Technical indicators for Citizen Lab reports :
- 201411_Communities@Risk : technical indicators for malware samples discussed in the report Communities @ Risk: Targeted Digital Threats Against Civil Society.
- 201510_NGO_Burma : IOCs from the report Targeted Malware Attacks against NGO Linked to Attacks on Burmese Government Websites published the 16th of October 2015
- 201512_PackRAT : IOCs from the Citizen Lab report "Packrat: Seven Years of a South American Threat Actor" published the 8th of December 2015
- 201603_Shifting_Tactics : IOCs from the Citizen Lab report Shifting Tactics: Tracking changes in years-long espionage campaign against Tibetans published the 10th of March 2016
- 201604_UP007_SLServer : IOCs from the Citizen Lab report Between Hong Kong and Burma: Tracking UP007 and SLServer Espionage Campaigns published the 18th of April 2016
- 201605_Stealth_Falcon : IOCs from the Citizen Lab report "Keep Calm and (Don’t) Enable Macros: A New Threat Actor Targets UAE Dissidents" published the 29th of May 2016
- 201608_Group5 : IOCs from the Citizen Lab report "Group5: Syria and the Iranian Connection" published the 2nd of August 2016
- 201608_NSO_Group : IOC from the Citizen Lab report "The Million Dollar Dissident: NSO Group’s iPhone Zero-Days used against a UAE Human Rights Defender" published the 24th of August 2016
- 201611_KeyBoy : IOCs from the Citizen Lab report It’s Parliamentary: KeyBoy and the targeting of the Tibetan Community published the 17th of November
Yara signatures can be found here: https://github.com/citizenlab/malware-signatures