What is aptnotes?

APTnotes is a collection of publicly available security research reports about APT campaigns, organized by year. APT stands for Advanced Persistent Threat, a term used in the security industry to describe sophisticated, often state-sponsored groups that conduct targeted attacks against governments, corporations, and critical infrastructure. The reports cover groups linked to many countries, including North Korea, China, Russia, and Iran, and their activities against targets around the world. The repository does not contain code or software. It is a curated index of links pointing to PDFs and documents hosted externally, mostly on Box.com. Each entry is a dated link to a published report from a security firm or government agency. The reports describe specific attack campaigns: who was targeted, what tools were used, and how the attackers operated. The list is sorted in reverse chronological order, starting from 2023 and going back to the early days of public APT research. Hundreds of reports are catalogued across more than a decade of documented activity. Entries cover well-known groups like Lazarus (North Korea), Sandworm (Russia), Mustang Panda and OilRig (China and Middle East-linked), and many others that appear only once or twice in the public record. A companion data repository exists at github.com/aptnotes/data to make the index easier to work with programmatically. New reports can be submitted as GitHub issues there. The main APTnotes repository functions as a human-readable reference and discovery point, not a tool for automation. If you are a researcher, journalist, or analyst trying to understand the history of sophisticated cyber campaigns, this collection is a starting point. It does not analyze the reports or summarize them itself. Each link takes you to an external document you read on your own. The full README is longer than what was shown.