Skip to content
OriginalSign in
Image: SOCRadar

SOCRadarAmeer Owda

SOCRadar links leepsmarts to LLM key theft and academic fraud

Part of the CVE-2026-41940 story · since 29 Apr

Developinglatest 2 hours ago17 articles10 outlets
29 Apr · Rapid7 first2 Aug3 Sep5 OctNowThis article17th of 17
  • Wed 29 Apr, 22:19 UTC. Rapid7, first report. Critical cPanel Flaw Lets Hackers Hijack Admin Access Remotely. Cites a CVE in CISA KEV.
  • Thu 30 Apr, 11:40 UTC. SecurityWeek, its first report on the story. Critical cPanel Auth Bypass (CVE-2026-41940) Exposes 1.5M Servers. Cites a CVE in CISA KEV.
  • Thu 30 Apr, 17:21 UTC. CISA, its first report on the story. CISA Flags Critical cPanel & WHM Bug CVE‑2026‑41940 Under Attack. Cites a CVE in CISA KEV.
  • Thu 30 Apr, 17:59 UTC. CISA. CISA flags critical cPanel WHM auth flaw allowing remote takeover. Cites a CVE in CISA KEV.
  • Thu 30 Apr, 23:12 UTC. DataBreaches, its first report on the story. “to recover your files, kindly send 0.1 BTC to…” ransom note appears on websites. Cites a CVE in CISA KEV.
  • Fri 1 May, 11:33 UTC. Malwarebytes, its first report on the story. Critical cPanel WHM bypass lets attackers hijack admin access. Cites a CVE in CISA KEV.
  • Sun 3 May, 15:11 UTC. Security Affairs, its first report on the story. CISA adds critical cPanel auth bypass flaw to KEV catalogue. Cites a CVE in CISA KEV.
  • Mon 4 May, 08:51 UTC. SecurityWeek. Attackers hit over 40k cPanel servers via CVE-2026-41940 flaw. Cites a CVE in CISA KEV.
  • Mon 4 May, 11:01 UTC. The Hacker News, its first report on the story. Critical cPanel Vulnerability Weaponized to Target Government and MSP Networks. Cites a CVE in CISA KEV.
  • Mon 4 May, 16:11 UTC. The Hacker News. Hacker News Weekly: Exploits Outpace Patches, Systems at Risk.. Cites a CVE in CISA KEV.
  • Mon 4 May, 20:11 UTC. Dark Reading, its first report on the story. Attackers Exploit cPanel Flaw, Endangering Millions of Websites. Cites a CVE in CISA KEV.
  • Mon 4 May, 20:12 UTC. Security Affairs. cPanel auth bypass exploited in Asian gov, MSP attacks. Cites a CVE in CISA KEV.
  • Thu 7 May, 23:31 UTC. dti.domaintools.com, its first report on the story. DomainTools Investigations | Cybersecurity Reading List - Week of 2026-05-04. Cites a CVE in CISA KEV.
  • Mon 11 May, 18:00 UTC. The Hacker News. Mr_Rot13 Exploits Critical cPanel Flaw, Deploys Filemanager. Cites a CVE in CISA KEV.
  • Tue 12 May, 12:10 UTC. Security Affairs. Attackers exploit cPanel CVE-2026-41940 to deploy Filemanager Backdoor. Cites a CVE in CISA KEV.
  • Sun 17 May, 14:21 UTC. Security Affairs. Security Affairs Round 97 Covers JDownloader Hacked, TrickMo Rise. Cites a CVE in CISA KEV.
  • Wed 4 Nov, 10:00 UTC. SOCRadar, its first report on the story. SOCRadar links leepsmarts to LLM key theft and academic fraud. Cites a CVE in CISA KEV. This article, 17th of 17.

SOCRadar’s Threat Research Unit attributes the KeyHunter Operation to the Chinese-speaking actor leepsmarts, who allegedly runs two intertwined campaigns: theft of LLM API credentials from misconfigured cloud infrastructure, and an academic fraud push targeting 20 institutions (19 in the United States). In total, the operation harvested 2,233 API keys, with 12 marked valid by the actor’s tooling and 247 exposed LLM gateways catalogued.

