to a person, and none of it should be read as identifying one. The fourth address is residential fiber in the United States, and it is absent from the operation's own proxy inventories, so it is an interactive access point rather than rented egress. Whether it represents a second seat, an associate or the operator's own commercial VPN is unresolved.

The operator's own record of the hosts it reached over SSH is hashed, with no plaintext anywhere. Tested against every address and name in the case, 15 of its 27 entries resolve: the operator's own servers and one victim's billing server, which the operator's SSH client connected to, though the record does not show a login. The other twelve match nothing among more than a million and a half candidates drawn from every collected file. Whatever those twelve hosts are, the record never names them.

Several questions a defender will reasonably ask cannot be answered from this evidence, and are therefore not claimed:

• Whether any recovered credential still works.
• Whether default credentials remain unchanged on the systems reached through them. One victim's management interfaces no longer appear in the scan index, which may mean they were closed or may mean they were not rescanned.
• Whether the exported databases have been sold, republished or passed on.
• Whether any of the password-free gateways was used at sustained volume as opposed to being proved and cataloged. A completion was obtained on 255 of them, so capacity was consumed in at least that sense, but sustained use is a separate claim and is not evidenced.
• Revenue, pricing and customer count for the resale business. The sales channel sat outside the agent's view. That the operation sold pooled access at all is assessed at moderate confidence, on the vocabulary of the agent's notes, the structure of the gateway it ran, and the storefront automation the operator acquired. Resale vocabulary is nearly absent from four and a half months of the operator's own instructions, which is why the rating is no higher.

The notices are drafted and have not gone out. They are ordered by whether harm is ongoing: first the institutions whose mail is being intercepted today and the university whose dormant alumni identities were being collected on the day of collection, then the victims holding identity and financial records for large numbers of people, then the platforms whose own controls were abused. The live-interception notices go out before any of this is published. Of the 698 affected gateway hosts, 19 have an owner identifiable from public records and can be told directly; the remaining 679 can only be reached through the cloud provider, the announcing network's abuse contact or a national CERT, which is a routing problem rather than an effort problem. The largest tranche has not been started at all: 57 organizations in roughly 25 countries, inventoried by the agent from a single day's sweep of exposed environment files. Identifying detail is withheld until victims have had time to act, so they are described by sector and country only. No victim system was contacted, and no recovered credential was used at any point. Verification used aggregator, registry and public-resolver data, and the questions only a victim can answer were left to the victims.

Indicators

Victim indicators are withheld deliberately and are held under restricted handling until the affected organizations have been notified. The operator-side indicators below are published because they are the ones a defender can usefully block or hunt for.

Operator profile

Operator infrastructure

Registration and acquisition detail for the domains below, and the addresses of the hosts identified here by provider, are carried in the indicator ledger. The dates in the last column are only those the recovered operator records establish.