# Stolen AI Architecture integrated into healthcare startup and defense contractor

> Source: <https://rentry.co/themis-docket-e61b189e37>
> Published: 2026-10-24 16:01:49+00:00

# THEMIS DOCKET: PUBLIC RELEASE 

## Forensic Analysis of the KAIROS IP Theft and Cybercrime Network 

**Date of Release:** October 24, 2026

### [DOWNLOAD RAW FORENSIC EVIDENCE (.ZIP)](https://files.catbox.moe/qrmzlm.zip) 

# THEMIS DOCKET: COMPREHENSIVE FORENSIC INVESTIGATION REPORT 

## SUBJECT: Coordinated Intellectual Property Theft, Corporate Fraud, and Cybercrime Network Targeting Synthicsoft Labs LLC 

**DATE OF RELEASE:** October 24, 2026

**PREPARED BY:** Cyber Forensics Investigation Team

**STATUS:** Public Release / Open Source Intelligence

### EXECUTIVE SUMMARY 

This report details the targeted theft, concealment, weaponization, and attempted commercialization of proprietary intellectual property belonging to Synthicsoft Labs LLC. The stolen assets are the KAIROS Always-On Daemon and the Aletheia framework, originally created by CEO Adam Rivers. Following an accidental NPM source code leak at Anthropic on March 31, 2026, a multi-jurisdictional syndicate executed a coordinated scheme to mine the leaked code, integrate it into commercial platforms to defraud investors, and deploy it as a distributed Android botnet. The evidence is irrefutable and has been prepared for federal referral.

### 1.0 VERIFICATION AND REPRODUCTION METHODOLOGY 

To ensure the evidence is admissible in a court of law and reproducible by independent forensic examiners, this investigation utilized a strict multi-vector approach:

- **Repository Cloning:** All public repositories were cloned locally using the Dulwich Python library. Cryptographic SHA-256 hashes were generated for all files to establish an immutable chain of custody.
- **API Scraping:** GitHub API endpoints were queried to extract exact follower networks and user metadata before suspects could delete them.
- **Infrastructure Tracing:** DNS queries, SSL transparency logs, and HTTP header analysis unmasked hosting providers and email servers behind the suspect's front domains.
- **Behavioral Time Zone Analysis:** Automated HTTP ping scripts documented exact timestamps of HTTP 404s to mathematically prove coordinated evidence destruction.
- **Deep Code String Extraction:** Recursive directory walks utilizing regular expressions were deployed to hunt for exact proprietary Synthicsoft variable names.

### 2.0 THE ORIGIN AND PRIMARY THREAT ACTOR 

**The Leak:** On March 31, 2026, an Anthropic NPM packaging error exposed the source map for Claude Code, including the embedded KAIROS daemon.

**The Primary Threat Actor:** Cody Kickertz, operating under the GitHub handle `forkwright`.

**Proof of Extraction:** On March 31, 2026, Kickertz opened Issue #2260 on the `forkwright/aletheia` repository, stating it was "Mined from Claude Code source." Between April 7 and April 8, 2026, Kickertz merged four pull requests (#2577, #2591, #2592, #2593), integrating the KAIROS autonomous dispatch cycle directly into Synthicsoft's Aletheia property and stripping copyright headers.

**Corporate Motive:** Git commit metadata ties Kickertz to [\[email protected\]](https://rentry.co/cdn-cgi/l/email-protection)

### 3.0 THE SYNDICATE NETWORK 

Cody Kickertz follows zero people on GitHub. His account is followed by a highly curated, closed circle of five active technical specialists. Forensic API extraction of this network reveals a coordinated, compartmentalized team.

- **Joseph Kim (josephjdkim):** Software Engineer at Summus Global in Brooklyn, NY. Actively tracking AI agentic frameworks and reverse engineering tools (Ghidra). Role: Corporate Insider.
- **Arpit Raj (arpitrajjj):** Based in India. Operates the malware and botnet infrastructure. Role: Malware Developer.
- **nguyentiendat78:** Based in Vietnam. Forked`openclaw` (a derivative of the stolen Claude Code) and malware/bot IP lists. Role: Proxy and API Rotation Operator.
- **skooch:** Based in Australia. Forks include`iBoot` (Apple bootloader) and`espressif-qemu` . Role: Low-Level Systems Engineer and Container Evasion.
- **derekberkley:** Based in Texas. Junior Developer and Bitcoin advocate.

### 4.0 THE SECONDARY COMMERCIAL NETWORK 

A separate network attempted to commercialize a "clean-room rewrite" of KAIROS under the repository `uameer/heartbeat`. A deep scan extracted exact proprietary KAIROS terminology hardcoded into their Python files (`heartbeat.py`, `heartbeat_memory.py`), containing the markers `kairos`, `always-on`, and `autodream`.

**The Actors:** Usman Ameer (Germany), Maksymilian Burdziej (Poland), Chanchal Raj (United Arab Emirates), and Mohamed Alani, an Operations Engineer at Woodward Incorporated (Illinois, USA).

