Indicators

This site holds 28,594 indicators, each with its own page, citation and source passage. They are searched from several places because each kind answers a different question.

Remote Workers20,059 indicatorsIndicators for the operators themselves: email addresses, GitHub and LinkedIn accounts, packages, wallets, malware hashes and infrastructure reported in connection with DPRK remote IT-worker operations and the Contagious Interview lures run alongside them.
Espionage clusters5,621 indicatorsIntrusion and heist indicators for the named DPRK APT clusters -- Lazarus Group, Kimsuky, APT37, Konni, APT38, Andariel and Moonstone Sleet. These answer a different question from the remote-worker identities they were filed beside, so they are grouped and searched on each cluster's own page.
EtherHiding Tracker463 indicatorsOn-chain command-and-control infrastructure: the smart contracts and wallet addresses used to stage payloads on public blockchains, tracked separately because they are infrastructure rather than identities.
PolinRider Repositories2,451 indicatorsRepositories the PolinRider campaign compromised. These name projects that were attacked rather than the people who ran the attack, which is why they are kept out of the remote-worker index and searched from the repo scanner instead.

Browsing without searching

Every indicator is also laid out as plain pages of links, by type; Browse indicators lists every page.

Type	Indicators
IP addresses	11,045
Email addresses	5,683
File hashes	3,434
Compromised repositories	2,451
GitHub accounts	2,069
Npm packages	726
Aliases	681
Cryptocurrency wallet addresses	494
Domains	397
LinkedIn accounts	195
Telephone numbers	170
Telegram accounts	159
Malicious repositories	153
Hosted sites	142
Smart contract addresses	106
X accounts	97
GitLab accounts	90
Payload URLs	67
Usernames	54
DEV Community accounts	50
Transaction hashes	41
Docker Hub accounts	36
Autonomous system numbers	25
Medium accounts	25
File names	23
Skype accounts	20
Hugging Face accounts	17
Calendly accounts	13
Freelancer.com accounts	11
Keybase accounts	9
CodeSandbox accounts	8
Personal sites	8
Chrome extensions	7
ENS names	7
Trello accounts	7
Discord accounts	6
Fiverr accounts	6
Torre accounts	5
XING accounts	5
Facebook accounts	4
LaborX accounts	4
PyPI packages	4
Remote OK accounts	4
Freelancermap accounts	3
Himalayas accounts	3
Instagram accounts	3
Stack Overflow accounts	3
Linktree accounts	2
Quora accounts	2
RemoteHub accounts	2
Upwork accounts	2
Web3.career accounts	2
Crypto.jobs accounts	1
CryptoJobsList accounts	1
Devpost accounts	1
Entre accounts	1
F6S accounts	1
GitHub search queries	1
Hashnode accounts	1
Klimbup accounts	1
Odnoklassniki accounts	1
Peerlist accounts	1
Product Hunt accounts	1
Useme accounts	1
Wantedly accounts	1
YouTube accounts	1

Reading an indicator page

Each page at /indicators/<id>/ lists every source that reported the value and what it said. Downloads are on Data and downloads.