Forensic Analysis of the KAIROS IP Theft and Cybercrime Network #
Date of Release: October 24, 2026
DOWNLOAD RAW FORENSIC EVIDENCE (.ZIP)
SUBJECT: Coordinated Intellectual Property Theft, Corporate Fraud, and Cybercrime Network Targeting Synthicsoft Labs LLC #
DATE OF RELEASE: October 24, 2026
PREPARED BY: Cyber Forensics Investigation Team
STATUS: Public Release / Open Source Intelligence
EXECUTIVE SUMMARY
This report details the targeted theft, concealment, weaponization, and attempted commercialization of proprietary intellectual property belonging to Synthicsoft Labs LLC. The stolen assets are the KAIROS Always-On Daemon and the Aletheia framework, originally created by CEO Adam Rivers. Following an accidental NPM source code leak at Anthropic on March 31, 2026, a multi-jurisdictional syndicate executed a coordinated scheme to mine the leaked code, integrate it into commercial platforms to defraud investors, and deploy it as a distributed Android botnet. The evidence is irrefutable and has been prepared for federal referral.
1.0 VERIFICATION AND REPRODUCTION METHODOLOGY
To ensure the evidence is admissible in a court of law and reproducible by independent forensic examiners, this investigation utilized a strict multi-vector approach:
- Repository Cloning: All public repositories were cloned locally using the Dulwich Python library. Cryptographic SHA-256 hashes were generated for all files to establish an immutable chain of custody.
- API Scraping: GitHub API endpoints were queried to extract exact follower networks and user metadata before suspects could delete them.
- Infrastructure Tracing: DNS queries, SSL transparency logs, and HTTP header analysis unmasked hosting providers and email servers behind the suspect's front domains.
- Behavioral Time Zone Analysis: Automated HTTP ping scripts documented exact timestamps of HTTP 404s to mathematically prove coordinated evidence destruction.
- Deep Code String Extraction: Recursive directory walks utilizing regular expressions were deployed to hunt for exact proprietary Synthicsoft variable names.
2.0 THE ORIGIN AND PRIMARY THREAT ACTOR
The Leak: On March 31, 2026, an Anthropic NPM packaging error exposed the source map for Claude Code, including the embedded KAIROS daemon.
The Primary Threat Actor: Cody Kickertz, operating under the GitHub handle forkwright.
Proof of Extraction: On March 31, 2026, Kickertz opened Issue #2260 on the forkwright/aletheia repository, stating it was "Mined from Claude Code source." Between April 7 and April 8, 2026, Kickertz merged four pull requests (#2577, #2591, #2592, #2593), integrating the KAIROS autonomous dispatch cycle directly into Synthicsoft's Aletheia property and stripping copyright headers.
Corporate Motive: Git commit metadata ties Kickertz to [email protected]
3.0 THE SYNDICATE NETWORK
Cody Kickertz follows zero people on GitHub. His account is followed by a highly curated, closed circle of five active technical specialists. Forensic API extraction of this network reveals a coordinated, compartmentalized team.
- Joseph Kim (josephjdkim): Software Engineer at Summus Global in Brooklyn, NY. Actively tracking AI agentic frameworks and reverse engineering tools (Ghidra). Role: Corporate Insider.
- Arpit Raj (arpitrajjj): Based in India. Operates the malware and botnet infrastructure. Role: Malware Developer.
- nguyentiendat78: Based in Vietnam. Forked
openclaw(a derivative of the stolen Claude Code) and malware/bot IP lists. Role: Proxy and API Rotation Operator. - skooch: Based in Australia. Forks include
iBoot(Apple boot) andespressif-qemu. Role: Low-Level Systems Engineer and Container Evasion. - derekberkley: Based in Texas. Junior Developer and Bitcoin advocate.
4.0 THE SECONDARY COMMERCIAL NETWORK
A separate network attempted to commercialize a "clean-room rewrite" of KAIROS under the repository uameer/heartbeat. A deep scan extracted exact proprietary KAIROS terminology hardcoded into their Python files (heartbeat.py, heartbeat_memory.py), containing the markers kairos, always-on, and autodream.
The Actors: Usman Ameer (Germany), Maksymilian Burdziej (Poland), Chanchal Raj (United Arab Emirates), and Mohamed Alani, an Operations Engineer at Woodward Incorporated (Illinois, USA).
5.0 CYBERCRIME INFRASTRUCTURE AND WEAPONIZATION
The Threat Actor: Arpit Raj ([email protected]
Proof of Botnet Infrastructure: Reverse engineering of his actions-testing repository revealed automated YAML workflows exploiting Microsoft and Apple cloud infrastructure to boot virtual Android devices, creating a cloud-hosted bot farm.
