22 unauthenticated AI-stack Elasticsearch operators (2026-05-17)

NuClide Research · 2026-05-17 Companion to: es-clickhouse-cross-stack-2026-05-17.md, meow-multi-actor-campaign-scope-2026-05-17.md

Summary

The morning’s _mapping probe surfaced 22 Elasticsearch hosts with dense_vector or knn_vector fields. Those are unambiguous AI / RAG workloads. We ran cert-pivot, Shodan, and aimap-profile on each one.

DCWF KSAT coverage

Auto-derived from DCWF AI work-role rule files (ksat-tag).

• 672 (AI Test & Evaluation Specialist): K7003, K7004, K7044, S7068, S7070, S7075, T5858, T5904
• 733 (AI Risk & Ethics Specialist): K7040, K7051, S7067, T5854, T5868, T5893
• overlap (Common AI KSATs (all 5 roles)): K1158, K1159, K22, K6311, K6900, K6935, K7003, K942, S7065

Three findings.

One. 103.69.124.214 is Nepal’s Ministry of Health and Population. The TLS cert SAN is ocl.hmis.gov.np. That host is the Open Concept Lab, Nepal’s clinical-terminology server. crt.sh returns 10 subdomains under hmis.gov.np including fhir.hmis.gov.np (Fast Healthcare Interoperability Resources gateway), elmis.hmis.gov.np (vaccine + drug logistics), erecord.hmis.gov.np (electronic records), and sudurpashchim.hmis.gov.np (Far-Western Province deployment).

The exposed host carries 318,114 clinical-concept documents with embeddings (drug names, diagnoses, ICD-10 codes), an admin user_profiles index, and a Meow read_me marker. The attacker planted the marker. The data is still alive. Disclosure went to NP-CERT and the Ministry of Health.

Two. 18 of 22 AI-stack hosts (82%) carry an extortion marker. Seven are fully wiped. Eleven are mid-wipe with original data still alive. The hospital host from yesterday (106.75.127.240) is one of the eleven. Its 270,000 patient-record vector indices are intact. The attacker has not yet deleted them.

Three. 17 of 22 hosts attributed to named operators. NewsBlur. XiaoIce. TorchV on ZLMediaKit. Hooper ERP. AItalkx. Tahakum AI. Guangxi OTA. TimeDB. isideweb. Equant Tech (Waffarha LMS). Each has a clean disclosure routing.

The full table

Seven fully wiped, eleven mid-wipe, four clean.

The Nepal HMIS finding

The TLS cert on 103.69.124.214:443 carries the SAN ocl.hmis.gov.np. We probed crt.sh on *.hmis.gov.np and got back the full government health-system footprint.

The exposed host’s indices:

We did not read documents in any index. Per the restraint ethic, the schema itself is the finding. The 318,114 concept documents and the 9 admin profiles are alive. The attacker has planted his marker but has not deleted.

WHOIS on the IP returns Department of Information Technology, Government of Nepal. Disclosure went to NP-CERT (incident@npcert.org.np) with the Ministry CC’d.

Other named operators

NewsBlur (135.125.201.31)

Cluster newsblur-local. Index discover-stories-openai-index with content_vector field at 256d. That is OpenAI text-embedding-3-small with the dimensions=256 parameter. NewsBlur’s “discover stories” feature reads off this index. Mid-wipe. Disclosure went to Samuel Clay.

gxota.com (112.124.16.227)

53 SAN subdomains. Multi-tenant Guangxi tourism SaaS with regional subsidiaries: car rental (zuche.ztc.gxota.com), business center API (bizcenter-api.gxota.com), retail (byhshop.gxota.com), provincial tourism brands (Sanjiang, Wuye, QiuYouLuYou). Six Chinese tourism knowledge bases at 1024d. Not wiped.

XiaoIce demo (8.147.113.203)

Cluster xiaoicedemo. Index prod_virtualhuman_knowledge_faq_default_org at 512d. XiaoIce is the Microsoft-spinoff Chinese AI companion product. The “demo” cluster name fronts production virtual-human FAQ data. Mid-wipe.

TravelM candidate (84.247.170.209)

Contabo Germany. Traefik default cert (no SNI binding). Indices article_de, article_en, article_es, article_fr, article_it, article_ru at 1536d (OpenAI text-embedding-3-large truncated). The earlier passive sweep returned ai.travelm.de on Shodan. Mid-wipe.

The synthetic-character operator (212.64.24.141)

Tencent Cloud Shanghai. Ancient ES 3.5.0. No cert. Eleven indices form a synthetic-character production pipeline:

material_ambient, material_background, material_character_appearance, material_subject_appearance, material_emotion_effect, material_music, material_voicefx, material_subject, resource_background, resource_music.

All knn_vector at 1024d. The schema names a virtual-influencer / digital-human content-generation pipeline. ES 3.5.0 is pre-X-Pack with public unauthenticated RCEs (CVE-2014-3120, CVE-2015-1427). Mid-wipe.

Embedding dimension as a provider signal

Chinese operators sit mostly at 768d and 1024d (open-source bge / m3e models). Western operators sit mostly at 256d, 1536d, 3072d (OpenAI). The dimension reads off which LLM API the operator is paying for.

Disclosure status

Sent today:

1. NP-CERT + Nepal MoHP. CRITICAL.
2. UCloud Shanghai abuse for the hospital host (106.75.127.240). CRITICAL.
3. NewsBlur (Samuel Clay). HIGH.
4. GMX abuse for wendy.etabw@gmx.com. HIGH.
5. Correction to UCloud naming Actor C (not Actor A). HIGH.
6. onionmail.org abuse for scandal@onionmail.org. HIGH.
7. sharebot.net abuse for db-recovery@sharebot.net. HIGH.

Queued, not yet sent: the remaining 13 named operators on the table above. Each needs a per-host re-probe and per-actor classification before send.

Toolchain provenance

visorgraph        [x] 22 hosts cert-pivot. 5 surfaced SAN domains.
aimap-profile     [x] 22 hosts fast mode. identity, surface_passive, cert_cns.
shodan host       [x] 22 hosts. org, country, vulns.
crt.sh            [x] manual pivot on hmis.gov.np (10 SAN), gxota.com (53 SAN).
whois             [x] cymru bulk and per-IP for routing.
aimap v1.9.8      [—] used earlier today for the ES schema probe.
nuclide-contact   [—] queued for the next batch of named operators.

See also

• es-clickhouse-cross-stack-2026-05-17.md
• meow-multi-actor-campaign-scope-2026-05-17.md
• ../../methodology/insight-28-survey-shelf-life-exposure-to-extortion.md
• ../../methodology/insight-29-overwhelming-prior-state-look-at-deltas-not-snapshots.md
• ../../methodology/insight-04-whois-over-slug-heuristics-for-disclosure-routing.md
• multi-cross-survey-stacked-catastrophe-2026-05-16.md