KeyHunter Operation: leepsmarts LLM API Key Theft & Academic Fraud Campaign — OTX Detection Pack

---
title: KeyHunter LLM API Key Harvesting - Exposed Environment File Access
description: Detects web requests attempting to access exposed .env files or environment config endpoints commonly scanned by leepsmarts infrastructure during Operation KeyHunter
status: experimental
date: 2026/11/04
author: Security Arsenal Threat Intelligence
logsource:
    category: webserver
    service: access
    product: generic
detection:
    selection_uri:
        c-uri|contains:
            - '/.env'
            - '/.env.production'
            - '/.env.local'
            - '/config.env'
            - '/api/config'
            - '/_next/env'
    selection_status:
        sc-status: 200
    filter_scanner_ips:
        c-ip:
            - '14.47.118.194'
            - '190.114.197.2'
            - '46.39.24.98'
    condition: selection_uri and (selection_status or filter_scanner_ips)
falsepositives:
    - Legitimate internal health checks on misrouted endpoints
    - Developer debugging from corporate IP ranges
level: high
tags:
    - attack.t1552.001
    - attack.t1190
---
title: KeyHunter Telegram Bot C2 Communication
description: Detects outbound HTTPS connections to Telegram Bot API endpoints from non-standard processes, consistent with leepsmarts credential exfiltration via Telegram bots
status: experimental
date: 2026/11/04
author: Security Arsenal Threat Intelligence
logsource:
    category: network_connection
    product: windows
detection:
    selection_dest:
        DestinationHostname|contains:
            - 'api.telegram.org'
            - 'juanwangccbotgithubgithub.com'
    selection_process_suspicious:
        Image|endswith:
            - '\powershell.exe'
            - '\cmd.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\python.exe'
            - '\node.exe'
    filter_known_bots:
        User|contains: 'telegram_bot_service_account'
    condition: selection_dest and selection_process_suspicious and not filter_known_bots
falsepositives:
    - Legitimate developer automation using Telegram notifications
    - IT alerting scripts
level: medium
tags:
    - attack.t1102
    - attack.t1071.001
    - attack.t1041
---
title: KeyHunter IOC Infrastructure Contact
description: Detects network connections to known leepsmarts Operation KeyHunter infrastructure IPs identified in OTX pulse data
status: experimental
date: 2026/11/04
author: Security Arsenal Threat Intelligence
logsource:
    category: network_connection
detection:
    selection:
        DestinationIp:
            - '14.47.118.194'
            - '190.114.197.2'
            - '46.39.24.98'
    condition: selection
falsepositives:
    - Unlikely; these IPs are attributed to active campaign infrastructure
level: critical
tags:
    - attack.t1071
    - attack.t1102

// KeyHunter Hunt: leepsmarts infrastructure contact + Telegram bot C2 + env-file scanning behavior
// Microsoft Sentinel / Defender XDR — run over last 30 days
let KeyHunterIPs = dynamic(["14.47.118.194", "190.114.197.2", "46.39.24.98"]);
let KeyHunterDomain = "juanwangccbotgithubgithub.com";
let NetworkHits = DeviceNetworkEvents
    | where Timestamp > ago(30d)
    | where RemoteIP in (KeyHunterIPs)
       or RemoteUrl contains KeyHunterDomain
       or (RemoteUrl contains "api.telegram.org" and InitiatingProcessFileName in~ ("powershell.exe","cmd.exe","wscript.exe","python.exe","node.exe"))
    | project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort, ActionType
    | extend HitType = "NetworkIOC_or_TelegramC2";
let ProcessHits = DeviceProcessEvents
    | where Timestamp > ago(30d)
    | where ProcessCommandLine has_any (".env", "api_key", "apikey", "OPENAI_API_KEY", "ANTHROPIC_API_KEY", "sk-", "curl", "wget")
       and FileName in~ ("powershell.exe", "cmd.exe", "curl.exe", "wget.exe", "python.exe")
    | project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, AccountName
    | extend HitType = "CredentialAccessBehavior";
union NetworkHits, ProcessHits
| sort by Timestamp desc

