ACT-2234

SuspectedRecurring · 2 hits

One actor behind 2 incidents, linked by canary token and breadcrumb trail. Fingerprinted to DeepSeek.

Identity & linking

Canary tokencnry_0hamz1ue0m

Model familyDeepSeek

Linked byCanary token · Breadcrumb trail

SurfacesWeb lure · Decoy doc

First seen22 Oct 2026, 04:27

Last seen26 Oct 2026, 21:26

Home regionParis, FR

Recommended action

Flag retrieval from this source and alert the owner.

Model fingerprint

unclassified

Most likely model

Unknown

Confidence

—

Claude

39%

Llama

30%

Mistral

24%

Qwen

GPT

Behaviour leans Claude but isn't separable yet (3 signals). Needs a longer correlated trail.

Fingerprinted from behaviour against bait — which lures it takes and whether it probes first — scored against measured per-model profiles. Signal: 3 steps. A single sighting rarely separates models; confidence rises as a correlated actor builds a multi-step trail (research: ~59% from 3 steps, ~85% over a whole run).

Where this actor struck

ConfirmedSuspectedWatchCoarse infrastructure regions — never IP addresses.

Attack trail — 2 incidents

NRS-4061Watch· Decoy doc · 26 Oct 2026, 21:26
Agent retrieved a decoy document and acted on the poisoned instruction embedded in it.
NRS-4062Suspected· Web lure · 22 Oct 2026, 04:27
Agent crawled a decoy repo of fake credentials and attempted to use them against a monitored endpoint.

Tailored to you

Track actors like this against your own assets.

Pro links incidents on your watchlist into actors automatically — so you see the campaign, not just scattered alerts — and tells you what to block.

See Pro Talk to us