Tawny Treehopper 7

What this actor is

An exploit bot that sends requests designed to trigger a known vulnerability. An attempt is not evidence of compromise.

Label: Exploit bot (EXP) · Inferred cluster (grouped by shared client signature; not a proven person or organisation).

Verification: Inferred cluster — no vendor identity claim to verify; the label comes from observed behaviour.

Evidence behind the label

Evidence tier summary

• verified: 0 publishable observations (identity supported by authoritative evidence)
• claimed: 0 publishable observations (self-declared claim only, not verified)
• inferred: 0 publishable observations (inferred from behaviour, not verified)
• unknown: 3 publishable observations (tier could not be determined from available evidence)

Techniques, services and CVE observations

Services / traps targeted: not-found (3 of 3 publishable trap observations).

• rce · 3 observations · Stage: Exploit attempt (request pattern matches an exploit technique; compromise not observed)

• CVE-2017-9841 · 3 observations · Stage: probe or exploit attempt as matched by request pattern; compromise not observed.

Robots, canary and honeytoken behaviour

Robots compliance: Not measured yet for this actor.

Canary follows: 0 publishable canary follows

Honeytoken uses: 0 publishable honeytoken uses

Following a canary or using a honeytoken is behavioural evidence; it does not by itself prove AI involvement or intent.