Malwarebox is an independent European project for malware analysis and threat intelligence.
We investigate malware campaigns, track attack infrastructure and document how adversaries operate.
On the blog, we share technical analyses of how malware is delivered and obfuscated, how infrastructure changes and how activity connects across campaigns. We explain what we found, how we got there and what others can use for detection and further investigation.
Alongside the research, we develop experimental tools and models, including Kraken, ACDP, IIM and IIMQL, to help organise evidence, track adversaries and follow campaigns over time.
Want to contribute? Get in touch:
contact@malwarebox.eu
Malwarebox is the stack.
A growing ecosystem for malware research, adversary infrastructure intelligence, actor-centric prioritization, and practical analyst tooling. Not another IOC pile. More like the map for how the mess is actually built.
The public entry points for the Malwarebox ecosystem. Websites, whitepapers, models, workbench tooling, and GitHub repositories.
Malwarebox
Main public entry point for the Malwarebox ecosystem, research direction, tools, models, and CTI work.
https://malwarebox.eu
Malwarebox GitHub
Public repositories for tools, schemas, workbench code, models, and research artifacts.
https://github.com/MalwareboxEU
KRAKEN Website
Actor-centric CTI platform for tracking adversaries, infrastructure, campaigns, and operational relationships.
https://kraken.malwarebox.eu
KRAKEN Whitepaper
The concept, reasoning, and architecture behind the KRAKEN approach to actor-centric intelligence.
https://kraken.malwarebox.eu/whitepaper
IIM Website
Infrastructure Intelligence Model. A structured grammar for describing adversary infrastructure chains and repeatable patterns between short-lived IOCs and endpoint behavior frameworks.
https://iim.malwarebox.euIIM Public Feeds
Public role-based adversary infrastructure chains. Browse actors, campaigns, relations, evidence, and full attack paths without reducing everything back into yet another IOC table.
https://feed.iim.malwarebox.eu
IIM GitHub
The public model repository for IIM specifications, schemas, examples, and reference material.
https://github.com/MalwareboxEU/IIM
IIM Workbench Web
Web workspace for building, validating, visualizing, and exporting IIM chains and patterns.
https://workbench.iim.malwarebox.eu/
IIM Workbench GitHub
Source code for the local and web-based workbench around the Infrastructure Intelligence Model.
https://github.com/MalwareboxEU/IIM-Workbench
IIMQL Website
The query language for adversary infrastructure. Built to search infrastructure chains, roles, relations, techniques, and patterns without pretending that flat IOC search is enough.
https://iimql.malwarebox.eu
IIMQL GitHub
Public repository for the IIMQL language, examples, documentation, and implementation work.
https://github.com/MalwareboxEU/IIMQL
ACDP Website
Actor-Centric Defensive Prioritization. Defensive focus based on adversary relevance, not dashboard theater.
https://acdp.malwarebox.eu
ACDP Whitepaper
The paper behind ACDP and its approach to prioritizing defensive work around relevant threat actors.
github.com/MalwareboxEU/ACDP/blob/main/acdp-paper.pdf