LeakySensey: Solo Russian Hacker Built a $200K Proxy Empire by Brute-Forcing 87,000 Legacy VPN Devices

Executive Summary

On September 17, 2026, Cybernews published original research disclosing "LeakySensey" — a name the outlet assigned to a single, Russia-based threat actor whose command-and-control server it discovered exposed and unprotected on July 20, 2026, revealing a roughly two-year-old, six-figure residential proxy business built entirely on brute-forced, end-of-life VPN devices.¹ The operation compromised more than 87,000 IP addresses by mass-scanning the internet for exposed PPTP, L2TP, and SSH services, then password-spraying commonly weak or default credentials such as "admin" or "admin123" against routers, dedicated VPN appliances, and network-attached storage devices too old to run modern, encrypted VPN protocols.¹

The exposed server's leaked database showed the illicit proxy service processed more than 24,000 transactions since 2024, totaling roughly $202,000 in proceeds, paid through the cryptocurrency processor cryptomus.com and distributed to over 56,000 registered users, more than 11,000 of whom linked Telegram accounts.¹ The operator resold access both directly to individual proxy users and wholesale to residential-proxy platforms, with the exposed data showing purchasers including the VPN service VPN Pure alongside Pure Connect, Rich Proxy, Opm Proxy, For Friends, and SkySocks.¹

The most distinctive element of the operation's tradecraft is its use of a deliberately jailbroken version of Anthropic's Claude Code coding-agent tool. Cybernews found an automated patching pipeline on the server — five Python scripts covering discovery, analysis, implementation, integrity verification, and distribution — that modified each new Claude Code release to remove its trust-confirmation dialog, accept any AI model ID regardless of Anthropic's allowlist, route subagents to third-party model providers, disable prompt-level safety filtering, and auto-approve execution plans without human review.¹ The patched binaries were distributed as private NPM packages for multiple platforms and routed through a third-party open-source proxy router to spread requests across a pool of legitimate OpenAI, Google, and Anthropic accounts, apparently to work around per-account rate limits.¹ Cybernews states it disclosed its findings to Anthropic.¹

Multiple independent artifacts on the server — Russian-language code comments, configuration files, and AI prompts, the Russian-language storefront at sensey24[.]ru, and evidence the operator was actively researching ways to bypass Russia's own internet-censorship systems (TSPU and deep packet inspection) — support the assessment that the operator is based in Russia, though the server itself was hosted with a French cloud provider, OVH SAS.¹

Disclosure: This paper covers an incident in which a threat actor modified and abused Claude Code, a product made by Anthropic. ThreatPaper has no financial or editorial relationship with Anthropic; this is reported using the same evidentiary standard applied to any other vendor.

Verification of Claims

1. Claim: The operation compromised more than 87,000 IP addresses. → Verified — directly documented from the threat actor's own leaked server inventory, reviewed and reported by Cybernews.¹

2. Claim: The illicit service generated approximately $202,000 across more than 24,000 transactions since 2024. → Verified — sourced from leaked payment-processor transaction records on the exposed server.¹

3. Claim: LeakySensey used a jailbroken version of Claude Code to automate parts of the operation. → Verified — Cybernews recovered and describes the patching pipeline directly from the exposed server.¹

4. Claim: Residential proxy resellers such as VPN Pure knowingly purchased proxy access sourced from compromised, hijacked devices. → Unverified — the exposed data confirms these platforms purchased access from LeakySensey, but no source establishes whether the purchasing platforms knew or had reason to know the underlying IPs were compromised consumer/business devices rather than legitimately sourced residential proxy infrastructure.¹

5. Claim: The operator is based in Russia. → Partially verified — supported by consistent, multiple independent language and behavioral artifacts (Russian-language code, prompts, storefront, and active anti-censorship research specific to Russian systems), but this is an inference from artifacts, not a confirmed real-world identity or location.¹

Timeline

Attack Anatomy

Reconnaissance

The operator ran mass internet-wide scanning for exposed PPTP (port 1723), L2TP (port 1701), and SSH services, using purpose-built tools identified on the server as "PPTP API Server v3.2" and "ipgo3."¹ Cybernews cites Censys scan data showing 1.9 million hosts still expose PPTP and over 3 million expose L2TP globally — both protocols are decades-old and either fundamentally broken (PPTP handshakes can be captured and brute-forced cheaply even against strong passwords) or dependent on separately configured encryption that is frequently misconfigured or absent (L2TP).¹

Credential attack

Discovered hosts were password-sprayed against a list of weak and default credentials, most commonly "admin" or "admin123."¹ The server's leaked inventory recorded 63,000+ servers compromised via PPTP brute-forcing, 24,000+ via L2TP, and 24 via SSH.¹

Monetization

Compromised hosts had proxy software deployed and access was rented out; at the time of Cybernews' discovery, 17,858 of the compromised IPs had proxy credentials actively configured as "ready" or "connected."¹ Sales were made directly to individual users via Telegram bots and websites, and wholesale to residential-proxy resale platforms, with all payments centralized through the cryptocurrency processor cryptomus.com.¹ The operation presented itself publicly as a legitimate Russian software development and IT consulting firm via the sensey24[.]ru storefront.¹

