The aptnotes.malwareconfig.com subdomain hosted a search-and-PDF-viewer interface to the APTnotes archive between roughly 2015 and 2019. Most of the inbound links to that subdomain came from research papers and blog posts in the same window, when “I want to read the FireEye APT1 report without leaving my browser” was a real workflow problem and a hosted PDF viewer was a real solution. The archive page for that subdomain now points at the canonical project; this post is the longer version of the same answer.

That problem has changed shape. The APTnotes archive itself is still maintained on GitHub at aptnotes/data , the maintainers still add reports, but the role it plays in a 2026 threat-intel workflow is different from the role it played in 2017. This is a practical note on where to look for APT reporting now, in what order, and what each archive is actually good at. None of the projects below are mine; I am describing other people’s work and crediting it by name.

What APTnotes is now

aptnotes/data is a flat archive of public APT-vendor PDF reports, indexed by year, with a YAML manifest. It is the continuation of kbandla’s original APTnotes repo , which is now archived but still worth knowing about for historical context. The archive is comprehensive for the era it covers and it is still maintained, but two things changed underneath it.

First, the discovery problem it solved got solved better elsewhere. In 2017 the value of APTnotes was that it collected the scattered vendor PDFs into one indexable place. In 2026 the indexing-and-cross-referencing job is done more thoroughly by the structured projects below, and a flat PDF archive is now the thing you reach for when you already know which report you want, not the thing you browse to discover one.

Second, the format moved. A meaningful share of 2024-2026 threat reporting is published as a vendor blog post with inline IOCs and an ATT&CK mapping, not as a downloadable PDF. A PDF archive captures the PDF-shaped reporting well and the blog-shaped reporting not at all. That is not a criticism of APTnotes; it is a description of where the reporting went.

So APTnotes in 2026 is best understood as the authoritative archive for the PDF era of APT reporting, roughly 2008 through the early 2020s, still maintained, still the right place for older campaigns whose canonical writeup predates the structured projects. It is no longer the right starting point for a fresh investigation. The starting point moved.

The broader-coverage archives

Two GitHub collections cover more than APTnotes does, in different ways.

RedDrip7’s APT_Digital_Weapon is a Chinese-language-leaning APT report archive maintained by the RedDrip team (QiAnXin). It carries vendor reporting that the Western-vendor-centric archives undercount, particularly reporting from Chinese vendors on campaigns targeting or originating in the region. If your investigation touches East Asian targeting, this archive frequently has reports the English-language collections do not.

CyberMonitor’s APT_CyberCriminal_Campagin_Collections (the typo in the repo name is original and load-bearing, because that is the URL everyone links) is the most comprehensive single-repo collection of public APT and cybercriminal campaign analysis I am aware of. It is organised by year, it goes back to 2006, and it includes both the APT reporting that APTnotes covers and a large body of financially-motivated-actor reporting that APTnotes does not. When I want to be sure I have not missed a report on a given campaign, this is the repo I check last, because it is the broadest net.

Neither of these is structured data. They are PDF-and-link collections, like APTnotes, with the same strength (comprehensive primary-source capture) and the same weakness (no cross-referencing layer, you bring your own).

Malpedia: the citation-grade layer

Malpedia , maintained by Fraunhofer FKIE, is the project that became the citation-grade encyclopedia for malware families and, by extension, a strong reference layer for the actors that use them. The distinction that matters: APTnotes and the collections above are archives of reports. Malpedia is a structured database of families, each entry curated, versioned, and carrying a reference list of the public reporting on that family.

For config-extraction work specifically, which is what this site is about, Malpedia is the entry I open first on any family because it aggregates the public analysis and the existing Yara coverage in one place, and the references are curated rather than dumped. The family-to-actor links let you pivot from “I have a sample of family X” to “which actors use family X and what is the public reporting on them” without leaving the page.

Malpedia is not trying to be a PDF archive and does not replace one. It is the structured index that sits on top of the archives. In practice you use both: Malpedia to orient and to find the canonical references, the archives to pull the actual primary-source PDFs the references point at.

MITRE ATT&CK Groups: the actor cross-reference

The cross-referencing role, “who did what, under how many vendor names, citing which reports,” moved decisively to MITRE ATT&CK Groups . Each group page carries the alias soup (the same actor named differently by each vendor), the techniques attributed to the group, the software associated with it, and citations into the underlying reporting.

This is the single largest change in the workflow since the subdomain era. In 2017 reconciling that vendor A’s “APT10” and vendor B’s “Stone Panda” and vendor C’s “MenuPass” were the same actor was manual work you did by reading reports. In 2026 the ATT&CK group page does the alias reconciliation for you and cites its sources. The MISP galaxy does a similar cross-referencing job in a machine-readable form if you need the data rather than the web pages, and the two are largely consistent.

ATT&CK Groups has a known limitation worth stating: coverage is selective. MITRE curates which groups get pages and which reporting gets cited, and the curation lags fresh activity and undercounts actors that have not been the subject of much English-language reporting. For a recent campaign, or for an actor mostly covered in non-English reporting, the ATT&CK page may be thin or absent, and you fall back to the archives.

A reading order for a fresh investigation

The practical answer to “where do I look” in 2026, in order:

1. MITRE ATT&CK Groups for the actor, if there is a page. It gives you the aliases, the technique profile, and the canonical citations in one place. Start here because it tells you what to read next.
2. Malpedia for the families the actor uses. It gives you the curated reference list per family and the existing detection coverage. This is also where you start if you are coming from a sample rather than from an actor name.
3. The vendor reporting itself, pulled from the citations the first two steps gave you. For PDF-era reports, APTnotes and CyberMonitor’s collection are where the PDFs live. For recent blog-shaped reporting, the vendor’s own research blog (Mandiant’s report library is the obvious one, but every major vendor has an equivalent) is the primary source.
4. The broader-coverage archives as the completeness check. CyberMonitor’s collection for the widest net, RedDrip7’s archive if the targeting has an East Asian dimension. These catch the reports the structured projects did not index.
5. The community collections for the long tail. vx-underground maintains a large public collection of samples and papers that is useful for primary-source material the curated projects skip. Florian Roth’s signature-base is the right cross-reference for the detection side, because if there is public Yara coverage of the actor’s tooling it is frequently there. AlienVault OTX is useful for community-contributed IOC pulses on active campaigns, with the usual caveat that the quality is uneven and you verify before you act on it.

The short version: structured projects to orient, archives to pull primary sources, detection repos to cross-check. The flat-PDF-archive-as-starting-point workflow that the subdomain served in 2017 is gone, and the thing that replaced it is better, because the cross-referencing layer that you used to build in your head now exists as maintained public infrastructure.

What this means for the subdomain

The aptnotes.malwareconfig.com subdomain is not coming back as a live viewer, and it should not. The viewer solved a 2017 problem that the projects above solve better in 2026. What the subdomain page does now is keep the historical inbound links resolving and point the human reader at aptnotes/data and the rest of the current ecosystem, which is the honest version of what that subdomain was ever actually for: a signpost to the canonical archive, maintained by people who are not me.

For continuity with the rest of this site, the reboot note covers the same archive-versus-successor logic applied to the config-extraction tooling, and the 2010s-web editorial covers why credit-by-name to the original authors still matters even when the tool or the archive has been superseded.

• Maren / halt0p