{
  "status": "Published metadata and original synthesis; no full original source texts hosted",
  "records": [
    {
      "id": "botnets-zombie-roundup-2005",
      "type": "research_paper",
      "title": "The Zombie Roundup: Understanding, Detecting, and Disrupting Botnets",
      "dates": {
        "publication_month": "2005-07"
      },
      "publisher": "USENIX, SRUTI 05",
      "people": [
        "Evan Cooke",
        "Farnam Jahanian",
        "Danny McPherson"
      ],
      "summary": "Early IRC-centered botnet research argues for correlating host and network evidence. Centralized coordination, transport and malicious purpose are separate properties.",
      "sources": [
        "https://www.usenix.org/conference/sruti-05/zombie-roundup-understanding-detecting-and-disrupting-botnets",
        "https://www.usenix.org/legacy/publications/library/proceedings/sruti05/prelim_papers/cooke/cooke_html/"
      ],
      "caveat": "The landing page omits Danny McPherson; the hosted paper names him. Observations describe the study period, not current prevalence.",
      "relations": [
        [
          "documents_architecture",
          "centralized IRC C2"
        ],
        [
          "documents_defense",
          "multi-source behavioral correlation"
        ]
      ],
      "checked": "2026-10-16",
      "rights": "Original concise summary and factual metadata only; source works linked, not reproduced. No leak files or code imported.",
      "verification": "Source-verified research packet supplied by parent task; implementation preserves caveats. No fresh source retrieval in this build.",
      "source_packet": "Parent thread 01a14254-208a-7286-8868-683441dbc0cf, research handoff 2026-10-16"
    },
    {
      "id": "botnets-p2p-peacomm-2007",
      "type": "research_paper",
      "title": "Peer-to-Peer Botnets: Overview and Case Study",
      "dates": {
        "publication_month": "2007-04"
      },
      "publisher": "USENIX, HotBots 07",
      "people": [
        "Julian B. Grizzard",
        "Vikram Sharma",
        "Chris Nunnery",
        "Brent ByungHoon Kang",
        "David Dagon"
      ],
      "summary": "The Trojan.Peacomm case study examines peer-to-peer coordination. P2P describes a topology; it does not establish an operator identity or the absence of every central dependency.",
      "sources": [
        "https://www.usenix.org/conference/hotbots-07/peer-peer-botnets-overview-and-case-study"
      ],
      "relations": [
        [
          "analyzes",
          "Trojan.Peacomm"
        ],
        [
          "documents_architecture",
          "peer-to-peer C2"
        ]
      ],
      "checked": "2026-10-16",
      "rights": "Original concise summary and factual metadata only; source works linked, not reproduced. No leak files or code imported.",
      "verification": "Source-verified research packet supplied by parent task; implementation preserves caveats. No fresh source retrieval in this build.",
      "source_packet": "Parent thread 01a14254-208a-7286-8868-683441dbc0cf, research handoff 2026-10-16"
    },
    {
      "id": "botnets-botminer-2008",
      "type": "research_paper",
      "title": "BotMiner: Clustering Analysis of Network Traffic for Protocol- and Structure-Independent Botnet Detection",
      "dates": {
        "landing_page_date": "2008-07-31",
        "publication_year": "2008"
      },
      "publisher": "USENIX Security",
      "people": [
        "Guofei Gu",
        "Roberto Perdisci",
        "Junjie Zhang",
        "Wenke Lee"
      ],
      "summary": "BotMiner correlated similar communications with malicious activity in IRC, HTTP and P2P traces, including Nugache and Storm. Its measured results are historical research findings, not a guarantee of universal detection.",
      "sources": [
        "https://www.usenix.org/conference/17th-usenix-security-symposium/presentation/botminer-clustering-analysis-network-traffic-",
        "https://static.usenix.org/events/sec08/tech/full_papers/gu/gu_html/"
      ],
      "relations": [
        [
          "evaluated_against",
          "Nugache"
        ],
        [
          "evaluated_against",
          "Storm"
        ],
        [
          "documents_defense",
          "cross-cluster traffic correlation"
        ]
      ],
      "checked": "2026-10-16",
      "rights": "Original concise summary and factual metadata only; source works linked, not reproduced. No leak files or code imported.",
      "verification": "Source-verified research packet supplied by parent task; implementation preserves caveats. No fresh source retrieval in this build.",
      "source_packet": "Parent thread 01a14254-208a-7286-8868-683441dbc0cf, research handoff 2026-10-16"
    },
    {
      "id": "botnets-conficker-2009",
      "type": "research_report",
      "title": "Conficker: logic and rendezvous points",
      "dates": {
        "observations": "2008-11/2008-12",
        "report_release": "2009-02-04",
        "report_updated": "2009-03-19"
      },
      "publisher": "SRI International",
      "people": [
        "Phillip Porras",
        "Hassen Saidi",
        "Vinod Yegneswaran"
      ],
      "summary": "Early SRI analysis describes a self-updating worm and rendezvous mechanisms. Variant dates matter: later capabilities should not be assigned to the original worm by assumption.",
      "sources": [
        "https://www.usenix.org/legacy/event/leet09/tech/full_papers/porras/porras_html/index2.html",
        "https://attack.mitre.org/techniques/T1568/002/"
      ],
      "caveat": "Descriptive history only; no reconstructed malware code or protocol implementation is imported.",
      "relations": [
        [
          "analyzes",
          "Conficker"
        ],
        [
          "source_documents_technique",
          "T1568.002",
          "MITRE ATT&CK Conficker procedure example; variant scope retained"
        ]
      ],
      "checked": "2026-10-16",
      "rights": "Original concise summary and factual metadata only; source works linked, not reproduced. No leak files or code imported.",
      "verification": "Source-verified research packet supplied by parent task; implementation preserves caveats. No fresh source retrieval in this build.",
      "source_packet": "Parent thread 01a14254-208a-7286-8868-683441dbc0cf, research handoff 2026-10-16"
    },
    {
      "id": "botnets-gameover-zeus-2014",
      "type": "disruption_event",
      "title": "GameOver Zeus disruption",
      "dates": {
        "operation_began": "2014-05",
        "announcement": "2014-06-02",
        "court_status_update": "2014-07-11"
      },
      "publisher": "FBI; U.S. Department of Justice",
      "summary": "International court-authorized measures disrupted GameOver Zeus and associated Cryptolocker activity. DOJ’s July update reported all or nearly all active infected computers communicating with a substitute server.",
      "sources": [
        "https://www.fbi.gov/news/stories/gameover-zeus-botnet-disrupted",
        "https://www.justice.gov/archives/opa/pr/department-justice-provides-update-gameover-zeus-and-cryptolocker-disruption"
      ],
      "caveat": "A dated institutional assessment of disruption is not permanent eradication.",
      "relations": [
        [
          "disrupted",
          "GameOver Zeus"
        ],
        [
          "involved_agency",
          "FBI"
        ],
        [
          "associated_with",
          "Cryptolocker"
        ]
      ],
      "checked": "2026-10-16",
      "rights": "Original concise summary and factual metadata only; source works linked, not reproduced. No leak files or code imported.",
