Reuse and citation

Terms

Detection rules

Detection Rule License (DRL) 1.1

Indicators and metrics

CC0 1.0 (no restrictions)

Text and figures

CC BY 4.0 (reuse with attribution)

Ask about reuse

Citing a page

Name the author, title, version, date and URL shown at the top of the article. Cite the version you read.

Files published with each article

• indicators.json and indicators.csv: the page's indicators, still defanged. The JSON follows the indicators schema.
• rules/: each detection rule as its own file, with the status and test notes shown on the page.
• manifest.json: every file with its size and SHA-256, the page version and date, and the reuse terms.

Indicators in these files are never refanged. Treat them as text, and do not visit them.

Indicator feed

The 222 attacker indicators submitted to ThreatFox, URLhaus, MalwareBazaar and VirusTotal on 1 November 2026, as one machine-readable feed: domains, IP addresses, IP and port pairs, URLs and SHA-256 file hashes. It lists no repositories and no victims. Unlike the article files, the values are not defanged, so that they can go straight into a blocklist or a SIEM. Do not open them in a browser. CC0 1.0, TLP:CLEAR. It is updated by hand when the research changes.

• iocs.json: JSON, with source, licence and date
• iocs.csv: CSV: type, value, activity, threat type, tags, first published
• iocs.txt: plain text, one value per line
• github_campaigns.yar: the YARA rules, CC0