ThreatPaper Maps the Human Machinery Behind Cybercrime

Field notes

ThreatPaper structures its research index like an incident-response briefing: each entry identifies the attack class, target, severity, actors, date, and estimated reading time. The visible issue includes an 18-minute BlackCat insider-threat investigation, a report on a malicious npm package that exfiltrated mail through a BCC, and an Archetyp market investigation citing five years of operation and €330 million in Monero. The page also states that its research uses timelines, MITRE ATT&CK mappings, indicators of compromise, and defensive lessons.