Want to help with the research, sitting on a lead, stuck on something we published, asking as a journalist or something none of those covers. It all comes through the same form and it is encrypted in your browser before it is sent.
NO WRONG DOOR
This is not an application form and there are no positions to apply for. It is the way to reach the people doing the work, whatever you are writing about.
Malwarebox is small. The same handful of people answer a press question, read a tip about infrastructure and hand over a thread to someone who wants to follow it. Splitting that across four addresses would only mean things land in the wrong inbox and sit there.
So pick whichever heading fits best below. If none of them do, say so in the form and describe what you had in mind. Nobody is filtered out for choosing the wrong one.
WHAT PEOPLE WRITE ABOUT
The right-hand column is what helps us answer quickly. None of it is required.
Helping out
Actor tracking, malware analysis, IIM chains, tooling, Netlab exercises. Most of it is unpaid and self-directed and it is honest to say so up front. What you produce carries your name.
Something you worked out yourself
A lead or a topic
An actor nobody seems to be tracking, infrastructure that looks wrong, a pattern you keep running into. We follow up on what we can verify and we say so when we cannot.
Indicators, samples, links
A question
About a framework, a chain, a number in a report or how something was arrived at. Questions that find a hole in the methodology are the useful kind.
Which publication and where it snagged
Research collaboration
Joint analysis with a CERT, a vendor or an academic group, shared tracking of an actor, review of a methodology before it is published, a talk or a workshop.
The case, not just the interest
Data and platform access
Access to Kraken, the IIM tooling or the closed substrate that is documented on request.
What you want to use it for
Press
Interviews, background or quoting a publication. We answer press ourselves; there is no agency in between.
Outlet and deadline
THE FORM
Everything you type here is encrypted in your browser against the key below, before it is sent. Our server stores the ciphertext and the heading you picked, nothing else. No IP address, no user agent.
Verify the fingerprint against the key you download. The page hands your browser both, so checking one against the other only proves the page is consistent with itself.
Die Nachricht liegt verschlüsselt bei uns. Lesen können wir sie erst, wenn wir sie
mit unserem privaten Schlüssel öffnen. Der liegt nicht auf diesem Server.
Wenn Sie nachfragen möchten, nennen Sie dieses Kennzeichen:
WHAT HAPPENS NEXT
We read it
Decrypted on a machine that is not this server. A few days is normal. If you wrote with a deadline, put it in the form and we work to it.
We answer
Encrypted, if you left us a key. Every message gets a reply, including the ones where the answer is no and then with a reason.
You can follow up
Every message gets a short reference. Quote it and we find the thread again, so nothing has to be sent twice.
MALWAREBOX
Get the research in your inbox
Pick what you want to hear about. One address, no cadence you did not ask for.