      "verification": "Source-verified research packet supplied by parent task; implementation preserves caveats. No fresh source retrieval in this build.",
      "source_packet": "Parent thread 01a14254-208a-7286-8868-683441dbc0cf, research handoff 2026-10-16"
    },
    {
      "id": "botnets-mirai-2016-2017",
      "type": "research_paper",
      "title": "Understanding the Mirai Botnet",
      "dates": {
        "major_activity": "2016",
        "publication_month": "2017-08"
      },
      "publisher": "USENIX Security 17",
      "people": [
        "Manos Antonakakis",
        "Tim April",
        "Michael Bailey",
        "Matt Bernhard",
        "Elie Bursztein",
        "Jaime Cochran",
        "Zakir Durumeric",
        "J. Alex Halderman",
        "Luca Invernizzi",
        "Michalis Kallitsis",
        "Deepak Kumar",
        "Chaz Lever",
        "Zane Ma",
        "Joshua Mason",
        "Damian Menscher",
        "Chad Seaman",
        "Nick Sullivan",
        "Kurt Thomas",
        "Yi Zhou"
      ],
      "summary": "A seven-month retrospective examines Mirai’s growth, IoT device ecosystem, DDoS victims and competing variants. The researchers estimated a peak of 600,000 infections within their measurement scope.",
      "sources": [
        "https://www.usenix.org/conference/usenixsecurity17/technical-sessions/presentation/antonakakis"
      ],
      "caveat": "Research landing page only; no malware source mirrors.",
      "relations": [
        [
          "analyzes",
          "Mirai"
        ],
        [
          "documents_impact",
          "DDoS"
        ],
        [
          "documents_target_class",
          "embedded and IoT devices"
        ]
      ],
      "checked": "2026-10-16",
      "rights": "Original concise summary and factual metadata only; source works linked, not reproduced. No leak files or code imported.",
      "verification": "Source-verified research packet supplied by parent task; implementation preserves caveats. No fresh source retrieval in this build.",
      "source_packet": "Parent thread 01a14254-208a-7286-8868-683441dbc0cf, research handoff 2026-10-16"
    },
    {
      "id": "botnets-qakbot-2023",
      "type": "disruption_event",
      "title": "Qakbot multinational disruption",
      "dates": {
        "announcement": "2023-08-29"
      },
      "publisher": "U.S. Department of Justice",
      "summary": "DOJ announced an infrastructure disruption and removal of Qakbot code from infected devices. It reported more than 700,000 victim computers and about $8.6 million in seized cryptocurrency.",
      "sources": [
        "https://www.justice.gov/archives/opa/pr/qakbot-malware-disrupted-international-cyber-takedown"
      ],
      "caveat": "These are the announcement’s dated figures; disruption does not prove the family cannot reappear.",
      "relations": [
        [
          "disrupted",
          "Qakbot"
        ],
        [
          "facilitated",
          "ransomware deployment",
          "DOJ describes Qakbot malware capability, not the disruption event",
          "Qakbot"
        ],
        [
          "involved_agency",
          "FBI"
        ]
      ],
      "checked": "2026-10-16",
      "rights": "Original concise summary and factual metadata only; source works linked, not reproduced. No leak files or code imported.",
      "verification": "Source-verified research packet supplied by parent task; implementation preserves caveats. No fresh source retrieval in this build.",
      "source_packet": "Parent thread 01a14254-208a-7286-8868-683441dbc0cf, research handoff 2026-10-16"
    },
    {
      "id": "c2-dga",
      "type": "technique_reference",
      "title": "Domain generation algorithms",
      "dates": {
        "catalog_created": "2020-03-10"
      },
      "publisher": "MITRE ATT&CK",
      "summary": "A DGA derives candidate rendezvous names. It is a discovery mechanism, not a network topology. Defensive interpretation combines DNS and endpoint evidence; unusual names alone are insufficient.",
      "sources": [
        "https://attack.mitre.org/techniques/T1568/002/"
      ],
      "relations": [
        [
          "maps_to_attack",
          "T1568.002"
        ],
        [
          "contrasts_with",
          "T1568.001"
        ],
        [
          "documented_example",
          "Conficker"
        ]
      ],
      "checked": "2026-10-16",
      "rights": "Original concise summary and factual metadata only; source works linked, not reproduced. No leak files or code imported.",
      "verification": "Source-verified research packet supplied by parent task; implementation preserves caveats. No fresh source retrieval in this build.",
      "source_packet": "Parent thread 01a14254-208a-7286-8868-683441dbc0cf, research handoff 2026-10-16"
    },
    {
      "id": "c2-fast-flux",
      "type": "technique_reference",
      "title": "Fast flux and defensive DNS analysis",
      "dates": {
        "advisory_month": "2025-04"
      },
      "publisher": "NSA and partner agencies; MITRE ATT&CK",
      "summary": "Fast flux changes address mappings behind names; a DGA changes candidate names. They can coexist. Legitimate distributed services also change infrastructure, so DNS observations require context.",
      "sources": [
        "https://attack.mitre.org/techniques/T1568/001/",
        "https://media.defense.gov/2025/Apr/02/2003681172/-1/-1/0/csa-fast-flux.pdf"
      ],
      "relations": [
        [
          "maps_to_attack",
          "T1568.001"
        ],
        [
          "contrasts_with",
          "T1568.002"
        ]
      ],
      "checked": "2026-10-16",
      "rights": "Original concise summary and factual metadata only; source works linked, not reproduced. No leak files or code imported.",
      "verification": "Source-verified research packet supplied by parent task; implementation preserves caveats. No fresh source retrieval in this build.",
      "source_packet": "Parent thread 01a14254-208a-7286-8868-683441dbc0cf, research handoff 2026-10-16"
    },
    {
      "id": "c2-dead-drop-resolver",
      "type": "technique_reference",
      "title": "Dead-drop resolvers",
      "dates": {
        "catalog_created": "2020-03-14"
      },
      "publisher": "MITRE ATT&CK",
      "summary": "Content on an external service can point a compromised host toward other C2 infrastructure. Resolving an address is distinct from carrying commands through that service. ATT&CK supplies BLACKCOFFEE and APT41 examples.",
      "sources": [
        "https://attack.mitre.org/techniques/T1102/001/"
      ],
      "relations": [
        [
          "maps_to_attack",
          "T1102.001"
        ],
        [
          "documented_example",
          "BLACKCOFFEE",
          "MITRE ATT&CK source example, not a new actor attribution"
        ],
        [
          "documented_example",
          "APT41",
          "MITRE ATT&CK source example, not a personal identity claim"
        ]
      ],
      "checked": "2026-10-16",
      "rights": "Original concise summary and factual metadata only; source works linked, not reproduced. No leak files or code imported.",
      "verification": "Source-verified research packet supplied by parent task; implementation preserves caveats. No fresh source retrieval in this build.",
      "source_packet": "Parent thread 01a14254-208a-7286-8868-683441dbc0cf, research handoff 2026-10-16"
    },
    {
      "id": "c2-web-encryption",
      "type": "technique_reference",
      "title": "Web C2 transport and encrypted channels",
      "dates": {