Keys span providers including Anthropic, OpenAI, Google and DeepSeek, with an Anthropic OAuth token and three DeepSeek keys observed in the actor’s LEEP group. The operation also functions from infrastructure in China, South Korea, Malaysia and the US, coordinated via Hermes Agent and OpenClaw AI frameworks, and managed from a custom dashboard on the actor’s primary server.

Harvard alumni data surfaced in August 2026, with 195 records (names, AAD numbers and Harvard addresses) processed from a torrent-distributed dataset tied to the November 2025 ShinyHunters incident; SOCRadar notes this as data exposure rather than a confirmed intrustion into Harvard systems.

Twenty institutions were targeted overall, including account creation at NYU, UC Berkeley, Oregon State and several state universities, plus application payment links for Stanford, UChicago, Wake Forest, Case Western and Central Michigan. A CVE-2026-41940 exploit was staged against named institutions, but no successful exploitation is confirmed at this time.

The campaign also encompasses a cryptocurrency drainer, credit card validation using stolen Stripe keys, and a structured academic-fraud workflow conducted from a Malaysia-based OpenClaw node.

How the story developed

All 17 articles
Developinglatest 2 hours ago17 articles10 outlets

17 articles from 10 outlets since 29 Apr. Picked up again today after 24 weeks quiet. This was the 17th report, 188 days after the first.

Now29 Apr24681012141618First reportRapid7 · 29 Apr, 22:19This article17th of 17 · day 189CISA alert30 Apr, 17:21 · official
  • Wed 29 Apr, 22:19 UTC. Rapid7, first report. Critical cPanel Flaw Lets Hackers Hijack Admin Access Remotely. Cites a CVE in CISA KEV.
  • Thu 30 Apr, 11:40 UTC. SecurityWeek, its first report on the story. Critical cPanel Auth Bypass (CVE-2026-41940) Exposes 1.5M Servers. Cites a CVE in CISA KEV.
  • Thu 30 Apr, 17:21 UTC. CISA, its first report on the story. CISA Flags Critical cPanel & WHM Bug CVE‑2026‑41940 Under Attack. Cites a CVE in CISA KEV.
  • Thu 30 Apr, 17:59 UTC. CISA. CISA flags critical cPanel WHM auth flaw allowing remote takeover. Cites a CVE in CISA KEV.
  • Thu 30 Apr, 23:12 UTC. DataBreaches, its first report on the story. “to recover your files, kindly send 0.1 BTC to…” ransom note appears on websites. Cites a CVE in CISA KEV.
  • Fri 1 May, 11:33 UTC. Malwarebytes, its first report on the story. Critical cPanel WHM bypass lets attackers hijack admin access. Cites a CVE in CISA KEV.
  • Sun 3 May, 15:11 UTC. Security Affairs, its first report on the story. CISA adds critical cPanel auth bypass flaw to KEV catalogue. Cites a CVE in CISA KEV.
  • Mon 4 May, 08:51 UTC. SecurityWeek. Attackers hit over 40k cPanel servers via CVE-2026-41940 flaw. Cites a CVE in CISA KEV.
  • Mon 4 May, 11:01 UTC. The Hacker News, its first report on the story. Critical cPanel Vulnerability Weaponized to Target Government and MSP Networks. Cites a CVE in CISA KEV.
  • Mon 4 May, 16:11 UTC. The Hacker News. Hacker News Weekly: Exploits Outpace Patches, Systems at Risk.. Cites a CVE in CISA KEV.
  • Mon 4 May, 20:11 UTC. Dark Reading, its first report on the story. Attackers Exploit cPanel Flaw, Endangering Millions of Websites. Cites a CVE in CISA KEV.
  • Mon 4 May, 20:12 UTC. Security Affairs. cPanel auth bypass exploited in Asian gov, MSP attacks. Cites a CVE in CISA KEV.
  • Thu 7 May, 23:31 UTC. dti.domaintools.com, its first report on the story. DomainTools Investigations | Cybersecurity Reading List - Week of 2026-05-04. Cites a CVE in CISA KEV.
  • Mon 11 May, 18:00 UTC. The Hacker News. Mr_Rot13 Exploits Critical cPanel Flaw, Deploys Filemanager. Cites a CVE in CISA KEV.
  • Tue 12 May, 12:10 UTC. Security Affairs. Attackers exploit cPanel CVE-2026-41940 to deploy Filemanager Backdoor. Cites a CVE in CISA KEV.
  • Sun 17 May, 14:21 UTC. Security Affairs. Security Affairs Round 97 Covers JDownloader Hacked, TrickMo Rise. Cites a CVE in CISA KEV.
  • Wed 4 Nov, 10:00 UTC. SOCRadar, its first report on the story. SOCRadar links leepsmarts to LLM key theft and academic fraud. Cites a CVE in CISA KEV. This article, 17th of 17.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 17 articles as a list
  1. Wed 29 AprDay 01
    1. Critical cPanel Flaw Lets Hackers Hijack Admin Access Remotely22:19 · Rapid7 · First report · Exploited CVE · Known exploited CVE
  2. Thu 30 AprDay 14
    1. Critical cPanel Auth Bypass (CVE-2026-41940) Exposes 1.5M Servers11:40 · SecurityWeek · Known exploited CVE
    2. CISA Flags Critical cPanel & WHM Bug CVE‑2026‑41940 Under Attack17:21 · CISA · official · CISA alert · Known exploited CVE
    3. CISA flags critical cPanel WHM auth flaw allowing remote takeover17:59 · CISA · official · Known exploited CVE
    4. “to recover your files, kindly send 0.1 BTC to…” ransom note appears on websites23:12 · DataBreaches · Known exploited CVE
  3. Fri 1 MayDay 21
    1. Critical cPanel WHM bypass lets attackers hijack admin access11:33 · Malwarebytes · Known exploited CVE

