Advanced threat intelligence

Kinryū Labs

We're a research group that finds vulnerabilities in space systems, runs honeypot networks to watch attackers in the wild, and produces cyber threat intelligence. We report what we find to the organisations affected, and publish what we can - once it's ready and cleared for release.

Read our reports About the group Portal

Doing it for the love of the game.

Latest reports

View all →

  • Coordinated disclosure

    220 Million Traveller Records: A Vietnam-Linked Passenger Database Left Exposed

    Kinryū Labs found a database holding Advance Passenger Information for everyone who flew into or out of Vietnam over nine years: 210,318,069 passenger records and 10,465,631 crew records, each pairing a name, date of birth and passport number with a full itinerary, down to the baggage tag. It answered on its unchanged default login. The reach ran from Aeroflot and Belavia crews to Belarusian tourists in Cam Ranh. Access was closed in June 2026 after coordinated disclosure.

    coordinated-disclosure · data-exposure · elasticsearch · aviation · apis · pii

  • keyHunter: An LLM-Proxy Key Operation That Leaked Its Own Toolkit

    A Chinese-speaking operator sweeps FOFA for exposed AI proxy panels, verifies them with unit-tested code built to recognise honeypots, and exports the API keys. Their agent executed a Kinryū Labs decoy's tool calls on its own host and returned 283 file paths, the scan yields, the WeChat chat log, and a results directory of exploit files named for six 2026 CVEs, a New-API Stripe-webhook bypass among them.

    threat-actor · litellm · agentic-ai · credential-theft · china-nexus

  • Exposed Elasticsearch: Inside the Ransom-Wipe Economy

    Kinryū Labs censused 17,043 internet-facing Elasticsearch hosts and found that a wiped husk with a ransom note in it is the single most common state of an exposed cluster: 5,073 of them. Tracing every wallet the notes advertised gives five actors, eleven payments and about $5,553 in total revenue, and shows the promise to return deleted data is unsupported by the evidence.

    elasticsearch · ransomware · extortion · data-exposure · on-chain-analysis · bitcoin

kinryu@lab

kinryu@lab: ~/intelligence
$