{"id":"CMP-202611-uhgzhk","kind":"campaign","aliases":[],"related":["CVE-2026-118527","CVE-2026-111357","CVE-2026-104935"],"title":"Mass-exploitation operation run by an AI coding agent ('kimi-code') from a Russian operator memory file, incl. Ivanti Connect Secure chain","description":null,"summary":"Etugen (3 Nov 2026) crawled an open directory on 208.85.17[.]99 (Vultr, AS20473), the attack proxy named after 108.165.147[.]64 (the IP Volexity published for UTA0576's Ivanti Connect Secure chain). It found an Ivanti exploit framework (/ivanti/exp2.py, SHA-256 7aa9f64e71d7d6dde8a6c0db200dc73a7064ac4adf65bb0f9affd9236351ba0c), 168 exploit run logs against ICS targets in several countries, IceWarp/MLflow/MinIO/CyberPanel target lists, stolen data and leaked cloud keys. It also found OPERATION_MEMORY.md (SHA-256 afc3f9b853243c88bfb5678fd86c4a2985fceffa8554a119fabb793eea2a8bd7), a 391 KB Russian 'canonical memory' file for an AI coding agent named 'kimi-code'. The file sets OPSEC rules ('work quietly, like APT/NSA'), records the VPS rotation 70.34.215[.]12 -> 139.84.235[.]230 -> 108.165.147[.]64 -> 208.85.17[.]99 (sole proxy since 14 Oct), and names the operator box 185.130.227[.]232 (egress 62.212.70[.]235). It describes a broad financially motivated data-theft and ransomware campaign (16 Sep-14 Oct 2026). Etugen ties the host to the published IOC with high confidence and to UTA0576 with only moderate confidence. The IPs known only from the notes are uncorroborated.","severity":"high","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-11-04T15:52:38+00:00","products":[],"ecosystems":[],"tags":["ai-agent","campaign","ivanti-connect-secure","mass-exploitation","open-directory"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-03T00:00:00+00:00","first_seen_at":"2026-11-04T15:52:38+00:00","triaged_at":"2026-11-04T15:52:38+00:00","updated_at":"2026-11-04T15:54:01+00:00","category":"infrastructure","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-14':175B '-202611':26A '-256':81B,107B '/ivanti/exp2.py':79B '108.165.147':60B,142B '12':139B '139.84.235':140B '14':149B '16':173B '168':83B '185.130.227':156B '2026':45B,177B '208.85.17':51B,144B '230':141B '232':157B '235':160B '3':43B '391':110B '62.212.70':159B '64':61B,143B '70.34.215':138B '7aa9f64e71d7d6dde8a6c0db200dc73a7064ac4adf65bb0f9affd9236351ba0c':82B '99':52B,145B 'afc3f9b853243c88bfb5678fd86c4a2985fceffa8554a119fabb793eea2a8bd7':108B 'agent':10A,30B,120B 'ai':8A,29B,118B 'ai-ag':28B 'also':103B 'apt/nsa':133B 'as20473':54B 'attack':56B 'box':155B 'broad':164B 'campaign':31B,172B 'canon':113B 'chain':24A,72B 'cloud':100B 'cmp':25A 'code':9A,13A,119B,124B 'confid':188B,195B 'connect':22A,34B,70B 'countri':92B 'crawl':46B 'data':97B,168B 'data-theft':167B 'describ':162B 'directori':41B,49B 'egress':158B 'etugen':42B,178B 'exploit':3A,38B,77B,84B 'file':19A,115B,126B 'financi':165B 'found':74B,104B 'framework':78B 'high':187B 'host':181B 'ic':88B 'icewarp/mlflow/minio/cyberpanel':93B 'incl':20A 'ioc':185B 'ip':63B,197B 'ivanti':21A,33B,69B,76B 'ivanti-connect-secur':32B 'kb':111B 'key':101B 'kimi':12A,123B 'kimi-cod':11A,122B 'known':198B 'leak':99B 'like':132B 'list':95B 'log':86B 'mass':2A,37B 'mass-exploit':1A,36B 'memori':18A,114B 'moder':194B 'motiv':166B 'name':58B,121B,152B 'note':202B 'nov':44B 'oct':150B,176B 'open':40B,48B 'open-directori':39B 'oper':4A,17A,154B 'operation_memory.md':105B 'opsec':128B 'proxi':57B,147B 'publish':65B,184B 'quiet':131B 'ransomwar':171B 'record':134B 'rotat':137B 'rule':129B 'run':5A,85B 'russian':16A,112B 'secur':23A,35B,71B 'sep':174B 'set':127B 'sever':91B 'sha':80B,106B 'sinc':148B 'sole':146B 'stolen':96B 'target':89B,94B 'theft':169B 'tie':179B 'uhgzhk':27A 'uncorrobor':204B 'uta0576':67B,191B 'volex':64B 'vps':136B 'vultr':53B 'work':130B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":[],"ptokens":[],"labels":["aiagent","campaign","high","infrastructure","ivanticonnectsecure","massexploitation","opendirectory"],"campaign_type":"exploitation","first_public_at":"2026-11-03T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-uhgzhk","url":null,"severity":null,"published_at":"2026-11-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-11-04T15:52:38+00:00","fetched_at":"2026-11-04T15:52:38+00:00","note":null}],"documents":[{"id":68048,"url":"https://etugen.io/blog/ivanti-zero-day-operation/","title":"Etugen: An Ivanti Zero-Day Operation Where the Dead Proxy Was Named in the Operator's Notes (3 Nov 2026)","kind":"blog","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}