Mass-exploitation operation run by an AI coding agent ('kimi-code') from a Russian operator memory file, incl. Ivanti Connect Secure chain

Etugen (3 Nov 2026) crawled an open directory on 208.85.17[.]99 (Vultr, AS20473), the attack proxy named after 108.165.147[.]64 (the IP Volexity published for UTA0576's Ivanti Connect Secure chain). It found an Ivanti exploit framework (/ivanti/exp2.py, SHA-256 7aa9f64e71d7d6dde8a6c0db200dc73a7064ac4adf65bb0f9affd9236351ba0c), 168 exploit run logs against ICS targets in several countries, IceWarp/MLflow/MinIO/CyberPanel target lists, stolen data and leaked cloud keys. It also found OPERATION_MEMORY.md (SHA-256 afc3f9b853243c88bfb5678fd86c4a2985fceffa8554a119fabb793eea2a8bd7), a 391 KB Russian 'canonical memory' file for an AI coding agent named 'kimi-code'. The file sets OPSEC rules ('work quietly, like APT/NSA'), records the VPS rotation 70.34.215[.]12 -> 139.84.235[.]230 -> 108.165.147[.]64 -> 208.85.17[.]99 (sole proxy since 14 Oct), and names the operator box 185.130.227[.]232 (egress 62.212.70[.]235). It describes a broad financially motivated data-theft and ransomware campaign (16 Sep-14 Oct 2026). Etugen ties the host to the published IOC with high confidence and to UTA0576 with only moderate confidence. The IPs known only from the notes are uncorroborated.