Stolen AI Architecture integrated into healthcare startup and defense contractor A Cyber Forensics Investigation Team publicly released a report on October 24, 2026 alleging that code from Synthicsoft Labs LLC's KAIROS Always-On Daemon and Aletheia framework, created by CEO Adam Rivers, was mined after an Anthropic NPM packaging error on March 31, 2026 exposed the Claude Code source map, then integrated into commercial platforms and deployed as a distributed Android botnet. The report names Cody Kickertz (GitHub handle forkwright) as the primary threat actor, citing Issue #2260 on the forkwright/aletheia repository stating the code was "Mined from Claude Code source" and four pull requests merged April 7-8, 2026 that integrated the KAIROS autonomous dispatch cycle and stripped copyright headers. The report describes a five-person network it links to Kickertz's GitHub followers, including Joseph Kim of Summus Global, Arpit Raj in India, nguyentiendat78 in Vietnam, skooch in Australia and derekberkley in Texas, and states the evidence has been prepared for federal referral. THEMIS DOCKET: PUBLIC RELEASE Forensic Analysis of the KAIROS IP Theft and Cybercrime Network Date of Release: October 24, 2026 DOWNLOAD RAW FORENSIC EVIDENCE .ZIP https://files.catbox.moe/qrmzlm.zip THEMIS DOCKET: COMPREHENSIVE FORENSIC INVESTIGATION REPORT SUBJECT: Coordinated Intellectual Property Theft, Corporate Fraud, and Cybercrime Network Targeting Synthicsoft Labs LLC DATE OF RELEASE: October 24, 2026 PREPARED BY: Cyber Forensics Investigation Team STATUS: Public Release / Open Source Intelligence EXECUTIVE SUMMARY This report details the targeted theft, concealment, weaponization, and attempted commercialization of proprietary intellectual property belonging to Synthicsoft Labs LLC. The stolen assets are the KAIROS Always-On Daemon and the Aletheia framework, originally created by CEO Adam Rivers. Following an accidental NPM source code leak at Anthropic on March 31, 2026, a multi-jurisdictional syndicate executed a coordinated scheme to mine the leaked code, integrate it into commercial platforms to defraud investors, and deploy it as a distributed Android botnet. The evidence is irrefutable and has been prepared for federal referral. 1.0 VERIFICATION AND REPRODUCTION METHODOLOGY To ensure the evidence is admissible in a court of law and reproducible by independent forensic examiners, this investigation utilized a strict multi-vector approach: - Repository Cloning: All public repositories were cloned locally using the Dulwich Python library. Cryptographic SHA-256 hashes were generated for all files to establish an immutable chain of custody. - API Scraping: GitHub API endpoints were queried to extract exact follower networks and user metadata before suspects could delete them. - Infrastructure Tracing: DNS queries, SSL transparency logs, and HTTP header analysis unmasked hosting providers and email servers behind the suspect's front domains. - Behavioral Time Zone Analysis: Automated HTTP ping scripts documented exact timestamps of HTTP 404s to mathematically prove coordinated evidence destruction. - Deep Code String Extraction: Recursive directory walks utilizing regular expressions were deployed to hunt for exact proprietary Synthicsoft variable names. 2.0 THE ORIGIN AND PRIMARY THREAT ACTOR The Leak: On March 31, 2026, an Anthropic NPM packaging error exposed the source map for Claude Code, including the embedded KAIROS daemon. The Primary Threat Actor: Cody Kickertz, operating under the GitHub handle forkwright . Proof of Extraction: On March 31, 2026, Kickertz opened Issue 2260 on the forkwright/aletheia repository, stating it was "Mined from Claude Code source." Between April 7 and April 8, 2026, Kickertz merged four pull requests 2577, 2591, 2592, 2593 , integrating the KAIROS autonomous dispatch cycle directly into Synthicsoft's Aletheia property and stripping copyright headers. Corporate Motive: Git commit metadata ties Kickertz to \ email protected\ https://rentry.co/cdn-cgi/l/email-protection 3.0 THE SYNDICATE NETWORK Cody Kickertz follows zero people on GitHub. His account is followed by a highly curated, closed circle of five active technical specialists. Forensic API extraction of this network reveals a coordinated, compartmentalized team. - Joseph Kim josephjdkim : Software Engineer at Summus Global in Brooklyn, NY. Actively tracking AI agentic frameworks and reverse engineering tools Ghidra . Role: Corporate Insider. - Arpit Raj arpitrajjj : Based in India. Operates the malware and botnet infrastructure. Role: Malware Developer. - nguyentiendat78: Based in Vietnam. Forked openclaw a derivative of the stolen Claude Code and malware/bot IP lists. Role: Proxy and API Rotation Operator. - skooch: Based in Australia. Forks include iBoot Apple bootloader and espressif-qemu . Role: Low-Level Systems Engineer and Container Evasion. - derekberkley: Based in Texas. Junior Developer and Bitcoin advocate. 