{"slug": "stolen-ai-architecture-integrated-into-healthcare-startup-and-defense-contractor", "title": "Stolen AI Architecture integrated into healthcare startup and defense contractor", "summary": "A Cyber Forensics Investigation Team publicly released a report on October 24, 2026 alleging that code from Synthicsoft Labs LLC's KAIROS Always-On Daemon and Aletheia framework, created by CEO Adam Rivers, was mined after an Anthropic NPM packaging error on March 31, 2026 exposed the Claude Code source map, then integrated into commercial platforms and deployed as a distributed Android botnet. The report names Cody Kickertz (GitHub handle forkwright) as the primary threat actor, citing Issue #2260 on the forkwright/aletheia repository stating the code was \"Mined from Claude Code source\" and four pull requests merged April 7-8, 2026 that integrated the KAIROS autonomous dispatch cycle and stripped copyright headers. The report describes a five-person network it links to Kickertz's GitHub followers, including Joseph Kim of Summus Global, Arpit Raj in India, nguyentiendat78 in Vietnam, skooch in Australia and derekberkley in Texas, and states the evidence has been prepared for federal referral.", "body_md": "# THEMIS DOCKET: PUBLIC RELEASE \n\n## Forensic Analysis of the KAIROS IP Theft and Cybercrime Network \n\n**Date of Release:** October 24, 2026\n\n### [DOWNLOAD RAW FORENSIC EVIDENCE (.ZIP)](https://files.catbox.moe/qrmzlm.zip) \n\n# THEMIS DOCKET: COMPREHENSIVE FORENSIC INVESTIGATION REPORT \n\n## SUBJECT: Coordinated Intellectual Property Theft, Corporate Fraud, and Cybercrime Network Targeting Synthicsoft Labs LLC \n\n**DATE OF RELEASE:** October 24, 2026\n\n**PREPARED BY:** Cyber Forensics Investigation Team\n\n**STATUS:** Public Release / Open Source Intelligence\n\n### EXECUTIVE SUMMARY \n\nThis report details the targeted theft, concealment, weaponization, and attempted commercialization of proprietary intellectual property belonging to Synthicsoft Labs LLC. The stolen assets are the KAIROS Always-On Daemon and the Aletheia framework, originally created by CEO Adam Rivers. Following an accidental NPM source code leak at Anthropic on March 31, 2026, a multi-jurisdictional syndicate executed a coordinated scheme to mine the leaked code, integrate it into commercial platforms to defraud investors, and deploy it as a distributed Android botnet. The evidence is irrefutable and has been prepared for federal referral.\n\n### 1.0 VERIFICATION AND REPRODUCTION METHODOLOGY \n\nTo ensure the evidence is admissible in a court of law and reproducible by independent forensic examiners, this investigation utilized a strict multi-vector approach:\n\n- **Repository Cloning:** All public repositories were cloned locally using the Dulwich Python library. Cryptographic SHA-256 hashes were generated for all files to establish an immutable chain of custody.\n- **API Scraping:** GitHub API endpoints were queried to extract exact follower networks and user metadata before suspects could delete them.\n- **Infrastructure Tracing:** DNS queries, SSL transparency logs, and HTTP header analysis unmasked hosting providers and email servers behind the suspect's front domains.\n- **Behavioral Time Zone Analysis:** Automated HTTP ping scripts documented exact timestamps of HTTP 404s to mathematically prove coordinated evidence destruction.\n- **Deep Code String Extraction:** Recursive directory walks utilizing regular expressions were deployed to hunt for exact proprietary Synthicsoft variable names.\n\n### 2.0 THE ORIGIN AND PRIMARY THREAT ACTOR \n\n**The Leak:** On March 31, 2026, an Anthropic NPM packaging error exposed the source map for Claude Code, including the embedded KAIROS daemon.\n\n**The Primary Threat Actor:** Cody Kickertz, operating under the GitHub handle `forkwright`.\n\n**Proof of Extraction:** On March 31, 2026, Kickertz opened Issue #2260 on the `forkwright/aletheia` repository, stating it was \"Mined from Claude Code source.