ThreatPaperBeta

Contribute Research

ThreatPaper is open to submissions. Anyone may write a paper, and every paper is reviewed by an editor before it is published. Review is about verifiability first: a well-written paper that cannot be checked against primary sources will not run.

How to submit

  1. Create an account — reading never needs one, submitting does.
  2. Open the editor and write your paper. The body is pre-filled with the required structure.
  3. Save drafts as often as you like; they stay private to you until you submit.
  4. Submit for review. An editor approves it with a note, or returns it with specific changes — you can revise and resubmit without limit.

Submitting runs an automatic check first: all ten sections present, balanced code fences, and a Sources section that actually contains links. It will tell you what is missing rather than rejecting silently.

Start a paper

What we publish

Yes

  • Real incidents with technical depth
  • Law-enforcement operations and prosecutions
  • Supply-chain compromises
  • Nation-state campaigns
  • Novel tradecraft used in the wild

No

  • CVE announcements with no exploitation evidence
  • Vendor advisories without a confirmed incident
  • Threat-landscape summaries and predictions
  • Vendor marketing framed as research
  • Rewrites of a single news article

The evidentiary standard

This is the most common reason a submission is turned down.

  1. 01

    Every specific claim needs a source

    Numbers, dates, attributions, technical details. If you cannot link it, do not assert it.

  2. 02

    Primary sources outrank everything

    Government advisories, court filings, regulatory notifications, and first-party incident reports come first. Journalism next. Vendor blogs after that. Never cite an aggregator restating something you could cite directly.

  3. 03

    Cross-check before asserting

    At least two independent sources before a claim is stated as fact.

  4. 04

    Mark what you could not verify

    A paper that honestly flags half its claims as unverified is more useful than one that asserts everything.

  5. 05

    Keep campaign intelligence separate from the incident

    If an advisory describes a group’s general tradecraft and you are writing about one victim, say which details are established for that victim and which are inferred.

  6. 06

    Attribution is a claim like any other

    Report who attributed the activity, on what basis, and at what confidence. “Widely attributed” is not attribution.

  7. 07

    Defang every indicator

    Network indicators are published for defence. No working exploit code, no live credentials, no victim personal data.

Paper structure

Ten sections, in this order. Continuous integration rejects a paper missing any of them, and checks citation links, indicator defanging, and tag formatting on every submission.

  1. 1

    Executive Summary

    Three to four substantive paragraphs: what happened, the scope, and why it matters.

  2. 2

    Verification of Claims

    Numbered claims, each rated Verified, Partially verified, or Unverified, each with its source.

  3. 3

    Timeline

    A table of Date, Actor, Event, Source — strictly chronological.

  4. 4

    Attack Anatomy

    Stage-by-stage breakdown with a Mermaid attack-chain diagram.

  5. 5

    Threat Actor Profile

    Aliases, attribution confidence and basis, motivation, prior operations, MITRE ATT&CK techniques.

  6. 6

    Technical Indicators

    A YAML block of defanged indicators of compromise.

  7. 7

    Legal and Regulatory Response

    Law enforcement action, government directives, platform response, criminal proceedings.

  8. 8

    Impact Assessment

    Labelled entries, each marked Confirmed, Reported, Estimated, or Unknown.

  9. 9

    Lessons and Defensive Recommendations

    Grouped for SOC teams, developers, platform providers, and leadership.

  10. 10

    Sources

    Numbered, every entry a working link, with publication and date.

Review and credit

An editor reads every submission for verifiability, structure, and tone, and will ask questions. Review is substantive rather than a formality. Authors keep credit on published papers.

Declare any relationship to the parties in your paper. Disclosed conflicts do not disqualify a submission; undisclosed ones mean the paper is withdrawn once found.

Papers carry a corrections log when they change materially after publication. If you find an error in a published paper, report it with a source — corrections are published rather than silently applied, because the log is part of the record.

Read the editorial methodology →