        "web_catalog_created": "2020-03-15",
        "encryption_catalog_created": "2020-03-16"
      },
      "publisher": "MITRE ATT&CK",
      "summary": "HTTP/S describes transport; centralized and P2P describe coordination topology. ATT&CK T1573 concerns encryption beyond inherent protocol protection: HTTPS alone should not automatically receive that mapping.",
      "sources": [
        "https://attack.mitre.org/techniques/T1071/001/",
        "https://attack.mitre.org/techniques/T1573/"
      ],
      "relations": [
        [
          "maps_to_attack",
          "T1071.001"
        ],
        [
          "distinguishes_from",
          "T1573"
        ]
      ],
      "checked": "2026-10-16",
      "rights": "Original concise summary and factual metadata only; source works linked, not reproduced. No leak files or code imported.",
      "verification": "Source-verified research packet supplied by parent task; implementation preserves caveats. No fresh source retrieval in this build.",
      "source_packet": "Parent thread 01a14254-208a-7286-8868-683441dbc0cf, research handoff 2026-10-16"
    },
    {
      "id": "intel-snowden-verizon-2013",
      "type": "disclosure_reporting",
      "title": "Snowden-era Verizon order reporting",
      "dates": {
        "initial_reporting_date": "2013-06-05",
        "current_article_display_date": "2013-06-06"
      },
      "publisher": "The Guardian",
      "people": [
        "Glenn Greenwald"
      ],
      "summary": "Reporting on a Verizon court order, with initial and displayed publication dates retained separately.",
      "provenance_class": "leak-based reporting; not official declassification",
      "sources": [
        "https://www.theguardian.com/world/2013/jun/06/nsa-phone-records-verizon-court-order",
        "https://www.pulitzer.org/files/2014/public-service/guardianus/01guardianus2014.pdf"
      ],
      "caveat": "The Pulitzer-submitted original supports the initial date; the current page displays the following date. No blanket authentication of other reported documents.",
      "relations": [
        [
          "reported_by",
          "Glenn Greenwald"
        ],
        [
          "contextualized_by",
          "intel-pclob-2014"
        ]
      ],
      "checked": "2026-10-16",
      "rights": "Original concise summary and factual metadata only; source works linked, not reproduced. No leak files or code imported.",
      "verification": "Source-verified research packet supplied by parent task; implementation preserves caveats. No fresh source retrieval in this build.",
      "source_packet": "Parent thread 01a14254-208a-7286-8868-683441dbc0cf, research handoff 2026-10-16"
    },
    {
      "id": "intel-pclob-2014",
      "type": "official_oversight_report",
      "title": "PCLOB Section 215 telephone-records report",
      "dates": {
        "report_filed": "2014-01-23"
      },
      "publisher": "Privacy and Civil Liberties Oversight Board",
      "summary": "Official oversight analysis of bulk telephone records and the Foreign Intelligence Surveillance Court, with twelve recommendations. Board findings, dissenting views and court rulings remain distinct.",
      "provenance_class": "official public oversight report",
      "sources": [
        "https://www.pclob.gov/Oversight",
        "https://www.intelligence.gov/ic-on-the-record-database/declassified/dni-clapper-declassifies-additional-intelligence-community-documents-regarding-collection-under-section-501-of-the-foreign-intelligence-surveillance-act"
      ],
      "relations": [
        [
          "reviews_program",
          "Section 215 bulk telephone records"
        ],
        [
          "contextualizes",
          "intel-snowden-verizon-2013"
        ]
      ],
      "checked": "2026-10-16",
      "rights": "Original concise summary and factual metadata only; source works linked, not reproduced. No leak files or code imported.",
      "verification": "Source-verified research packet supplied by parent task; implementation preserves caveats. No fresh source retrieval in this build.",
      "source_packet": "Parent thread 01a14254-208a-7286-8868-683441dbc0cf, research handoff 2026-10-16"
    },
    {
      "id": "intel-vault7-court-context",
      "type": "disclosure_legal_context",
      "title": "Vault 7 and the Schulte proceedings",
      "dates": {
        "theft_date": "2016-04-20",
        "first_public_disclosure": "2017-03-07",
        "espionage_trial_verdict": "2022-07-13",
        "sentencing": "2024-02-01"
      },
      "publisher": "U.S. Attorney’s Office SDNY; U.S. District Court SDNY",
      "people": [
        "Joshua Adam Schulte"
      ],
      "summary": "The prosecution establishes a CIA theft and transmission-to-WikiLeaks context. The 2024 sentence followed several trials and covered multiple categories of crimes; it was not solely punishment for disclosure.",
      "provenance_class": "court-established disclosure context, as documented by DOJ and court records",
      "sources": [
        "https://www.justice.gov/usao-sdny/pr/former-cia-officer-joshua-adam-schulte-sentenced-40-years-prison-espionage-and-child",
        "https://www.nysd.uscourts.gov/sites/default/files/2024-04/1139%20Schulte%20Sealing%20Order.pdf"
      ],
      "caveat": "The 2024 order noted an appeal. Current appellate disposition was not checked. This does not authenticate every mirrored file or operational claim; no toolkit archive is included.",
      "relations": [
        [
          "disclosure_publisher",
          "WikiLeaks",
          "Vault 7 disclosure publisher, not publisher of court proceedings"
        ],
        [
          "origin_institution",
          "CIA",
          "DOJ account of proved trial facts"
        ],
        [
          "legal_case_subject",
          "Joshua Adam Schulte"
        ]
      ],
      "checked": "2026-10-16",
      "rights": "Original concise summary and factual metadata only; source works linked, not reproduced. No leak files or code imported.",
      "verification": "Source-verified research packet supplied by parent task; implementation preserves caveats. No fresh source retrieval in this build.",
      "source_packet": "Parent thread 01a14254-208a-7286-8868-683441dbc0cf, research handoff 2026-10-16"
    },
    {
      "id": "intel-shadow-brokers-2016-2017",
      "type": "disclosure_research_context",
      "title": "Shadow Brokers: provenance claims and defensive aftermath",
      "dates": {
        "initial_disclosure": "2016-08-13",
        "kaspersky_analysis": "2016-08-16",
        "ms17_010_release": "2017-03-14",
        "microsoft_triage_publication": "2017-04-15"
      },
      "publisher": "Kaspersky GReAT; Microsoft Security Response Center",
      "summary": "Kaspersky reported high-confidence code relationships with previously studied Equation Group malware, without identifying the leaker or acquisition route. Microsoft later identified patches, including MS17-010, for listed affected vulnerabilities.",
      "provenance_class": "researcher-assessed leak relationship",
      "sources": [
        "https://securelist.com/the-equation-giveaway/75812/",
        "https://www.microsoft.com/en-us/msrc/blog/2017/04/protecting-customers-and-evaluating-risk/",
        "https://learn.microsoft.com/en-us/security-updates/securitybulletins/2017/ms17-010"
      ],
      "caveat": "Code relationship, alleged agency attribution, leaker identity and document authenticity are different questions. Use April 2017 for the later release until April 14/15 timestamp conventions are reconciled.",
      "relations": [
        [
          "assessed_related_to",