\" Between April 7 and April 8, 2026, Kickertz merged four pull requests (#2577, #2591, #2592, #2593), integrating the KAIROS autonomous dispatch cycle directly into Synthicsoft's Aletheia property and stripping copyright headers.\n\n**Corporate Motive:** Git commit metadata ties Kickertz to [\\[email protected\\]](https://rentry.co/cdn-cgi/l/email-protection)\n\n### 3.0 THE SYNDICATE NETWORK \n\nCody Kickertz follows zero people on GitHub. His account is followed by a highly curated, closed circle of five active technical specialists. Forensic API extraction of this network reveals a coordinated, compartmentalized team.\n\n- **Joseph Kim (josephjdkim):** Software Engineer at Summus Global in Brooklyn, NY. Actively tracking AI agentic frameworks and reverse engineering tools (Ghidra). Role: Corporate Insider.\n- **Arpit Raj (arpitrajjj):** Based in India. Operates the malware and botnet infrastructure. Role: Malware Developer.\n- **nguyentiendat78:** Based in Vietnam. Forked`openclaw` (a derivative of the stolen Claude Code) and malware/bot IP lists. Role: Proxy and API Rotation Operator.\n- **skooch:** Based in Australia. Forks include`iBoot` (Apple bootloader) and`espressif-qemu` . Role: Low-Level Systems Engineer and Container Evasion.\n- **derekberkley:** Based in Texas. Junior Developer and Bitcoin advocate.\n\n### 4.0 THE SECONDARY COMMERCIAL NETWORK \n\nA separate network attempted to commercialize a \"clean-room rewrite\" of KAIROS under the repository `uameer/heartbeat`. A deep scan extracted exact proprietary KAIROS terminology hardcoded into their Python files (`heartbeat.py`, `heartbeat_memory.py`), containing the markers `kairos`, `always-on`, and `autodream`.\n\n**The Actors:** Usman Ameer (Germany), Maksymilian Burdziej (Poland), Chanchal Raj (United Arab Emirates), and Mohamed Alani, an Operations Engineer at Woodward Incorporated (Illinois, USA).\n\n### 5.0 CYBERCRIME INFRASTRUCTURE AND WEAPONIZATION \n\n**The Threat Actor:** Arpit Raj ([\\[email protected\\]](https://rentry.co/cdn-cgi/l/email-protection)\n\n**Proof of Botnet Infrastructure:** Reverse engineering of his `actions-testing` repository revealed automated YAML workflows exploiting Microsoft and Apple cloud infrastructure to boot virtual Android devices, creating a cloud-hosted bot farm.\n\n**Proof of Malware Deployment:** The `OnyxBridge` C++ configuration file defines `HEARTBEAT_INTERVAL_MS` as 2000 and requests `SEND_SMS`, `RECEIVE_SMS`, and `READ_SMS` permissions. This proves an intent to intercept messages, bypass two-factor authentication, and facilitate mass account fraud.\n\n**Command and Control:** Hardcoded C2 endpoint at `https://onyxdashboard-7hi7.onrender.com`. Additionally, the `rich-editor-bot` repository contains a hardcoded Telegram Bot Token (`8912527344:AAF4pzrDdHX0wKoKw1b2kCguuquxAfUEIgw`) used for secondary C2.\n\n### 6.0 GEOLOCATION AND OPERATIONAL SECURITY ANALYSIS \n\n**Primary Geolocation:** Git commit metadata from the `not-of-work` repository returned a timezone offset of `+0530` (India Standard Time), placing Arpit Raj in India during the initial cyberattack development.\n\n**OPSEC Evasion:** All subsequent repositories were committed with a timezone offset of `+0000` (UTC). This proves the actor deliberately transitioned to cloud-based virtual machines to obfuscate his physical location.\n\n### 7.0 SPOLIATION OF EVIDENCE \n\nOn October 23, 2026, at 9:45 PM Central Standard Time, during active automated forensic extraction, the primary repositories `forkwright/aletheia` and `NullLabTests/claude-code-enhanced` simultaneously returned HTTP 404 errors, indicating deletion.\n\n**Time Zone Analysis:** At that exact moment, it was 10:45 PM in New York, 4:45 AM in Europe, and 6:45 AM in the UAE. The mathematical improbability of a manual reaction at these hours proves automated surveillance of Synthicsoft or an insider tip-off. The immediate deletion constitutes obstruction of justice and a clear consciousness of guilt.