Umbral Cicada 4

What this actor is

A search-engine crawler that indexes pages for a search index.

Label: Search crawler (SEC) · Inferred cluster (grouped by shared client signature; not a proven person or organisation).

Verification: Spoofed identity — this actor claimed a known identity, but the claim failed verification. A claimed identity is not a verified identity.

Spoofed claim: the user-agent or claim suggested a known service, but network evidence did not support it. Treat the name as a claim, not an attribution.

Evidence behind the label

Evidence tier summary

• verified: Not enough data yet (identity supported by authoritative evidence)
• claimed: Withheld · single source (self-declared claim only, not verified)
• inferred: Not enough data yet (inferred from behaviour, not verified)
• unknown: Not enough data yet (tier could not be determined from available evidence)

Techniques, services and CVE observations

Withheld · single source. Technique, service and CVE breakdowns are not published for single-source actors.

Robots, canary and honeytoken behaviour

Robots compliance: Withheld · single source — not measured for publication.

Canary follows: Withheld or below publication threshold — not a zero. Canary follows are counted only when publishable.

Honeytoken uses: Withheld or below publication threshold — not a zero.

Following a canary or using a honeytoken is behavioural evidence; it does not by itself prove AI involvement or intent.