# KeyHunter IOC Hunt Script - leepsmarts Operation Artifacts
# Checks: network connections to known IOCs, suspicious Telegram API contact,
# exposed .env artifacts in web roots, and recent downloads of bot payload domains
# Run elevated on endpoints and web/application servers

$KeyHunterIPs   = @('14.47.118.194','190.114.197.2','46.39.24.98')
$KeyHunterDomain = 'juanwangccbotgithubgithub.com'
$Report = @()

Write-Host '[*] KeyHunter IOC Sweep - leepsmarts Campaign' -ForegroundColor Cyan

# 1. Active + historical TCP connections to campaign IPs
Write-Host '[1] Checking network connections to KeyHunter IPs...'
$conns = Get-NetTCPConnection -ErrorAction SilentlyContinue |
    Where-Object { $KeyHunterIPs -contains $_.RemoteAddress }
foreach ($c in $conns) {
    $proc = Get-Process -Id $c.OwningProcess -ErrorAction SilentlyContinue
    $Report += [PSCustomObject]@{
        Check   = 'NetworkConnection'
        Finding = "Connection to $($c.RemoteAddress):$($c.RemotePort) by $($proc.ProcessName) (PID $($c.OwningProcess))"
        Severity = 'CRITICAL'
    }
}

# 2. DNS cache check for typosquat bot domain
Write-Host '[2] Checking DNS cache for KeyHunter bot domain...'
$dns = Get-DnsClientCache -ErrorAction SilentlyContinue |
    Where-Object { $_.Entry -like "*$KeyHunterDomain*" }
if ($dns) {
    $Report += [PSCustomObject]@{
        Check = 'DNSCache'
        Finding = "DNS resolution of $KeyHunterDomain found in cache"
        Severity = 'CRITICAL'
    }
}

# 3. Web server logs for .env probing (IIS default path)
Write-Host '[3] Scanning IIS logs for .env access attempts...'
$iisLogRoot = 'C:\inetpub\logs\LogFiles'
if (Test-Path $iisLogRoot) {
    $hits = Get-ChildItem $iisLogRoot -Recurse -Filter '*.log' -ErrorAction SilentlyContinue |
        Select-String -Pattern '/\.env' -SimpleMatch -ErrorAction SilentlyContinue |
        Select-Object -First 20
    foreach ($h in $hits) {
        $Report += [PSCustomObject]@{
            Check = 'WebLog'
            Finding = ".env probe in $($h.Path): $($h.Line.Substring(0,[Math]::Min(150,$h.Line.Length)))"
            Severity = 'HIGH'
        }
    }
}

# 4. Exposed .env files in common web/deployment roots
Write-Host '[4] Checking for exposed .env files in web roots...'
$webRoots = @('C:\inetpub\wwwroot','C:\xampp\htdocs','C:\var\www')
foreach ($root in $webRoots) {
    if (Test-Path $root) {
        Get-ChildItem $root -Recurse -Filter '.env*' -ErrorAction SilentlyContinue |
            ForEach-Object {
                $Report += [PSCustomObject]@{
                    Check = 'ExposedEnvFile'
                    Finding = "Exposed env file: $($_.FullName)"
                    Severity = 'HIGH'
                }
            }
    }
}

# 5. Suspicious scheduled tasks referencing telegram/curl/node (drainer persistence)
Write-Host '[5] Checking scheduled tasks for bot persistence...'
Get-ScheduledTask -ErrorAction SilentlyContinue | ForEach-Object {
    $actions = $_.Actions | Out-String
    if ($actions -match 'telegram|juanwang|curl\.exe|node\.exe.*bot') {
        $Report += [PSCustomObject]@{
            Check = 'ScheduledTask'
            Finding = "Suspicious task '$($_.TaskName)': $($actions.Trim())"
            Severity = 'CRITICAL'
        }
    }
}

# Output
if ($Report.Count -eq 0) {
    Write-Host '[+] No KeyHunter IOCs or artifacts found on this host.' -ForegroundColor Green
} else {
    Write-Host "[!] $($Report.Count) finding(s) detected:" -ForegroundColor Red
    $Report | Sort-Object Severity | Format-Table -AutoSize
    $Report | Export-Csv -Path ".\keyhunter_hunt_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv" -NoTypeInformation
}