          "Equation Group",
          "Assessor: Kaspersky GReAT; high confidence applies to analyzed code relationship only"
        ],
        [
          "mitigated_by",
          "MS17-010",
          "Assessor: Microsoft; scope: listed SMB vulnerabilities, not the leak or event",
          "listed SMB vulnerabilities"
        ]
      ],
      "checked": "2026-10-16",
      "rights": "Original concise summary and factual metadata only; source works linked, not reproduced. No leak files or code imported.",
      "verification": "Source-verified research packet supplied by parent task; implementation preserves caveats. No fresh source retrieval in this build.",
      "source_packet": "Parent thread 01a14254-208a-7286-8868-683441dbc0cf, research handoff 2026-10-16"
    },
    {
      "id": "intel-venona-release",
      "type": "declassified_collection",
      "title": "VENONA translated-message releases",
      "dates": {
        "first_public_release_month": "1995-07"
      },
      "publisher": "National Security Agency",
      "summary": "The first of six public releases contained 49 translations about Soviet efforts to obtain U.S. atomic-research information. Historical message, translation, revision and public-release dates are separate fields.",
      "provenance_class": "official declassification",
      "sources": [
        "https://www.nsa.gov/Helpful-Links/NSA-FOIA/Declassification-Transparency-Initiatives/Historical-Releases/Venona/smdcat14707/VENONA/smdpage14707/9/smdsearch14707/Venona/"
      ],
      "caveat": "Declassified translations are not contemporary plaintext originals; uncertainty and later corrections remain relevant.",
      "relations": [
        [
          "released_by",
          "NSA"
        ],
        [
          "documents_subject",
          "Soviet intelligence and U.S. atomic research"
        ]
      ],
      "checked": "2026-10-16",
      "rights": "Original concise summary and factual metadata only; source works linked, not reproduced. No leak files or code imported.",
      "verification": "Source-verified research packet supplied by parent task; implementation preserves caveats. No fresh source retrieval in this build.",
      "source_packet": "Parent thread 01a14254-208a-7286-8868-683441dbc0cf, research handoff 2026-10-16"
    },
    {
      "id": "intel-friedman-papers",
      "type": "declassified_collection",
      "title": "William F. Friedman Collection of Official Papers",
      "dates": {
        "bulk_document_dates": "1930/1955",
        "public_release": "2015-04-20",
        "nsa_announcement": "2015-04-24"
      },
      "publisher": "NSA; National Archives; George C. Marshall Foundation",
      "people": [
        "William F. Friedman"
      ],
      "summary": "NSA describes more than 52,000 pages, primarily from 1930–1955. National Archives records an April 20 public release, preceding the April 24 announcement.",
      "provenance_class": "official declassification",
      "sources": [
        "https://www.nsa.gov/Helpful-Links/NSA-FOIA/Declassification-Transparency-Initiatives/Historical-Releases/Friedman-Documents/search-strategies/",
        "https://transforming-classification.blogs.archives.gov/2015/04/30/nsa-declassifies-and-releases-the-friedman-collection/",
        "https://www.nsa.gov/Press-Room/Press-Releases-Statements/Tag/121404/friedman-collection/"
      ],
      "relations": [
        [
          "documents_career",
          "William F. Friedman"
        ],
        [
          "released_by",
          "NSA"
        ]
      ],
      "checked": "2026-10-16",
      "rights": "Original concise summary and factual metadata only; source works linked, not reproduced. No leak files or code imported.",
      "verification": "Source-verified research packet supplied by parent task; implementation preserves caveats. No fresh source retrieval in this build.",
      "source_packet": "Parent thread 01a14254-208a-7286-8868-683441dbc0cf, research handoff 2026-10-16"
    },
    {
      "id": "intel-tonkin-release",
      "type": "declassified_collection",
      "title": "Gulf of Tonkin SIGINT historical releases",
      "dates": {
        "events": "1964-08",
        "first_release": "2005-11-30",
        "final_release": "2006-05-30"
      },
      "publisher": "National Security Agency",
      "summary": "The collection contains historical articles, chronologies, oral histories, SIGINT reports, translations and memoranda. Intelligence evidence, later historical interpretation and institutional endorsement remain distinct.",
      "provenance_class": "official declassification",
      "sources": [
        "https://www.nsa.gov/Helpful-Links/NSA-FOIA/Declassification-Transparency-Initiatives/Historical-Releases/Gulf-of-Tonkin/smdpage14697/4/smdsort14697/title/"
      ],
      "caveat": "NSA says authors’ opinions need not represent its official views. The collection is not a single categorical claim.",
      "relations": [
        [
          "documents_event",
          "Gulf of Tonkin incidents"
        ],
        [
          "released_by",
          "NSA"
        ]
      ],
      "checked": "2026-10-16",
      "rights": "Original concise summary and factual metadata only; source works linked, not reproduced. No leak files or code imported.",
      "verification": "Source-verified research packet supplied by parent task; implementation preserves caveats. No fresh source retrieval in this build.",
      "source_packet": "Parent thread 01a14254-208a-7286-8868-683441dbc0cf, research handoff 2026-10-16"
    }
  ],
  "assertions": [
    {
      "subject": "botnets-zombie-roundup-2005",
      "asserted_in": "botnets-zombie-roundup-2005",
      "subject_resolution": "Research seed record",
      "predicate": "documents_architecture",
      "object_label": "centralized IRC C2",
      "object_id": null,
      "target_url": null,
      "resolution": "Source-scoped label or seed ID; no global identity/alias merge",
      "scope": "As described by the cited research seed; not a new causal or attribution inference",
      "sources": [
        "https://www.usenix.org/conference/sruti-05/zombie-roundup-understanding-detecting-and-disrupting-botnets",
        "https://www.usenix.org/legacy/publications/library/proceedings/sruti05/prelim_papers/cooke/cooke_html/"
      ],
      "checked": "2026-10-16"
    },
    {
      "subject": "botnets-zombie-roundup-2005",
      "asserted_in": "botnets-zombie-roundup-2005",
      "subject_resolution": "Research seed record",
      "predicate": "documents_defense",
      "object_label": "multi-source behavioral correlation",
      "object_id": null,
      "target_url": null,
      "resolution": "Source-scoped label or seed ID; no global identity/alias merge",
      "scope": "As described by the cited research seed; not a new causal or attribution inference",
      "sources": [
        "https://www.usenix.org/conference/sruti-05/zombie-roundup-understanding-detecting-and-disrupting-botnets",
        "https://www.usenix.org/legacy/publications/library/proceedings/sruti05/prelim_papers/cooke/cooke_html/"
      ],
      "checked": "2026-10-16"
    },
    {
      "subject": "botnets-p2p-peacomm-2007",
      "asserted_in": "botnets-p2p-peacomm-2007",
      "subject_resolution": "Research seed record",
      "predicate": "analyzes",
      "object_label": "Trojan.Peacomm",
      "object_id": null,
      "target_url": null,
      "resolution": "Source-scoped label or seed ID; no global identity/alias merge",
      "scope": "As described by the cited research seed; not a new causal or attribution inference",