Proof of Malware Deployment: The OnyxBridge C++ configuration file defines HEARTBEAT_INTERVAL_MS as 2000 and requests SEND_SMS, RECEIVE_SMS, and READ_SMS permissions. This proves an intent to intercept messages, bypass two-factor authentication, and facilitate mass account fraud.
Command and Control: Hardcoded C2 endpoint at https://onyxdashboard-7hi7.onrender.com. Additionally, the rich-editor-bot repository contains a hardcoded Telegram Bot Token (8912527344:AAF4pzrDdHX0wKoKw1b2kCguuquxAfUEIgw) used for secondary C2.
6.0 GEOLOCATION AND OPERATIONAL SECURITY ANALYSIS
Primary Geolocation: Git commit metadata from the not-of-work repository returned a timezone offset of +0530 (India Standard Time), placing Arpit Raj in India during the initial cyberattack development.
OPSEC Evasion: All subsequent repositories were committed with a timezone offset of +0000 (UTC). This proves the actor deliberately transitioned to cloud-based virtual machines to obfuscate his physical location.
7.0 SPOLIATION OF EVIDENCE
On October 23, 2026, at 9:45 PM Central Standard Time, during active automated forensic extraction, the primary repositories forkwright/aletheia and NullLabTests/claude-code-enhanced simultaneously returned HTTP 404 errors, indicating deletion.
Time Zone Analysis: At that exact moment, it was 10:45 PM in New York, 4:45 AM in Europe, and 6:45 AM in the UAE. The mathematical improbability of a manual reaction at these hours proves automated surveillance of Synthicsoft or an insider tip-off. The immediate deletion constitutes obstruction of justice and a clear consciousness of guilt.
8.0 LEGAL RAMIFICATIONS AND POTENTIAL PENALTIES
Criminal Liability: The Defend Trade Secrets Act and the Economic Espionage Act make the theft of proprietary trade secrets for commercial benefit a federal felony. Individuals face up to 10 years in federal prison and $250,000 in fines per offense. Corporate entities face fines up to $5 million. Using stolen code to secure a $20 million funding round constitutes securities fraud, carrying penalties of up to 20 years in federal prison.
Civil Liability: For willful copyright infringement, plaintiffs can seek up to $150,000 per work infringed. Due to the deletion of repositories during active discovery, courts will issue severe spoliation sanctions, including default judgments and adverse inference instructions.
RAW EVIDENCE EXTRACTS
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
|
--- GIT COMMIT LOGS ---
Commit: d90d9363
Date: 2026-08-31 19:18:12 UTC
Author: Arpit Raj <[email protected]>
Message: Add GitHub Actions workflow for Zenserp Mass Reg
Commit: 0f39a2de
Date: 2026-08-31 19:17:05 UTC
Author: Arpit Raj <[email protected]>
Message: Add mass registration script with email verification
--- MALWARE CONFIG (OnyxBridge) ---
#pragma once
#include <string>
namespace onyx {
#ifndef ONYX_API_URL
#define ONYX_API_URL "https://onyxdashboard-7hi7.onrender.com"
#endif
static constexpr int HEARTBEAT_INTERVAL_MS = 2000;
static constexpr int PERM_POLL_INTERVAL_MS = 1000;
static constexpr const char* SMS_PERMISSIONS[] = {
"android.permission.SEND_SMS",
"android.permission.RECEIVE_SMS",
"android.permission.READ_SMS",
};
static constexpr int SMS_PERMISSION_COUNT = 3;
static constexpr const char* LIBRARY_VERSION = "2.0.0";
}
--- GITHUB ACTIONS BOTNET ---
name: Zenserp Mass Reg
on:
workflow_dispatch:
inputs:
total_accounts:
description: 'Total accounts'
required: false
default: '100'
jobs:
shard:
runs-on: windows-latest
timeout-minutes: 30
strategy:
fail-fast: false
matrix:
shard: [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15]
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Setup Python
uses: actions/setup-python@v5
with:
python-version: '3.12'
- name: Run shard ${{ matrix.shard }}
env:
TG_TOKEN: ${{ secrets.TG_TOKEN }}
TG_CHAT_ID: ${{ secrets.TG_CHAT_ID }}
run: python mass_reg.py ${{ matrix.shard }} 15 ${{ inputs.total_accounts || '100' }}
--- TELEGRAM C2 (rich-editor-bot) ---
BOT_TOKEN = os.environ.get("BOT_TOKEN", "8912527344:AAF4pzrDdHX0wKoKw1b2kCguuquxAfUEIgw")
|