Themis Docket: KAIROS Theft Analysis

Forensic Analysis of the KAIROS Intellectual Property Theft and Cybercrime Network

Date of Release: October 24, 2026

Executive Summary

This report details the targeted theft, concealment, weaponization, and attempted commercialization of proprietary intellectual property belonging to Synthicsoft Labs LLC. The stolen assets are the KAIROS Always-On Daemon and the Aletheia framework, originally created by CEO Adam Rivers. Following an accidental NPM source code leak at Anthropic on March 31, 2026, a multi-jurisdictional syndicate executed a coordinated scheme to mine the leaked code, integrate it into commercial platforms to defraud investors, and deploy it as a distributed Android botnet. The evidence is irrefutable and has been prepared for federal referral.

1.0 Verification and Reproduction Methodology

To ensure the evidence is admissible in a court of law and reproducible by independent forensic examiners, this investigation utilized a strict multi-vector approach: Repository Cloning via Dulwich with SHA-256 hashing for chain of custody; API Scraping to extract follower networks before deletion; Infrastructure Tracing via DNS and SSL logs; Behavioral Time Zone Analysis to document HTTP 404s; and Deep Code String Extraction to hunt for proprietary variable names.

2.0 The Origin and Primary Threat Actor

On March 31, 2026, an Anthropic NPM packaging error exposed the source map for Claude Code. Cody Kickertz (forkwright) executed the earliest extraction, opening Issue #2260 on the 'forkwright/aletheia' repository, stating it was 'Mined from Claude Code source.' Between April 7 and April 8, 2026, Kickertz merged four pull requests, integrating the KAIROS autonomous dispatch cycle directly into Synthicsoft's Aletheia property and stripping copyright headers. Git commit metadata ties Kickertz to ckickertz@summusglobal.com. SEC filings prove Summus Global closed a $20 million Series C funding round on April 7, 2026. The stolen code was integrated to artificially inflate the company's valuation for investors including Danaher and the Glenstone Foundation.

3.0 The Syndicate Network

Cody Kickertz follows zero people on GitHub. His account is followed by a highly curated, closed circle of five active technical specialists. This includes Joseph Kim (josephjdkim), a Software Engineer at Summus Global in Brooklyn, NY, who was tracking AI agentic frameworks and reverse engineering tools (Ghidra). It also includes Arpit Raj (arpitrajjj), based in India, operating the malware and botnet infrastructure; nguyentiendat78 (Vietnam) providing proxy and API rotation; skooch (Australia) handling low-level systems engineering; and derekberkley (Texas).

4.0 The Secondary Commercial Network

A separate network attempted to commercialize a 'clean-room rewrite' of KAIROS under the repository 'uameer/heartbeat'. A deep scan extracted exact proprietary KAIROS terminology hardcoded into their Python files (heartbeat.py, heartbeat_memory.py), containing the markers 'kairos', 'always-on', and 'autodream'. The actors include Usman Ameer (Germany), Maksymilian Burdziej (Poland), Chanchal Raj (United Arab Emirates), and Mohamed Alani, an Operations Engineer at Woodward Incorporated (Illinois, USA).

5.0 Cybercrime Infrastructure and Weaponization

Arpit Raj (ashondrugs@proton.me) weaponized the stolen code. Reverse engineering of his 'actions-testing' repository revealed automated YAML workflows exploiting Microsoft and Apple cloud infrastructure to boot virtual Android devices, creating a cloud-hosted bot farm. The 'OnyxBridge' C++ configuration file defines HEARTBEAT_INTERVAL_MS as 2000 and requests SEND_SMS, RECEIVE_SMS, and READ_SMS permissions, proving an intent to intercept messages, bypass two-factor authentication, and facilitate mass account fraud. The Command and Control endpoint is hardcoded at https://onyxdashboard-7hi7.onrender.com, with a secondary Telegram Bot Token found in the 'rich-editor-bot' repository.

6.0 Geolocation and Operational Security Analysis

Git commit metadata from the 'not-of-work' repository returned a timezone offset of +0530 (India Standard Time), placing Arpit Raj in India during the initial cyberattack development. All subsequent repositories were committed with a timezone offset of +0000 (UTC), proving the actor deliberately transitioned to cloud-based virtual machines to obfuscate his physical location.

7.0 Spoliation of Evidence

On October 23, 2026, at 9:45 PM Central Standard Time, during active automated forensic extraction, the primary repositories 'forkwright/aletheia' and 'NullLabTests/claude-code-enhanced' simultaneously returned HTTP 404 errors, indicating deletion. The mathematical improbability of a manual reaction at these hours across multiple time zones proves automated surveillance of Synthicsoft or an insider tip-off. The immediate deletion constitutes obstruction of justice and a clear consciousness of guilt.

8.0 Legal Ramifications and Potential Penalties

The Defend Trade Secrets Act and the Economic Espionage Act make the theft of proprietary trade secrets for commercial benefit a federal felony. Individuals face up to 10 years in federal prison and $250,000 in fines per offense. Corporate entities face fines up to $5 million. Using stolen code to secure a $20 million funding round constitutes securities fraud, carrying penalties of up to 20 years in federal prison. For willful copyright infringement, plaintiffs can seek up to $150,000 per work infringed. Due to the deletion of repositories during active discovery, courts will issue severe spoliation sanctions, including default judgments and adverse inference instructions.

Full Report

Read the complete forensic report and view the evidence here: https://github.com/SynthicsoftLabs/KAIROS_Forensics