      "sources": [
        "https://www.usenix.org/conference/hotbots-07/peer-peer-botnets-overview-and-case-study"
      ],
      "checked": "2026-10-16"
    },
    {
      "subject": "botnets-p2p-peacomm-2007",
      "asserted_in": "botnets-p2p-peacomm-2007",
      "subject_resolution": "Research seed record",
      "predicate": "documents_architecture",
      "object_label": "peer-to-peer C2",
      "object_id": null,
      "target_url": null,
      "resolution": "Source-scoped label or seed ID; no global identity/alias merge",
      "scope": "As described by the cited research seed; not a new causal or attribution inference",
      "sources": [
        "https://www.usenix.org/conference/hotbots-07/peer-peer-botnets-overview-and-case-study"
      ],
      "checked": "2026-10-16"
    },
    {
      "subject": "botnets-botminer-2008",
      "asserted_in": "botnets-botminer-2008",
      "subject_resolution": "Research seed record",
      "predicate": "evaluated_against",
      "object_label": "Nugache",
      "object_id": null,
      "target_url": null,
      "resolution": "Source-scoped label or seed ID; no global identity/alias merge",
      "scope": "As described by the cited research seed; not a new causal or attribution inference",
      "sources": [
        "https://www.usenix.org/conference/17th-usenix-security-symposium/presentation/botminer-clustering-analysis-network-traffic-",
        "https://static.usenix.org/events/sec08/tech/full_papers/gu/gu_html/"
      ],
      "checked": "2026-10-16"
    },
    {
      "subject": "botnets-botminer-2008",
      "asserted_in": "botnets-botminer-2008",
      "subject_resolution": "Research seed record",
      "predicate": "evaluated_against",
      "object_label": "Storm",
      "object_id": null,
      "target_url": null,
      "resolution": "Source-scoped label or seed ID; no global identity/alias merge",
      "scope": "As described by the cited research seed; not a new causal or attribution inference",
      "sources": [
        "https://www.usenix.org/conference/17th-usenix-security-symposium/presentation/botminer-clustering-analysis-network-traffic-",
        "https://static.usenix.org/events/sec08/tech/full_papers/gu/gu_html/"
      ],
      "checked": "2026-10-16"
    },
    {
      "subject": "botnets-botminer-2008",
      "asserted_in": "botnets-botminer-2008",
      "subject_resolution": "Research seed record",
      "predicate": "documents_defense",
      "object_label": "cross-cluster traffic correlation",
      "object_id": null,
      "target_url": null,
      "resolution": "Source-scoped label or seed ID; no global identity/alias merge",
      "scope": "As described by the cited research seed; not a new causal or attribution inference",
      "sources": [
        "https://www.usenix.org/conference/17th-usenix-security-symposium/presentation/botminer-clustering-analysis-network-traffic-",
        "https://static.usenix.org/events/sec08/tech/full_papers/gu/gu_html/"
      ],
      "checked": "2026-10-16"
    },
    {
      "subject": "botnets-conficker-2009",
      "asserted_in": "botnets-conficker-2009",
      "subject_resolution": "Research seed record",
      "predicate": "analyzes",
      "object_label": "Conficker",
      "object_id": null,
      "target_url": null,
      "resolution": "Source-scoped label or seed ID; no global identity/alias merge",
      "scope": "As described by the cited research seed; not a new causal or attribution inference",
      "sources": [
        "https://www.usenix.org/legacy/event/leet09/tech/full_papers/porras/porras_html/index2.html",
        "https://attack.mitre.org/techniques/T1568/002/"
      ],
      "checked": "2026-10-16"
    },
    {
      "subject": "botnets-conficker-2009",
      "asserted_in": "botnets-conficker-2009",
      "subject_resolution": "Research seed record",
      "predicate": "source_documents_technique",
      "object_label": "T1568.002",
      "object_id": "ATTACK:enterprise:T1568.002",
      "target_url": "https://aol.pm/taxonomy/attack-enterprise-t1568-002.html",
      "resolution": "Exact existing enterprise ATT&CK external identifier; no new taxonomy entity",
      "scope": "MITRE ATT&CK Conficker procedure example; variant scope retained",
      "sources": [
        "https://www.usenix.org/legacy/event/leet09/tech/full_papers/porras/porras_html/index2.html",
        "https://attack.mitre.org/techniques/T1568/002/"
      ],
      "checked": "2026-10-16"
    },
    {
      "subject": "botnets-gameover-zeus-2014",
      "asserted_in": "botnets-gameover-zeus-2014",
      "subject_resolution": "Research seed record",
      "predicate": "disrupted",
      "object_label": "GameOver Zeus",
      "object_id": null,
      "target_url": null,
      "resolution": "Source-scoped label or seed ID; no global identity/alias merge",
      "scope": "As described by the cited research seed; not a new causal or attribution inference",
      "sources": [
        "https://www.fbi.gov/news/stories/gameover-zeus-botnet-disrupted",
        "https://www.justice.gov/archives/opa/pr/department-justice-provides-update-gameover-zeus-and-cryptolocker-disruption"
      ],
      "checked": "2026-10-16"
    },
    {
      "subject": "botnets-gameover-zeus-2014",
      "asserted_in": "botnets-gameover-zeus-2014",
      "subject_resolution": "Research seed record",
      "predicate": "involved_agency",
      "object_label": "FBI",
      "object_id": null,
      "target_url": null,
      "resolution": "Source-scoped label or seed ID; no global identity/alias merge",
      "scope": "As described by the cited research seed; not a new causal or attribution inference",
      "sources": [
        "https://www.fbi.gov/news/stories/gameover-zeus-botnet-disrupted",
        "https://www.justice.gov/archives/opa/pr/department-justice-provides-update-gameover-zeus-and-cryptolocker-disruption"
      ],
      "checked": "2026-10-16"
    },
    {
      "subject": "botnets-gameover-zeus-2014",
      "asserted_in": "botnets-gameover-zeus-2014",
      "subject_resolution": "Research seed record",
      "predicate": "associated_with",
      "object_label": "Cryptolocker",
      "object_id": null,
      "target_url": null,
      "resolution": "Source-scoped label or seed ID; no global identity/alias merge",
      "scope": "As described by the cited research seed; not a new causal or attribution inference",
      "sources": [
        "https://www.fbi.gov/news/stories/gameover-zeus-botnet-disrupted",
        "https://www.justice.gov/archives/opa/pr/department-justice-provides-update-gameover-zeus-and-cryptolocker-disruption"
      ],
      "checked": "2026-10-16"
    },
    {
      "subject": "botnets-mirai-2016-2017",
      "asserted_in": "botnets-mirai-2016-2017",
      "subject_resolution": "Research seed record",
      "predicate": "analyzes",
      "object_label": "Mirai",
      "object_id": null,
      "target_url": null,
      "resolution": "Source-scoped label or seed ID; no global identity/alias merge",
      "scope": "As described by the cited research seed; not a new causal or attribution inference",
      "sources": [
        "https://www.usenix.org/conference/usenixsecurity17/technical-sessions/presentation/antonakakis"
      ],
      "checked": "2026-10-16"
    },
    {
      "subject": "botnets-mirai-2016-2017",
      "asserted_in": "botnets-mirai-2016-2017",
      "subject_resolution": "Research seed record",
      "predicate": "documents_impact",
      "object_label": "DDoS",
      "object_id": null,
      "target_url": null,
      "resolution": "Source-scoped label or seed ID; no global identity/alias merge",
