A hacker dubbed LeakySensey, who researchers believe is likely operating from Russia, controls a massive residential proxy network consisting of roughly 87,000 IP addresses. To find vulnerable routers and other devices using outdated VPN protocols, he relies on automation and AI-powered tools, then rents out access to the compromised IP addresses.
Researchers uncovered a large underground proxy network built on thousands of compromised devices around the world. The threat actor was dubbed LeakySensey after his main domain and the ironic fact that his own infrastructure had also been compromised and left exposed to unauthorized access.
According to the available data, the operator compromised more than 87,000 IP addresses and resells them to residential proxy providers, as well as directly to users through Telegram bots and various websites. For comparison, Tor, the world’s largest public anonymity network, has more than 11,000 IP addresses operating as active relays.
The operation is disguised as a legitimate Russian software development company on the sensey24[.]ru website. The scheme itself is fairly simple but effective: the attacker automates large-scale internet scanning for open ports, then launches password-spraying attacks using extremely weak credentials such as admin or admin123.
The campaign has been running for around two years and primarily targets devices using outdated VPN protocols such as PPTP and L2TP. The targets include old routers, dedicated VPN appliances, NAS devices, and other network equipment. Since 2024, the illicit service has processed more than 24,000 transactions and generated roughly $202,000 in revenue.
“The brute-force campaign monetizes compromised hosts by deploying proxy software and renting out access. There is no doubt about the malicious nature of the hacker’s activity. At the same time, it highlights another problem: owners neglect security by leaving old or poorly protected devices connected to the internet, while criminals abuse their environments for cybercrime,” said cybersecurity researcher Aras Nazarovas.
The attacker’s server was discovered on July 20, 2026. It had been left completely exposed, effectively revealing the entire operation. Three separate projects were running on the server, and the accessible data included malicious tools, AI-powered agent software, customer lists, IP address inventories with working credentials, mostly admin/admin, as well as logs showing that the server itself had repeatedly been targeted by other cybercriminals.
The server contents also revealed that the operator was simultaneously involved in legitimate development work. He built websites for various Russian clients and stored their source code. For the attacks, LeakySensey used specialized brute-force tools called PPTP API Server v3.2 and ipgo3, which were integrated with the payment processing system. The platform performed large-scale IP scanning to identify PPTP, L2TP, and SSH services.
PPTP, or Point-to-Point Tunneling Protocol, is an old and insecure VPN protocol that operates over port 1723. Public Censys scans show that around 1.9 million hosts still expose this outdated service. L2TP, published in 1999, is also frequently misconfigured and poorly protected. Scans of port 1701, which is used by L2TP, reveal more than 3 million accessible devices worldwide.
The attacker’s database contained more than 63,000 servers compromised through PPTP, over 24,000 through L2TP, and another 24 servers breached via SSH. However, only part of those IP addresses were actively used in the residential proxy network. At the time of discovery, 17,858 IP addresses had proxy credentials configured and were marked as either “ready” or “connected.”
According to the leaked database, the service had more than 56,000 users, over 11,000 of whom had linked their Telegram accounts. Some users of the illicit proxy service even registered under their real names. All payments were centralized through cryptomus.com, a platform that supports more than 100 cryptocurrencies.
The server also revealed where LeakySensey was reselling proxy access. Buyers included the relatively well-known VPN provider VPN Pure, as well as Pure Connect, Rich Proxy, Opm Proxy, For Friends, SkySocks, and other services.
“This raises serious questions about the ethics of how some providers source their proxy endpoints,” Nazarovas said.
While attacking other systems, LeakySensey also had to deal with security problems of his own. On one of the servers hosting a Git repository, other attackers installed a Monero miner. The operator noticed the compromise and removed 37 unauthorized users that had been created in his Git environment.
Another incident occurred after LeakySensey’s API keys were stolen. Other cybercriminals obtained credentials for the proxy service and began using its infrastructure without authorization. The operator eventually identified the compromised API keys and the IP addresses of those abusing them.
A significant part of the automation was handled by Claude Code, but not the official Anthropic release. Instead, LeakySensey used a heavily modified build in which client-side security mechanisms had been removed or bypassed.
An automated pipeline for patching Claude Code binaries was running on the server. It consisted of five Python scripts responsible for detecting new versions, analyzing them, applying modifications, verifying integrity, and distributing the patched builds. Whenever a new version of Claude Code was released, the system automatically applied the prepared changes.
The modifications included disabling trust dialogs and filesystem access confirmations, allowing arbitrary model identifiers, connecting subagents to OpenAI, Google, Qwen, and other providers, and automatically executing plans without manual approval. The modified Claude Code binaries were then distributed as private NPM packages for Apple, Windows, and Linux.
“Modified binaries allow clients to work continuously on tasks without human supervision, bypass client-side security checks, and use any AI models, including locally hosted ones,” Nazarovas said.
Researchers found 12 Antigravity accounts, one Claude account, five Codex accounts, and two Gemini accounts. All of them were routed through an intermediary tool called CLIProxyAPI, a project with more than 50,000 stars on GitHub.
LeakySensey replaced Claude Code’s default endpoints with this router and added support for multiple models, along with additional cost-optimization settings, including limits on the “thinking” budget, reasoning level, and other provider-specific parameters.
The operator appears to have used legitimate accounts. The email addresses found in the system had not appeared in any known previous data breaches.
“What is interesting about this Claude Code infrastructure is that it uses a large number of LLM service accounts. They were likely intended to distribute requests across AI agents, bypass rate limits, or increase overall throughput,” Nazarovas noted.
“The attacker may also be selling this unrestricted AI access as a separate service to other users.”
The infrastructure was hosted by OVH SAS, a French cloud computing company, and used the IP address 37[.]187[.]136[.]86:9999. That port is no longer active, suggesting the operator may have moved the server elsewhere.
Multiple artifacts indicate that LeakySensey may be based in Russia. Code comments, configuration files, LLM prompts, model outputs, and the service website were all written in Russian.
Researchers also found an Xray client binary on the server, a popular tool used to bypass internet censorship in Russia and China. In addition, the operator had been actively researching ways to evade Russia’s TSPU censorship system, as well as deep packet inspection, or DPI, mechanisms.
The Sensey24 website did not list any legal entity, although it offered software development and IT consulting services.
LeakySensey’s success shows just how dangerous outdated network equipment can remain. PPTP has effectively been considered broken for years: even with a strong password, its handshake can be intercepted and the necessary credentials can then be brute-forced at relatively low cost.
L2TP does not provide built-in encryption on its own and relies on IPsec for security, which means misconfigured deployments can leave devices exposed. Simply changing a username and password may therefore not be enough.
Owners of such equipment should replace devices that have reached end of life or install more modern software where possible. Legacy systems should also not be exposed directly to the public internet, and poorly protected devices should be isolated from the main trusted network.
“Check these servers for signs of compromise, including unauthorized SOCKS5 proxies and related artifacts.”
Any passwords, API keys, or other secrets that may have been exposed on compromised systems should be changed immediately. AI providers, in this case Anthropic, should also take known patching and client-side security bypass techniques into account to make similar modifications harder to use in the future.