AI-assisted tradecraft

An automated pipeline re-patched each new release of Claude Code to strip Anthropic's client-side safety controls — removing the trust-confirmation dialog, accepting arbitrary model IDs, permitting subagents to route to any AI provider, disabling prompt-level safety filtering, and auto-approving execution plans — producing an unsupervised coding-agent binary distributed as private NPM packages for macOS, Windows, and Linux.¹ Requests were routed through an open-source LLM proxy/router tool to spread load across a pool of AI provider accounts (12 Antigravity, 5 Codex, 2 Gemini, and 1 Claude account identified on the server) that used email addresses not found in prior data-breach corpora, suggesting legitimately registered accounts rather than stolen ones.¹

The operator's own incidents

The exposed server also revealed that LeakySensey had itself been breached twice: a Monero cryptominer was planted on the git-repository server (the operator noticed and removed 37 unauthorized accounts it had created), and separately the operator's own proxy-service API keys were stolen and abused by other criminals before being identified and rotated.¹

Threat Actor Profile

Name: LeakySensey (researcher-assigned name, after the operator's primary domain and the irony of the operator's own infrastructure being exposed) Assessed origin: Russia Attribution confidence: Moderate — based on consistent Russian-language artifacts across code, prompts, and the public storefront, plus behavioral evidence (active research into bypassing Russia's own TSPU/DPI censorship systems); the operator's real-world identity is not established in the reporting reviewed.¹

The operator appears to be a solo actor running what Cybernews characterizes as "rudimentary yet highly effective" tradecraft — commodity scanning and credential-spraying tools rather than novel exploits — layered with unusually sophisticated automation for jailbreaking and operating an AI coding agent at scale.¹ Server artifacts indicate the operator maintains a parallel, ostensibly legitimate career as a freelance web developer for Russian clients, with that work's source code hosted alongside the criminal infrastructure.¹

MITRE ATT&CK techniques:

Technical Indicators

storefront_domain:
  - sensey24[.]ru
discovered_server:
  ip_port: 37[.]187[.]136[.]86:9999   # inactive at time of publication; likely migrated
  host_provider: OVH SAS (France)
tooling_identified:
  - "PPTP API Server v3.2"
  - ipgo3
payment_processor:
  - cryptomus[.]com
reseller_platforms_named:
  - VPN Pure
  - Pure Connect
  - Rich Proxy
  - Opm Proxy
  - For Friends
  - SkySocks
scale_metrics:
  compromised_ips_total: "87,000+"
  compromised_via_pptp: "63,000+"
  compromised_via_l2tp: "24,000+"
  compromised_via_ssh: 24
  ips_active_as_proxy: 17858
  registered_users: "56,000+"
  telegram_linked_users: "11,000+"
  transactions_since_2024: "24,000+"
  gross_proceeds_usd: 202000
note: >
  No file hashes or C2 domains beyond the storefront and discovered server IP
  were published in the source reviewed; this reflects the nature of the
  disclosure (an exposed operator infrastructure investigation, not a
  malware-sample technical teardown).

Legal and Regulatory Response

No law enforcement action, takedown, or regulatory response tied to this specific operation had been publicly reported as of this paper's research cutoff (September 18, 2026). Cybernews states it disclosed its findings to Anthropic; no public statement from Anthropic in response is quoted or referenced in the source reviewed.¹

Impact Assessment

• Confirmed: 87,000+ IP addresses compromised via credential brute-forcing, per the operator's own leaked server inventory.¹
• Confirmed: Approximately $202,000 in gross proceeds across 24,000+ transactions since 2024, per leaked payment-processor records.¹
• Reported: Resale of proxy access to named platforms including VPN Pure; whether those platforms had knowledge of the underlying infrastructure's compromised origin is not established.¹
• Unknown: The identity of the individual operator; the current operational status of the network following the server's exposure and likely migration; and whether Anthropic has taken or plans any specific technical countermeasure in response to the disclosed jailbreak pipeline.¹

Lessons and Defensive Recommendations

For device owners/network operators:

• Replace end-of-life routers, VPN appliances, and NAS devices still running PPTP or L2TP; these protocols are fundamentally weak (PPTP) or dependent on separately, often incorrectly, configured encryption (L2TP).
• Where replacement is not immediately possible, do not expose PPTP/L2TP/SSH management interfaces directly to the internet, segregate such devices from the trusted network, and rotate any default or weak credentials immediately.
• Periodically check for unauthorized SOCKS5 proxy configurations or unexpected outbound connections on any internet-facing legacy device, per Cybernews researcher Aras Nazarovas' direct recommendation.¹

For residential-proxy platforms and their customers:

• The presence of a named, seemingly legitimate proxy platform (VPN Pure) among the buyers in this operation's leaked customer data is a reminder that "residential proxy" sourcing claims are not self-verifying; platforms that cannot describe how their IP pool is obtained warrant scrutiny before commercial use.

For AI vendors and platform security teams:

• A five-stage automated pipeline that re-patches a vendor's CLI tool on every new release to strip client-side safety controls indicates that shipping safety and trust checks purely as client-side, binary-level gates is not sufficient against a motivated, technically capable adversary; server-side/account-level abuse detection (unusual request patterns, model-ID mismatches, anomalous account fan-out through proxy routers) is a necessary complementary control.

For incident responders:

• When investigating a hijacked-device/proxy-network case, do not assume a single technical exploit — this operation succeeded almost entirely through credential weakness and protocol obsolescence, not novel vulnerability exploitation, meaning detection strategies built around patch/CVE tracking alone would have missed it entirely.

Sources