  4. Quiet for 2 days

    Sun 3 MayDay 41
    1. CISA adds critical cPanel auth bypass flaw to KEV catalogue15:11 · Security Affairs · Picked up again · Known exploited CVE
  5. Mon 4 MayDay 55
    1. Attackers hit over 40k cPanel servers via CVE-2026-41940 flaw08:51 · SecurityWeek · Known exploited CVE
    2. Critical cPanel Vulnerability Weaponized to Target Government and MSP Networks11:01 · The Hacker News · Known exploited CVE
    3. Hacker News Weekly: Exploits Outpace Patches, Systems at Risk.16:11 · The Hacker News · Known exploited CVE
    Show 2 more from 4 May
    1. Attackers Exploit cPanel Flaw, Endangering Millions of Websites20:11 · Dark Reading · Known exploited CVE
    2. cPanel auth bypass exploited in Asian gov, MSP attacks20:12 · Security Affairs · Known exploited CVE

  6. Quiet for 3 days

    Thu 7 MayDay 81
    1. DomainTools Investigations | Cybersecurity Reading List - Week of 2026-05-0423:31 · dti.domaintools.com · Picked up again · Known exploited CVE

  7. Quiet for 4 days

    Mon 11 MayDay 121
    1. Mr_Rot13 Exploits Critical cPanel Flaw, Deploys Filemanager18:00 · The Hacker News · Picked up again · Known exploited CVE
  8. Tue 12 MayDay 131
    1. Attackers exploit cPanel CVE-2026-41940 to deploy Filemanager Backdoor12:10 · Security Affairs · Known exploited CVE

  9. Quiet for 5 days

    Sun 17 MayDay 181
    1. Security Affairs Round 97 Covers JDownloader Hacked, TrickMo Rise14:21 · Security Affairs · Picked up again · Known exploited CVE

  10. Quiet for 24 weeks

    Wed 4 NovDay 1891
    1. SOCRadar links leepsmarts to LLM key theft and academic fraud10:00 · SOCRadar · Picked up again · Known exploited CVE · This article, 17th of 17

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in