\n\n### 8.0 LEGAL RAMIFICATIONS AND POTENTIAL PENALTIES \n\n**Criminal Liability:** The Defend Trade Secrets Act and the Economic Espionage Act make the theft of proprietary trade secrets for commercial benefit a federal felony. Individuals face up to 10 years in federal prison and $250,000 in fines per offense. Corporate entities face fines up to $5 million. Using stolen code to secure a $20 million funding round constitutes securities fraud, carrying penalties of up to 20 years in federal prison.\n\n**Civil Liability:** For willful copyright infringement, plaintiffs can seek up to $150,000 per work infringed. Due to the deletion of repositories during active discovery, courts will issue severe spoliation sanctions, including default judgments and adverse inference instructions.\n\n### RAW EVIDENCE EXTRACTS \n\n| \n\n```\n 1\n 2\n 3\n 4\n 5\n 6\n 7\n 8\n 9\n10\n11\n12\n13\n14\n15\n16\n17\n18\n19\n20\n21\n22\n23\n24\n25\n26\n27\n28\n29\n30\n31\n32\n33\n34\n35\n36\n37\n38\n39\n40\n41\n42\n43\n44\n45\n46\n47\n48\n49\n50\n51\n52\n53\n54\n55\n56\n57\n58\n59\n60\n61\n```\n\n | \n\n```\n--- GIT COMMIT LOGS ---\nCommit: d90d9363\nDate: 2026-08-31 19:18:12 UTC\nAuthor: Arpit Raj <[email protected]>\nMessage: Add GitHub Actions workflow for Zenserp Mass Reg\n\nCommit: 0f39a2de\nDate: 2026-08-31 19:17:05 UTC\nAuthor: Arpit Raj <[email protected]>\nMessage: Add mass registration script with email verification\n\n--- MALWARE CONFIG (OnyxBridge) ---\n#pragma once\n#include <string>\nnamespace onyx {\n#ifndef ONYX_API_URL\n#define ONYX_API_URL \"https://onyxdashboard-7hi7.onrender.com\"\n#endif\nstatic constexpr int HEARTBEAT_INTERVAL_MS = 2000;\nstatic constexpr int PERM_POLL_INTERVAL_MS = 1000;\nstatic constexpr const char* SMS_PERMISSIONS[] = {\n    \"android.permission.SEND_SMS\",\n    \"android.permission.RECEIVE_SMS\",\n    \"android.permission.READ_SMS\",\n};\nstatic constexpr int SMS_PERMISSION_COUNT = 3;\nstatic constexpr const char* LIBRARY_VERSION = \"2.0.0\";\n}\n\n--- GITHUB ACTIONS BOTNET ---\nname: Zenserp Mass Reg\non:\n  workflow_dispatch:\n    inputs:\n      total_accounts:\n        description: 'Total accounts'\n        required: false\n        default: '100'\njobs:\n  shard:\n    runs-on: windows-latest\n    timeout-minutes: 30\n    strategy:\n      fail-fast: false\n      matrix:\n        shard: [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15]\n    steps:\n      - name: Checkout\n        uses: actions/checkout@v4\n      - name: Setup Python\n        uses: actions/setup-python@v5\n        with:\n          python-version: '3.12'\n      - name: Run shard ${{ matrix.shard }}\n        env:\n          TG_TOKEN: ${{ secrets.TG_TOKEN }}\n          TG_CHAT_ID: ${{ secrets.TG_CHAT_ID }}\n        run: python mass_reg.py ${{ matrix.shard }} 15 ${{ inputs.total_accounts || '100' }}\n\n--- TELEGRAM C2 (rich-editor-bot) ---\nBOT_TOKEN = os.environ.get(\"BOT_TOKEN\", \"8912527344:AAF4pzrDdHX0wKoKw1b2kCguuquxAfUEIgw\")\n```\n\n |", "url": "https://wpnews.pro/news/stolen-ai-architecture-integrated-into-healthcare-startup-and-defense-contractor", "canonical_source": "https://rentry.co/themis-docket-e61b189e37", "published_at": "2026-10-24 16:01:49+00:00", "updated_at": "2026-10-24 16:12:12.658294+00:00", "lang": "en", "topics": ["ai-safety", "ai-policy"], "entities": ["Synthicsoft Labs LLC", "KAIROS Always-On Daemon", "Aletheia", "Adam Rivers", "Anthropic", "Claude Code", "Cody Kickertz", "GitHub"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/stolen-ai-architecture-integrated-into-healthcare-startup-and-defense-contractor", "markdown": "https://wpnews.pro/news/stolen-ai-architecture-integrated-into-healthcare-startup-and-defense-contractor.md", "text": "https://wpnews.pro/news/stolen-ai-architecture-integrated-into-healthcare-startup-and-defense-contractor.txt", "jsonld": "https://wpnews.pro/news/stolen-ai-architecture-integrated-into-healthcare-startup-and-defense-contractor.jsonld"}}