No specimens catalogued yet.
The archive's primary database.
Every accepted intake gets a permanent case number, a five-stage autopsy, and a place in this table. Search or filter it the way you'd query any real research archive.
The Digital Autopsy
Every case file — no exceptions — moves through the same five stages, in the same order. Recognizable the way a medical journal is recognizable: you always know where you are in the file.
Executive Diagnosis. Before the dissection, every autopsy opens with a short pathology summary — what the specimen is, what it does, primary risk, and confidence — so a reader who needs the verdict never has to read the evidence to get it.
Intake
How the specimen arrived, what it claimed to be, and first triage.
Isolation
Detonation inside a monitored, air-gapped sandbox with C2 sinkholed.
Dissection
Static and dynamic reversing — YARA rules, strings, disassembly.
Behavioral Pathology
Symptoms mapped to ATT&CK technique IDs and a detonation timeline.
Remediation
Indicators, rules, and response steps — then the case is stamped.
↓ Open the latest intake above, or any card in the Vault, to see the full autopsy.
Longer work. Not case files.
Malware × ML, agentic security, detection engineering, CTI methodology — the investigations that don't belong to a single specimen. Research articles don't pretend to be autopsies.
Not a blog. A logbook.
Dr. Mori's day-to-day: experiments, interesting observations, failed approaches, tool testing — short investigations that don't warrant a full autopsy.
Recovered Artifact
Some evidence arrives corrupted. Move Dr. Mori's lens over the dump below to recover the annotated version underneath — the same pattern works over screenshots, strings, and network captures.
Magnifying Glass Mode
Dr. Mori's lens replaces the cursor over annotated evidence. What looks like corruption is a byte-for-byte disassembly — the lens just shows you the part that's already been read.
Equipment, not products.
Open-source tools built by the institute, released as apparatus — versioned, licensed, documented.
An institute, not a persona.
Dead Machine Society is a digital pathology institute — a research practice that treats malware the way a hospital treats disease. Every specimen that reaches the archive is intake, isolated, dissected, diagnosed, and, where possible, prevented from doing this to anyone else again. The research focus is deliberately narrow: malware analysis and reverse engineering, threat intelligence methodology, and — increasingly — how AI and agentic systems change both sides of that work.
Dr. Mori narrates the archive. He is the institute's curator and researcher persona — the voice behind the case notes, the Field Notes entries, and the occasional 2 a.m. observation about a stubborn packer. He is not the whole of DMS. Dead Machine Society is researched and written by its founder, with Dr. Mori as the lab's public face and Field Notes' author, and — over time — with room for collaborators whose work earns its own byline.
Methodology
- 01 Every specimen gets the same five-stage autopsy — no shortcuts, no exceptions.
- 02 Findings are labeled by evidence tier: observed, inferred, confirmed, or unknown.
- 03 Conclusions cite sources — ATT&CK IDs, vendor research, and prior DMS cases.
- 04 Narrative voice and evidence are kept visually distinct, always.
Memento Mori
The phrase is not decoration. Machines fail. Software decays. Infrastructure dies, on a schedule nobody sends a calendar invite for. Defenses that work today become obsolete the day someone studies them closely enough — which is, not incidentally, the job description of this institute. Remembering that everything running is also something that will eventually stop running is not a morbid habit. It is how you learn what keeps a system alive in the meantime, and what quietly stopped protecting it months before anyone noticed.
VERIFIED CASE
ARCHIVE
DMS
Written and researched independently. Collaborations and outside case contributions are welcome — reach out through the archive.
hello@deadmachinesociety.io