Research materials
The site ships with the public materials needed to review the series without depending on the original workspace layout.
Paper and source edition
Section titled “Paper and source edition”- Scanner paper: PDF · Zenodo record · Concept DOI · CC BY 4.0.
- Campaign preprint: PDF · Current Zenodo version · Concept DOI · CC BY 4.0.
- Blog series source package
The scanner PDF is the file deposited at Zenodo, SHA-256 5c1dbf32898275bc48e7191f8a2d49501539c6a1b049aca574838c9aec7a4553. The campaign PDF also matches its current Zenodo version.
Evidence reports
Section titled “Evidence reports”Each article links directly to the reports supporting its claims. The full list is here, so readers can open a specific exhibit without going through the evidence directory. The reports are edited summaries, not complete forensic exports.
Download all 21 PDF reports · Collection notes · Checksums
| Exhibit | Subject | Files |
|---|---|---|
| E01 | Master investigation report | PDF · Readable report |
| E02 | Clipboard-lure deobfuscation analysis | PDF · Readable report |
| E03 | Editor-extension package analysis | PDF · Readable report |
| E04 | Authenticated payload-decryption analysis | PDF · Readable report |
| E05 | Payload capability re-examination | PDF · Readable report |
| E06 | Administration frontend analysis | PDF · Readable report |
| E07 | Configuration and infrastructure history | PDF · Readable report |
| E08 | Target-acquisition code and database aggregates | PDF · Readable report |
| E09 | Deployment and mail-guide analysis | PDF · Readable report |
| E10 | Repository-ownership reassessment | PDF · Readable report |
| E11 | Archive lineage and configuration rotation | PDF · Readable report |
| E12 | Attribution and build-artifact assessment | PDF · Readable report |
| E13 | Development-application configuration analysis | PDF · Readable report |
| E14 | Image-provenance examination | PDF · Readable report |
| E15 | Companion tooling and validation record | PDF · Readable report |
| E16 | Retraction of an earlier campaign attribution | PDF · Readable report |
| E17 | Stage-three collection and configuration analysis | PDF · Readable report |
| E18 | Framework and sample comparison | PDF · Readable report |
| E19 | Windows elevation and Electron execution analysis | PDF · Readable report |
| E20 | Historical origin-server observations | PDF · Readable report |
| E21 | Build and hosting chronology | PDF · Readable report |
The historical indicator reference collects defanged URLs, domains, paths and IP observations, separating captured evidence from weaker leads. The sample and repository artifact reference adds exact hashes for selected held payloads, recovered URLScan response bodies, repository files and the ECHOES archive lineage.
Detection companion
Section titled “Detection companion”The companion repository contains the parse-only AST scanner and 33 named YARA rules across 28 files. A read-only replay matched every rule against retained case artifacts; a separate scan of 1,914 local software files produced no hits. The paper distinguishes the published rule snapshot from a later local YARA noise review. The installable scanner is now available on npm and PyPI; its expanded registry evaluation and bypass study are described in Part 13 and Part 14. The rules remain experimental and the small baselines do not establish fleet-wide false-positive rates. Sigma rules are omitted because authentic endpoint event logs were unavailable for replay.
Citation boundary
Section titled “Citation boundary”The scanner experiments are dated 29 October 2026. The case evidence runs through 24 July 2026. The public-literature refresh runs through 25 October 2026. Later reporting is used to assess context and novelty, while case-specific technical claims remain tied to retained evidence.