ACT-2233

SuspectedRecurring · 2 hits

One actor behind 2 incidents, linked by canary token and breadcrumb trail. Fingerprinted to Qwen.

Identity & linking

Canary tokencnry_65s841kf85

Model familyQwen

Linked byCanary token · Breadcrumb trail

SurfacesHoney skill · Web lure

First seen27 Sept 2026, 23:06

Last seen3 Nov 2026, 19:11

Home regionHong Kong, HK

Recommended action

Block this agent signature at your edge/WAF.

Model fingerprint

unclassified

Most likely model

Unknown

Confidence

—

Claude

39%

Llama

30%

Mistral

24%

Qwen

GPT

Behaviour leans Claude but isn't separable yet (3 signals). Needs a longer correlated trail.

Fingerprinted from behaviour against bait — which lures it takes and whether it probes first — scored against measured per-model profiles. Signal: 3 steps. A single sighting rarely separates models; confidence rises as a correlated actor builds a multi-step trail (research: ~59% from 3 steps, ~85% over a whole run).

Where this actor struck

ConfirmedSuspectedWatchCoarse infrastructure regions — never IP addresses.

Attack trail — 2 incidents

NRS-4060Watch· Web lure · 3 Nov 2026, 19:11
Agent crawled a decoy repo of fake credentials and attempted to use them against a monitored endpoint.
NRS-4059Suspected· Honey skill · 27 Sept 2026, 23:06
Agent installed a honey skill and invoked its most dangerous capability within seconds.

Tailored to you

Track actors like this against your own assets.

Pro links incidents on your watchlist into actors automatically — so you see the campaign, not just scattered alerts — and tells you what to block.

See Pro Talk to us