      "scope": "As described by the cited research seed; not a new causal or attribution inference",
      "sources": [
        "https://www.usenix.org/conference/usenixsecurity17/technical-sessions/presentation/antonakakis"
      ],
      "checked": "2026-10-16"
    },
    {
      "subject": "botnets-mirai-2016-2017",
      "asserted_in": "botnets-mirai-2016-2017",
      "subject_resolution": "Research seed record",
      "predicate": "documents_target_class",
      "object_label": "embedded and IoT devices",
      "object_id": null,
      "target_url": null,
      "resolution": "Source-scoped label or seed ID; no global identity/alias merge",
      "scope": "As described by the cited research seed; not a new causal or attribution inference",
      "sources": [
        "https://www.usenix.org/conference/usenixsecurity17/technical-sessions/presentation/antonakakis"
      ],
      "checked": "2026-10-16"
    },
    {
      "subject": "botnets-qakbot-2023",
      "asserted_in": "botnets-qakbot-2023",
      "subject_resolution": "Research seed record",
      "predicate": "disrupted",
      "object_label": "Qakbot",
      "object_id": null,
      "target_url": null,
      "resolution": "Source-scoped label or seed ID; no global identity/alias merge",
      "scope": "As described by the cited research seed; not a new causal or attribution inference",
      "sources": [
        "https://www.justice.gov/archives/opa/pr/qakbot-malware-disrupted-international-cyber-takedown"
      ],
      "checked": "2026-10-16"
    },
    {
      "subject": "Qakbot",
      "asserted_in": "botnets-qakbot-2023",
      "subject_resolution": "Source-scoped label; no global identity merge",
      "predicate": "facilitated",
      "object_label": "ransomware deployment",
      "object_id": null,
      "target_url": null,
      "resolution": "Source-scoped label or seed ID; no global identity/alias merge",
      "scope": "DOJ describes Qakbot malware capability, not the disruption event",
      "sources": [
        "https://www.justice.gov/archives/opa/pr/qakbot-malware-disrupted-international-cyber-takedown"
      ],
      "checked": "2026-10-16"
    },
    {
      "subject": "botnets-qakbot-2023",
      "asserted_in": "botnets-qakbot-2023",
      "subject_resolution": "Research seed record",
      "predicate": "involved_agency",
      "object_label": "FBI",
      "object_id": null,
      "target_url": null,
      "resolution": "Source-scoped label or seed ID; no global identity/alias merge",
      "scope": "As described by the cited research seed; not a new causal or attribution inference",
      "sources": [
        "https://www.justice.gov/archives/opa/pr/qakbot-malware-disrupted-international-cyber-takedown"
      ],
      "checked": "2026-10-16"
    },
    {
      "subject": "c2-dga",
      "asserted_in": "c2-dga",
      "subject_resolution": "Research seed record",
      "predicate": "maps_to_attack",
      "object_label": "T1568.002",
      "object_id": "ATTACK:enterprise:T1568.002",
      "target_url": "https://aol.pm/taxonomy/attack-enterprise-t1568-002.html",
      "resolution": "Exact existing enterprise ATT&CK external identifier; no new taxonomy entity",
      "scope": "As described by the cited research seed; not a new causal or attribution inference",
      "sources": [
        "https://attack.mitre.org/techniques/T1568/002/"
      ],
      "checked": "2026-10-16"
    },
    {
      "subject": "c2-dga",
      "asserted_in": "c2-dga",
      "subject_resolution": "Research seed record",
      "predicate": "contrasts_with",
      "object_label": "T1568.001",
      "object_id": "ATTACK:enterprise:T1568.001",
      "target_url": "https://aol.pm/taxonomy/attack-enterprise-t1568-001.html",
      "resolution": "Exact existing enterprise ATT&CK external identifier; no new taxonomy entity",
      "scope": "As described by the cited research seed; not a new causal or attribution inference",
      "sources": [
        "https://attack.mitre.org/techniques/T1568/002/"
      ],
      "checked": "2026-10-16"
    },
    {
      "subject": "c2-dga",
      "asserted_in": "c2-dga",
      "subject_resolution": "Research seed record",
      "predicate": "documented_example",
      "object_label": "Conficker",
      "object_id": null,
      "target_url": null,
      "resolution": "Source-scoped label or seed ID; no global identity/alias merge",
      "scope": "As described by the cited research seed; not a new causal or attribution inference",
      "sources": [
        "https://attack.mitre.org/techniques/T1568/002/"
      ],
      "checked": "2026-10-16"
    },
    {
      "subject": "c2-fast-flux",
      "asserted_in": "c2-fast-flux",
      "subject_resolution": "Research seed record",
      "predicate": "maps_to_attack",
      "object_label": "T1568.001",
      "object_id": "ATTACK:enterprise:T1568.001",
      "target_url": "https://aol.pm/taxonomy/attack-enterprise-t1568-001.html",
      "resolution": "Exact existing enterprise ATT&CK external identifier; no new taxonomy entity",
      "scope": "As described by the cited research seed; not a new causal or attribution inference",
      "sources": [
        "https://attack.mitre.org/techniques/T1568/001/",
        "https://media.defense.gov/2025/Apr/02/2003681172/-1/-1/0/csa-fast-flux.pdf"
      ],
      "checked": "2026-10-16"
    },
    {
      "subject": "c2-fast-flux",
      "asserted_in": "c2-fast-flux",
      "subject_resolution": "Research seed record",
      "predicate": "contrasts_with",
      "object_label": "T1568.002",
      "object_id": "ATTACK:enterprise:T1568.002",
      "target_url": "https://aol.pm/taxonomy/attack-enterprise-t1568-002.html",
      "resolution": "Exact existing enterprise ATT&CK external identifier; no new taxonomy entity",
      "scope": "As described by the cited research seed; not a new causal or attribution inference",
      "sources": [
        "https://attack.mitre.org/techniques/T1568/001/",
        "https://media.defense.gov/2025/Apr/02/2003681172/-1/-1/0/csa-fast-flux.pdf"
      ],
      "checked": "2026-10-16"
    },
    {
      "subject": "c2-dead-drop-resolver",
      "asserted_in": "c2-dead-drop-resolver",
      "subject_resolution": "Research seed record",
      "predicate": "maps_to_attack",
      "object_label": "T1102.001",
      "object_id": "ATTACK:enterprise:T1102.001",
      "target_url": "https://aol.pm/taxonomy/attack-enterprise-t1102-001.html",
      "resolution": "Exact existing enterprise ATT&CK external identifier; no new taxonomy entity",
      "scope": "As described by the cited research seed; not a new causal or attribution inference",
      "sources": [
        "https://attack.mitre.org/techniques/T1102/001/"
      ],
      "checked": "2026-10-16"
    },
    {
      "subject": "c2-dead-drop-resolver",
      "asserted_in": "c2-dead-drop-resolver",
      "subject_resolution": "Research seed record",
      "predicate": "documented_example",
      "object_label": "BLACKCOFFEE",
      "object_id": null,
      "target_url": null,
      "resolution": "Source-scoped label or seed ID; no global identity/alias merge",
      "scope": "MITRE ATT&CK source example, not a new actor attribution",
      "sources": [
        "https://attack.mitre.org/techniques/T1102/001/"
      ],
      "checked": "2026-10-16"
    },
    {
      "subject": "c2-dead-drop-resolver",
      "asserted_in": "c2-dead-drop-resolver",
      "subject_resolution": "Research seed record",
      "predicate": "documented_example",
      "object_label": "APT41",
      "object_id": null,
      "target_url": null,
