Amber Thrip 3

What this actor is

A scanner that probes many hosts, ports, or paths to map what is exposed. Scanning is reconnaissance, not by itself a compromise.

Label: Scanner (SCN) · Inferred cluster (grouped by shared client signature; not a proven person or organisation).

Verification: Inferred cluster — no vendor identity claim to verify; the label comes from observed behaviour.

Evidence behind the label

Evidence tier summary

• verified: Not enough data yet (identity supported by authoritative evidence)
• claimed: Not enough data yet (self-declared claim only, not verified)
• inferred: Not enough data yet (inferred from behaviour, not verified)
• unknown: Withheld · single source (tier could not be determined from available evidence)

Techniques, services and CVE observations

Withheld · single source. Technique, service and CVE breakdowns are not published for single-source actors.

Robots, canary and honeytoken behaviour

Robots compliance: Withheld · single source — not measured for publication.

Canary follows: Withheld or below publication threshold — not a zero. Canary follows are counted only when publishable.

Honeytoken uses: Withheld or below publication threshold — not a zero.

Following a canary or using a honeytoken is behavioural evidence; it does not by itself prove AI involvement or intent.