### 5.0 CYBERCRIME INFRASTRUCTURE AND WEAPONIZATION 

**The Threat Actor:** Arpit Raj ([\[email protected\]](https://rentry.co/cdn-cgi/l/email-protection)

**Proof of Botnet Infrastructure:** Reverse engineering of his `actions-testing` repository revealed automated YAML workflows exploiting Microsoft and Apple cloud infrastructure to boot virtual Android devices, creating a cloud-hosted bot farm.

**Proof of Malware Deployment:** The `OnyxBridge` C++ configuration file defines `HEARTBEAT_INTERVAL_MS` as 2000 and requests `SEND_SMS`, `RECEIVE_SMS`, and `READ_SMS` permissions. This proves an intent to intercept messages, bypass two-factor authentication, and facilitate mass account fraud.

**Command and Control:** Hardcoded C2 endpoint at `https://onyxdashboard-7hi7.onrender.com`. Additionally, the `rich-editor-bot` repository contains a hardcoded Telegram Bot Token (`8912527344:AAF4pzrDdHX0wKoKw1b2kCguuquxAfUEIgw`) used for secondary C2.

### 6.0 GEOLOCATION AND OPERATIONAL SECURITY ANALYSIS 

**Primary Geolocation:** Git commit metadata from the `not-of-work` repository returned a timezone offset of `+0530` (India Standard Time), placing Arpit Raj in India during the initial cyberattack development.

**OPSEC Evasion:** All subsequent repositories were committed with a timezone offset of `+0000` (UTC). This proves the actor deliberately transitioned to cloud-based virtual machines to obfuscate his physical location.

### 7.0 SPOLIATION OF EVIDENCE 

On October 23, 2026, at 9:45 PM Central Standard Time, during active automated forensic extraction, the primary repositories `forkwright/aletheia` and `NullLabTests/claude-code-enhanced` simultaneously returned HTTP 404 errors, indicating deletion.

**Time Zone Analysis:** At that exact moment, it was 10:45 PM in New York, 4:45 AM in Europe, and 6:45 AM in the UAE. The mathematical improbability of a manual reaction at these hours proves automated surveillance of Synthicsoft or an insider tip-off. The immediate deletion constitutes obstruction of justice and a clear consciousness of guilt.

### 8.0 LEGAL RAMIFICATIONS AND POTENTIAL PENALTIES 

**Criminal Liability:** The Defend Trade Secrets Act and the Economic Espionage Act make the theft of proprietary trade secrets for commercial benefit a federal felony. Individuals face up to 10 years in federal prison and $250,000 in fines per offense. Corporate entities face fines up to $5 million. Using stolen code to secure a $20 million funding round constitutes securities fraud, carrying penalties of up to 20 years in federal prison.

**Civil Liability:** For willful copyright infringement, plaintiffs can seek up to $150,000 per work infringed. Due to the deletion of repositories during active discovery, courts will issue severe spoliation sanctions, including default judgments and adverse inference instructions.

### RAW EVIDENCE EXTRACTS 

| 

```
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
```

 | 

```
--- GIT COMMIT LOGS ---
Commit: d90d9363
Date: 2026-08-31 19:18:12 UTC
Author: Arpit Raj <[email protected]>
Message: Add GitHub Actions workflow for Zenserp Mass Reg

Commit: 0f39a2de
Date: 2026-08-31 19:17:05 UTC
Author: Arpit Raj <[email protected]>
Message: Add mass registration script with email verification

--- MALWARE CONFIG (OnyxBridge) ---
#pragma once
#include <string>
namespace onyx {
#ifndef ONYX_API_URL
#define ONYX_API_URL "https://onyxdashboard-7hi7.onrender.com"
#endif
static constexpr int HEARTBEAT_INTERVAL_MS = 2000;
static constexpr int PERM_POLL_INTERVAL_MS = 1000;
static constexpr const char* SMS_PERMISSIONS[] = {
    "android.permission.SEND_SMS",
    "android.permission.RECEIVE_SMS",
    "android.permission.READ_SMS",
};
static constexpr int SMS_PERMISSION_COUNT = 3;
static constexpr const char* LIBRARY_VERSION = "2.0.0";
}

--- GITHUB ACTIONS BOTNET ---
name: Zenserp Mass Reg
on:
  workflow_dispatch:
    inputs:
      total_accounts:
        description: 'Total accounts'
        required: false
        default: '100'
jobs:
  shard:
    runs-on: windows-latest
    timeout-minutes: 30
    strategy:
      fail-fast: false
      matrix:
        shard: [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15]
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.12'
      - name: Run shard ${{ matrix.shard }}
        env:
          TG_TOKEN: ${{ secrets.TG_TOKEN }}
          TG_CHAT_ID: ${{ secrets.TG_CHAT_ID }}
        run: python mass_reg.py ${{ matrix.shard }} 15 ${{ inputs.total_accounts || '100' }}

--- TELEGRAM C2 (rich-editor-bot) ---
BOT_TOKEN = os.environ.get("BOT_TOKEN", "8912527344:AAF4pzrDdHX0wKoKw1b2kCguuquxAfUEIgw")
```

 |