Harvard Alumni Data and Stanford Applications Leaked on Dark Web
Original title: KeyHunter Operation: Harvard Alumni Data, Stanford Applications and LLM Key Theft
Leaked data includes Harvard alumni records and Stanford university applications, along with LLM keys.
SOCRadar reported on the KeyHunter operation where sensitive data from Harvard alumni and Stanford applications, plus LLM keys, were exposed on the dark web. The leaks were scanned by SOCRadar's tools.
Unconfirmed: No specific threat group is named in the report
- Leaked Harvard alumni data
- Stanford university applications leaked
- LLM keys stolen
Impact: data exposure on dark web
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | astrdark.cyou | Malaysia-based OpenClaw host, tied to the senhai[.]store / astrdark[.]cyou / xxtt[.]me domain cluster and linked by a shared PentAGI |
| domain | senhai.store | fied by IP plus a Malaysia-based OpenClaw host, tied to the senhai[.]store / astrdark[.]cyou / xxtt[.]me domain cluster and linked b |
| domain | xxtt.me | enClaw host, tied to the senhai[.]store / astrdark[.]cyou / xxtt[.]me domain cluster and linked by a shared PentAGI CA certific |
| ipv4 | 123.60.2.245 | l keys, CUA Driver v0.22.2, systemd service, AIradar cron 123.60.2[.]245 AS55990 · Huawei Cloud, CN PentAGI + Xingrin ASM PentAGI |
| ipv4 | 14.47.118.194 | rtificate, pentagi.senhai[.]store, yyhuni author metadata 14.47.118[.]194 AS4766 · Korea Telecom, KR Open WebUI + Wazuh SIEM PentAG |
| ipv4 | 173.231.39.244 | er Open directory, 110 files, dashboard :9997, bot tokens 173.231.39[.]244 AS18450 · WebNX, US Hermes Agent node .env with Exa/Firec |
| ipv4 | 209.112.91.74 | 2026, SOCRadar detected a server listening on port 8899 at 209.112.91[.]74, with directory listing enabled and exposing 110 files ac |
| ipv4 | 66.42.94.67 | ficate, Open WebUI :8080, Wazuh :7547, MCP session header 66.42.94[.]67 Vultr Relay gateway gateway.log: accepted connection from |
From the original article
11 min read at socradar.io
The KeyHunter Operation pairs LLM key theft with an academic fraud campaign that reaches Harvard alumni data, Stanford applications and 18 other universities. SOCRadar’s Threat Research Unit (STRU) attributes the operation to leepsmarts, a Chinese-speaking threat actor, with activity confirmed as late as October 13, 2026. The operation runs on two main tracks: theft of […]
By Ameer Owda · socradar.io
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.