4.0 THE SECONDARY COMMERCIAL NETWORK A separate network attempted to commercialize a "clean-room rewrite" of KAIROS under the repository uameer/heartbeat . A deep scan extracted exact proprietary KAIROS terminology hardcoded into their Python files heartbeat.py , heartbeat memory.py , containing the markers kairos , always-on , and autodream . The Actors: Usman Ameer Germany , Maksymilian Burdziej Poland , Chanchal Raj United Arab Emirates , and Mohamed Alani, an Operations Engineer at Woodward Incorporated Illinois, USA . 5.0 CYBERCRIME INFRASTRUCTURE AND WEAPONIZATION The Threat Actor: Arpit Raj \ email protected\ https://rentry.co/cdn-cgi/l/email-protection Proof of Botnet Infrastructure: Reverse engineering of his actions-testing repository revealed automated YAML workflows exploiting Microsoft and Apple cloud infrastructure to boot virtual Android devices, creating a cloud-hosted bot farm. Proof of Malware Deployment: The OnyxBridge C++ configuration file defines HEARTBEAT INTERVAL MS as 2000 and requests SEND SMS , RECEIVE SMS , and READ SMS permissions. This proves an intent to intercept messages, bypass two-factor authentication, and facilitate mass account fraud. Command and Control: Hardcoded C2 endpoint at https://onyxdashboard-7hi7.onrender.com . Additionally, the rich-editor-bot repository contains a hardcoded Telegram Bot Token 8912527344:AAF4pzrDdHX0wKoKw1b2kCguuquxAfUEIgw used for secondary C2. 6.0 GEOLOCATION AND OPERATIONAL SECURITY ANALYSIS Primary Geolocation: Git commit metadata from the not-of-work repository returned a timezone offset of +0530 India Standard Time , placing Arpit Raj in India during the initial cyberattack development. OPSEC Evasion: All subsequent repositories were committed with a timezone offset of +0000 UTC . This proves the actor deliberately transitioned to cloud-based virtual machines to obfuscate his physical location. 7.0 SPOLIATION OF EVIDENCE On October 23, 2026, at 9:45 PM Central Standard Time, during active automated forensic extraction, the primary repositories forkwright/aletheia and NullLabTests/claude-code-enhanced simultaneously returned HTTP 404 errors, indicating deletion. Time Zone Analysis: At that exact moment, it was 10:45 PM in New York, 4:45 AM in Europe, and 6:45 AM in the UAE. The mathematical improbability of a manual reaction at these hours proves automated surveillance of Synthicsoft or an insider tip-off. The immediate deletion constitutes obstruction of justice and a clear consciousness of guilt. 8.0 LEGAL RAMIFICATIONS AND POTENTIAL PENALTIES Criminal Liability: The Defend Trade Secrets Act and the Economic Espionage Act make the theft of proprietary trade secrets for commercial benefit a federal felony. Individuals face up to 10 years in federal prison and $250,000 in fines per offense. Corporate entities face fines up to $5 million. Using stolen code to secure a $20 million funding round constitutes securities fraud, carrying penalties of up to 20 years in federal prison. Civil Liability: For willful copyright infringement, plaintiffs can seek up to $150,000 per work infringed. Due to the deletion of repositories during active discovery, courts will issue severe spoliation sanctions, including default judgments and adverse inference instructions. RAW EVIDENCE EXTRACTS | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 | --- GIT COMMIT LOGS --- Commit: d90d9363 Date: 2026-08-31 19:18:12 UTC Author: Arpit Raj < email protected Message: Add GitHub Actions workflow for Zenserp Mass Reg Commit: 0f39a2de Date: 2026-08-31 19:17:05 UTC Author: Arpit Raj < email protected Message: Add mass registration script with email verification --- MALWARE CONFIG OnyxBridge --- pragma once include