      "resolution": "Source-scoped label or seed ID; no global identity/alias merge",
      "scope": "MITRE ATT&CK source example, not a personal identity claim",
      "sources": [
        "https://attack.mitre.org/techniques/T1102/001/"
      ],
      "checked": "2026-10-16"
    },
    {
      "subject": "c2-web-encryption",
      "asserted_in": "c2-web-encryption",
      "subject_resolution": "Research seed record",
      "predicate": "maps_to_attack",
      "object_label": "T1071.001",
      "object_id": "ATTACK:enterprise:T1071.001",
      "target_url": "https://aol.pm/taxonomy/attack-enterprise-t1071-001.html",
      "resolution": "Exact existing enterprise ATT&CK external identifier; no new taxonomy entity",
      "scope": "As described by the cited research seed; not a new causal or attribution inference",
      "sources": [
        "https://attack.mitre.org/techniques/T1071/001/",
        "https://attack.mitre.org/techniques/T1573/"
      ],
      "checked": "2026-10-16"
    },
    {
      "subject": "c2-web-encryption",
      "asserted_in": "c2-web-encryption",
      "subject_resolution": "Research seed record",
      "predicate": "distinguishes_from",
      "object_label": "T1573",
      "object_id": "ATTACK:enterprise:T1573",
      "target_url": "https://aol.pm/taxonomy/attack-enterprise-t1573.html",
      "resolution": "Exact existing enterprise ATT&CK external identifier; no new taxonomy entity",
      "scope": "As described by the cited research seed; not a new causal or attribution inference",
      "sources": [
        "https://attack.mitre.org/techniques/T1071/001/",
        "https://attack.mitre.org/techniques/T1573/"
      ],
      "checked": "2026-10-16"
    },
    {
      "subject": "intel-snowden-verizon-2013",
      "asserted_in": "intel-snowden-verizon-2013",
      "subject_resolution": "Research seed record",
      "predicate": "reported_by",
      "object_label": "Glenn Greenwald",
      "object_id": null,
      "target_url": null,
      "resolution": "Source-scoped label or seed ID; no global identity/alias merge",
      "scope": "As described by the cited research seed; not a new causal or attribution inference",
      "sources": [
        "https://www.theguardian.com/world/2013/jun/06/nsa-phone-records-verizon-court-order",
        "https://www.pulitzer.org/files/2014/public-service/guardianus/01guardianus2014.pdf"
      ],
      "checked": "2026-10-16"
    },
    {
      "subject": "intel-snowden-verizon-2013",
      "asserted_in": "intel-snowden-verizon-2013",
      "subject_resolution": "Research seed record",
      "predicate": "contextualized_by",
      "object_label": "intel-pclob-2014",
      "object_id": null,
      "target_url": null,
      "resolution": "Source-scoped label or seed ID; no global identity/alias merge",
      "scope": "As described by the cited research seed; not a new causal or attribution inference",
      "sources": [
        "https://www.theguardian.com/world/2013/jun/06/nsa-phone-records-verizon-court-order",
        "https://www.pulitzer.org/files/2014/public-service/guardianus/01guardianus2014.pdf"
      ],
      "checked": "2026-10-16"
    },
    {
      "subject": "intel-pclob-2014",
      "asserted_in": "intel-pclob-2014",
      "subject_resolution": "Research seed record",
      "predicate": "reviews_program",
      "object_label": "Section 215 bulk telephone records",
      "object_id": null,
      "target_url": null,
      "resolution": "Source-scoped label or seed ID; no global identity/alias merge",
      "scope": "As described by the cited research seed; not a new causal or attribution inference",
      "sources": [
        "https://www.pclob.gov/Oversight",
        "https://www.intelligence.gov/ic-on-the-record-database/declassified/dni-clapper-declassifies-additional-intelligence-community-documents-regarding-collection-under-section-501-of-the-foreign-intelligence-surveillance-act"
      ],
      "checked": "2026-10-16"
    },
    {
      "subject": "intel-pclob-2014",
      "asserted_in": "intel-pclob-2014",
      "subject_resolution": "Research seed record",
      "predicate": "contextualizes",
      "object_label": "intel-snowden-verizon-2013",
      "object_id": null,
      "target_url": null,
      "resolution": "Source-scoped label or seed ID; no global identity/alias merge",
      "scope": "As described by the cited research seed; not a new causal or attribution inference",
      "sources": [
        "https://www.pclob.gov/Oversight",
        "https://www.intelligence.gov/ic-on-the-record-database/declassified/dni-clapper-declassifies-additional-intelligence-community-documents-regarding-collection-under-section-501-of-the-foreign-intelligence-surveillance-act"
      ],
      "checked": "2026-10-16"
    },
    {
      "subject": "intel-vault7-court-context",
      "asserted_in": "intel-vault7-court-context",
      "subject_resolution": "Research seed record",
      "predicate": "disclosure_publisher",
      "object_label": "WikiLeaks",
      "object_id": null,
      "target_url": null,
      "resolution": "Source-scoped label or seed ID; no global identity/alias merge",
      "scope": "Vault 7 disclosure publisher, not publisher of court proceedings",
      "sources": [
        "https://www.justice.gov/usao-sdny/pr/former-cia-officer-joshua-adam-schulte-sentenced-40-years-prison-espionage-and-child",
        "https://www.nysd.uscourts.gov/sites/default/files/2024-04/1139%20Schulte%20Sealing%20Order.pdf"
      ],
      "checked": "2026-10-16"
    },
    {
      "subject": "intel-vault7-court-context",
      "asserted_in": "intel-vault7-court-context",
      "subject_resolution": "Research seed record",
      "predicate": "origin_institution",
      "object_label": "CIA",
      "object_id": null,
      "target_url": null,
      "resolution": "Source-scoped label or seed ID; no global identity/alias merge",
      "scope": "DOJ account of proved trial facts",
      "sources": [
        "https://www.justice.gov/usao-sdny/pr/former-cia-officer-joshua-adam-schulte-sentenced-40-years-prison-espionage-and-child",
        "https://www.nysd.uscourts.gov/sites/default/files/2024-04/1139%20Schulte%20Sealing%20Order.pdf"
      ],
      "checked": "2026-10-16"
    },
    {
      "subject": "intel-vault7-court-context",
      "asserted_in": "intel-vault7-court-context",
      "subject_resolution": "Research seed record",
      "predicate": "legal_case_subject",
      "object_label": "Joshua Adam Schulte",
      "object_id": null,
      "target_url": null,
      "resolution": "Source-scoped label or seed ID; no global identity/alias merge",
      "scope": "As described by the cited research seed; not a new causal or attribution inference",
      "sources": [
        "https://www.justice.gov/usao-sdny/pr/former-cia-officer-joshua-adam-schulte-sentenced-40-years-prison-espionage-and-child",
        "https://www.nysd.uscourts.gov/sites/default/files/2024-04/1139%20Schulte%20Sealing%20Order.pdf"
      ],
      "checked": "2026-10-16"
    },
    {
      "subject": "intel-shadow-brokers-2016-2017",
      "asserted_in": "intel-shadow-brokers-2016-2017",
      "subject_resolution": "Research seed record",
      "predicate": "assessed_related_to",
      "object_label": "Equation Group",
      "object_id": null,
      "target_url": null,
      "resolution": "Source-scoped label or seed ID; no global identity/alias merge",
      "scope": "Assessor: Kaspersky GReAT; high confidence applies to analyzed code relationship only",
      "sources": [
        "https://securelist.com/the-equation-giveaway/75812/",
        "https://www.microsoft.com/en-us/msrc/blog/2017/04/protecting-customers-and-evaluating-risk/",
