Terms of Use

What this is for

Everything here is published for defensive, educational, and academic use: understanding how intrusions happened so they can be detected and prevented. Indicators of compromise are published defanged, for blocking and hunting.

Using anything on this site to attack systems you do not own or have permission to test is a breach of these terms and, in most jurisdictions, a crime.

Accuracy and how to read attribution

Papers are reviewed before publication, and every claim is expected to carry a source. Review is not a guarantee of correctness. Research on live incidents is written from incomplete information, and the record changes as investigations progress.

Attribution statements reflect the assessments of the cited sources — government advisories, court filings, vendor threat intelligence — and are reproduced with the confidence those sources stated. A paper saying a group is linked to a state is reporting an assessment, not returning a verdict. Where no authority has attributed an incident, papers are expected to say so.

Naming an individual is limited to people already named in public court filings, indictments, or official statements, and their legal status is reported as it stands. An accusation is not a conviction and papers must not present it as one.

Nothing here is legal, financial, or professional advice.

Corrections

If you find a factual error, report it with a source. Material corrections are published in a corrections log on the paper itself rather than applied silently, because the log is part of the record.

If you are named in a paper and believe it is inaccurate, contact the editors. Substantiated corrections are made promptly.

Accounts

You are responsible for activity under your account. One account per person; do not impersonate anyone. We may suspend or remove accounts that breach these terms.

Submitting research

By submitting a paper you confirm that:

• It is your own work, or you have the right to publish it here.
• Every specific claim is supported by a source you have actually read.
• You have disclosed any relationship to the parties involved — employment by the victim or a vendor, a commercial interest, or involvement in the response. Disclosed conflicts do not disqualify a paper; undisclosed ones mean it is withdrawn once discovered.
• It contains no working exploit code, no live credentials, no unredacted victim personal data, and no material subject to an embargo or non-disclosure agreement you are bound by.
• It is not primarily promotional.

Editors decide what is published. A paper may be approved, returned with comments, or declined. There is no limit on revising and resubmitting.

Who owns what you write

You keep copyright in your work. By submitting, you grant ThreatPaper a non-exclusive, worldwide, royalty-free licence to publish, display, and distribute it here and in related channels such as the RSS feed and newsletter, and to make editorial corrections.

Because it is non-exclusive, you remain free to publish your work elsewhere. Published papers carry your byline.

We may withdraw a published paper if it turns out to breach these terms, if a factual problem cannot be corrected, or if we are legally required to. Where practical we will tell you first.

Voting and conduct

Votes signal which papers readers found useful. Do not manipulate them with multiple accounts or coordinated voting. Votes are recorded per account and manipulation is detectable.

Using what you read here

Quote and cite freely with attribution and a link. Wholesale republication of papers without permission is not permitted — the rights belong to their authors.

Automated scraping that degrades the service is not permitted. The RSS feed exists for programmatic access; if you need something more, ask.

No warranty, and limits

The service is provided as is. We do not warrant that it will be uninterrupted, or that every statement is free of error. To the extent the law allows, ThreatPaper is not liable for loss arising from use of the site or reliance on its content.

Nothing here limits liability for anything that cannot lawfully be limited.

Changes

These terms may change. The date at the top changes with them, and material changes are notified to account holders. Continuing to use the service after a change means accepting it.

Contact

For questions about these terms, corrections, takedown requests, or security reports, contact the editors — see the about page.