Malwarebox is an independent European malware analysis and threat intelligence project focused on tracking real-world attack infrastructure, malware delivery chains, and adversary behavior.
The blog publishes technical research on malware campaigns, infrastructure rotations, payload delivery, obfuscation techniques, and threat actor activity. Instead of only listing indicators, Malwarebox tries to explain how an attack is built, how the infrastructure is connected, and what patterns can be reused for detection and analysis.
Malwarebox also includes experimental tools and models such as Kraken, ACDP, IIM, and IIMQL, which are designed to support structured infrastructure intelligence, adversary tracking and deeper malware campaign analysis.
Malwarebox is the stack.
A growing ecosystem for malware research, adversary infrastructure intelligence, actor-centric prioritization, and practical analyst tooling. Not another IOC pile. More like the map for how the mess is actually built.
The public entry points for the Malwarebox ecosystem. Websites, whitepapers, models, workbench tooling, and GitHub repositories in one animated overview.
Malwarebox
Main public entry point for the Malwarebox ecosystem, research direction, tools, models, and CTI work.
https://malwarebox.eu
Malwarebox GitHub
Public repositories for tools, schemas, workbench code, models, and research artifacts.
https://github.com/MalwareboxEU
KRAKEN Website
Actor-centric CTI platform for tracking adversaries, infrastructure, campaigns, and operational relationships.
https://kraken.malwarebox.eu
KRAKEN Whitepaper
The concept, reasoning, and architecture behind the KRAKEN approach to actor-centric intelligence.
https://kraken.malwarebox.eu/whitepaper
IIM Website
Infrastructure Intelligence Model. A structured grammar for describing adversary infrastructure chains and repeatable patterns between short-lived IOCs and endpoint behavior frameworks.
https://iim.malwarebox.eu
IIM GitHub
The public model repository for IIM specifications, schemas, examples, and reference material.
https://github.com/MalwareboxEU/IIM
IIM Workbench Web
Web workspace for building, validating, visualizing, and exporting IIM chains and patterns.
https://workbench.iim.malwarebox.eu/
IIM Workbench GitHub
Source code for the local and web-based workbench around the Infrastructure Intelligence Model.
https://github.com/MalwareboxEU/IIM-Workbench
IIMQL Website
The query language for adversary infrastructure. Built to search infrastructure chains, roles, relations, techniques, and patterns without pretending that flat IOC search is enough.
https://iimql.malwarebox.eu
IIMQL GitHub
Public repository for the IIMQL language, examples, documentation, and implementation work.
https://github.com/MalwareboxEU/IIMQL
ACDP Website
Actor-Centric Defensive Prioritization. Defensive focus based on adversary relevance, not dashboard theater.
https://acdp.malwarebox.eu
ACDP Whitepaper
The paper behind ACDP and its approach to prioritizing defensive work around relevant threat actors.
github.com/MalwareboxEU/ACDP/blob/main/acdp-paper.pdf