        "https://learn.microsoft.com/en-us/security-updates/securitybulletins/2017/ms17-010"
      ],
      "checked": "2026-10-16"
    },
    {
      "subject": "listed SMB vulnerabilities",
      "asserted_in": "intel-shadow-brokers-2016-2017",
      "subject_resolution": "Source-scoped label; no global identity merge",
      "predicate": "mitigated_by",
      "object_label": "MS17-010",
      "object_id": null,
      "target_url": null,
      "resolution": "Source-scoped label or seed ID; no global identity/alias merge",
      "scope": "Assessor: Microsoft; scope: listed SMB vulnerabilities, not the leak or event",
      "sources": [
        "https://securelist.com/the-equation-giveaway/75812/",
        "https://www.microsoft.com/en-us/msrc/blog/2017/04/protecting-customers-and-evaluating-risk/",
        "https://learn.microsoft.com/en-us/security-updates/securitybulletins/2017/ms17-010"
      ],
      "checked": "2026-10-16"
    },
    {
      "subject": "intel-venona-release",
      "asserted_in": "intel-venona-release",
      "subject_resolution": "Research seed record",
      "predicate": "released_by",
      "object_label": "NSA",
      "object_id": null,
      "target_url": null,
      "resolution": "Source-scoped label or seed ID; no global identity/alias merge",
      "scope": "As described by the cited research seed; not a new causal or attribution inference",
      "sources": [
        "https://www.nsa.gov/Helpful-Links/NSA-FOIA/Declassification-Transparency-Initiatives/Historical-Releases/Venona/smdcat14707/VENONA/smdpage14707/9/smdsearch14707/Venona/"
      ],
      "checked": "2026-10-16"
    },
    {
      "subject": "intel-venona-release",
      "asserted_in": "intel-venona-release",
      "subject_resolution": "Research seed record",
      "predicate": "documents_subject",
      "object_label": "Soviet intelligence and U.S. atomic research",
      "object_id": null,
      "target_url": null,
      "resolution": "Source-scoped label or seed ID; no global identity/alias merge",
      "scope": "As described by the cited research seed; not a new causal or attribution inference",
      "sources": [
        "https://www.nsa.gov/Helpful-Links/NSA-FOIA/Declassification-Transparency-Initiatives/Historical-Releases/Venona/smdcat14707/VENONA/smdpage14707/9/smdsearch14707/Venona/"
      ],
      "checked": "2026-10-16"
    },
    {
      "subject": "intel-friedman-papers",
      "asserted_in": "intel-friedman-papers",
      "subject_resolution": "Research seed record",
      "predicate": "documents_career",
      "object_label": "William F. Friedman",
      "object_id": null,
      "target_url": null,
      "resolution": "Source-scoped label or seed ID; no global identity/alias merge",
      "scope": "As described by the cited research seed; not a new causal or attribution inference",
      "sources": [
        "https://www.nsa.gov/Helpful-Links/NSA-FOIA/Declassification-Transparency-Initiatives/Historical-Releases/Friedman-Documents/search-strategies/",
        "https://transforming-classification.blogs.archives.gov/2015/04/30/nsa-declassifies-and-releases-the-friedman-collection/",
        "https://www.nsa.gov/Press-Room/Press-Releases-Statements/Tag/121404/friedman-collection/"
      ],
      "checked": "2026-10-16"
    },
    {
      "subject": "intel-friedman-papers",
      "asserted_in": "intel-friedman-papers",
      "subject_resolution": "Research seed record",
      "predicate": "released_by",
      "object_label": "NSA",
      "object_id": null,
      "target_url": null,
      "resolution": "Source-scoped label or seed ID; no global identity/alias merge",
      "scope": "As described by the cited research seed; not a new causal or attribution inference",
      "sources": [
        "https://www.nsa.gov/Helpful-Links/NSA-FOIA/Declassification-Transparency-Initiatives/Historical-Releases/Friedman-Documents/search-strategies/",
        "https://transforming-classification.blogs.archives.gov/2015/04/30/nsa-declassifies-and-releases-the-friedman-collection/",
        "https://www.nsa.gov/Press-Room/Press-Releases-Statements/Tag/121404/friedman-collection/"
      ],
      "checked": "2026-10-16"
    },
    {
      "subject": "intel-tonkin-release",
      "asserted_in": "intel-tonkin-release",
      "subject_resolution": "Research seed record",
      "predicate": "documents_event",
      "object_label": "Gulf of Tonkin incidents",
      "object_id": null,
      "target_url": null,
      "resolution": "Source-scoped label or seed ID; no global identity/alias merge",
      "scope": "As described by the cited research seed; not a new causal or attribution inference",
      "sources": [
        "https://www.nsa.gov/Helpful-Links/NSA-FOIA/Declassification-Transparency-Initiatives/Historical-Releases/Gulf-of-Tonkin/smdpage14697/4/smdsort14697/title/"
      ],
      "checked": "2026-10-16"
    },
    {
      "subject": "intel-tonkin-release",
      "asserted_in": "intel-tonkin-release",
      "subject_resolution": "Research seed record",
      "predicate": "released_by",
      "object_label": "NSA",
      "object_id": null,
      "target_url": null,
      "resolution": "Source-scoped label or seed ID; no global identity/alias merge",
      "scope": "As described by the cited research seed; not a new causal or attribution inference",
      "sources": [
        "https://www.nsa.gov/Helpful-Links/NSA-FOIA/Declassification-Transparency-Initiatives/Historical-Releases/Gulf-of-Tonkin/smdpage14697/4/smdsort14697/title/"
      ],
      "checked": "2026-10-16"
    }
  ],
  "architecture_cards": [
    [
      "Coordination topology",
      "Centralized systems have a logical coordination point; peer-to-peer systems coordinate through peers. Hybrid systems can combine dependencies. Topology alone does not identify an operator.",
      [
        "botnets-zombie-roundup-2005",
        "botnets-p2p-peacomm-2007"
      ]
    ],
    [
      "Transport",
      "IRC and HTTP/S are application transports. Either label answers a different question from centralized or peer-to-peer coordination.",
      [
        "botnets-zombie-roundup-2005",
        "botnets-botminer-2008",
        "c2-web-encryption"
      ]
    ],
    [
      "Rendezvous",
      "A fixed address, generated candidate name or external resolver describes how infrastructure is found. Finding an address is distinct from carrying commands.",
      [
        "c2-dga",
        "c2-dead-drop-resolver"
      ]
    ],
    [
      "Infrastructure churn",
      "Fast flux changes address mappings; DGA changes candidate names. These mechanisms can coexist, and legitimate distributed services also require context.",
      [
        "c2-fast-flux",
        "c2-dga"
      ]
    ],
    [
      "Encryption",
      "Protocol-provided TLS and additional encryption are distinct properties. Do not automatically map every HTTPS connection to ATT&CK T1573.",
      [
        "c2-web-encryption"
      ]
    ],
    [
      "Detection and response",
      "Correlate endpoint and network observations, interpret DNS changes in context and retain the study’s measurement scope. A single indicator or a successful disruption is not a permanent verdict.",
      [
        "botnets-botminer-2008",
        "botnets-gameover-zeus-2014",
        "botnets-qakbot-2023"
      ]
    ]
  ],
  "coverage": {
    "records": 18,
    "botnet_and_architecture_records": 11,
    "intelligence_records": 7,
    "fulltexts": 0,
    "raw_leaks": 0,
    "complete_denominator": null
  },
  "rights": "Metadata and original summaries only. No full source-text reuse claimed."
}