Our digital forensics investigations focus on Internet censorship, targeted malware, disinformation campaigns, election fraud, digital attacks against media sites, and other digital threats against a free and open Internet.
We collaborate with independent media and investigative journalists to validate and enrich their stories with digital forensics. Qurium also assists with media dissemination so that the stories reaches a wider public beyond local media. Several of our media partners have been awarded for their work in investigative journalism:
- Kloop Media, Kyrgyzstan, Global Investigative Journalism Network (Best Investigative Stories from the Former Soviet Union — 2017)
- Azadliq.info, Azerbaijan, Guardian Journalism Award winner (2014)
- Premium Times Nigeria, Nigeria, Pulitzer Prize, as a part of the Panama Papers Investigation (2017)
This page includes all forensic reports that have been released to the public. For full reports including media coverage, please see respective country page.
Azerbaijan
-

Phishing attack against Azerbaijani political and human right activists
-

A decade of efforts to keep independent Azeri media online
-

Sandman and Fineproxy behind the DDOS attacks against timetv.live
-

Targeted sophisticated phishing attacks against dissidents in Azerbaijan is trending
-

Get to know “man”, the person behind the phishing attacks in Azerbaijan
-

Fishing phishers in Azerbaijan
-

Find Face and Internet blocking in Azerbaijan
-

Fineproxy used to launch DDoS attack against site critical of Azerbaijani state oil company’s leader
-

DDOS: the inconvenient business visitor of Name.com
-

Media websites from Azerbaijan under DDOS.
-

SUS-759: Sandvine and Internet blocking in Azerbaijan
-

Politically motivated attacks against azadliq.info
-

Azerbaijan and the fineproxy DIY DDOS service (Region40 / QualityNetwork)
-

Corruption, Censorship and a Deep Packet Inspection Vendor
-

Flooding the messengers
-

24saat also under blocking in Azerbaijan
-

The original court case notification in Azerbaijan
-

Azadliq.info reloaded
-

Deep Packet Inspection and Internet censorship in Azerbaijan
-

News media websites attacked from Governmental Infrastructure in Azerbaijan
-

Technical notes about blocking in Azerbaijan
-

Akamai Load Balancing and Internet Congestion in Azerbaijan
-

How Azerbaijan is trying to block main opposition media news
Kyrgyzstan
-

Fake Newspaper announces the involvement of journalists of Radio Liberty in the killing of Saimaitu Airken
-

Kloop and OCCRP’s report “Public Land, Private Hands” under DDoS
-

Infocom unprovisions the Samara reverse proxy
-

Samara press conference
-

The State Registration Service caught in denial
-

Elections in Kyrgyzstan 2017 – Exposing Samara, a fraudulent voter management system
Myanmar
-

Myanmar junta keeps expanding the secret block list
-

Myanmar’s official social application OKPar – flawed privacy by design?
-

Myanmar – Multi-stage malware attack targets elected lawmakers
-

“My Ooredoo Myanmar” – Insecure communications
-

Internet blocking in Myanmar – secret block list and no means to appeal
-

Unrest in Myanmar
Philippines
-

Statement on the November 18, 2025 Court Decision in Quezon City
-

Deep fake of Maria Ressa connected to Russian cyberscam network
-

Hundreds of sites cloned to promote a Chinese gambling network
-

Tracking toxic backlinks against Rappler
-

Independent Philippine media “Bulatlat” blocked by Smart Broadband
-

The tip of the iceberg – the algorithm fraud industry
-

Israeli firm ‘Bright Data’ (Luminati Networks) enabled the attacks against Karapatan
-

Human rights alliance ‘Karapatan’ under long lasting DDoS attack
-

Attacks against media in the Philippines continue
-

DDoS attacks against Philippine websites during COVID-19
-

What is hosted at the Suniway network?
-

Attributing the attacks against media and human rights websites in the Philippines
-

Alternative news agency from Philippines “Bulatlat” under denial of service attack
Russia
-

Proxy.vn’s hidden Tin-Roof datacenter fueling fake accounts and DDoS attack on iStories.media
-

Proxy provider connected to state sanctioned research center linked to attack against investigative media
-

Yet another proxy provider behind the iStories DoS attacks
-

How Russia uses EU companies for propaganda
-

Russian exiled media Meduza.io facing repeated DDoS attacks
-

Russian disinformation against Zelenskyy exposed on Times Square billboard
-

Under the hood of a Doppelgänger
Forensic Series
Weaponizing Proxy and VPN Providers
-

Proxy.vn’s hidden Tin-Roof datacenter fueling fake accounts and DDoS attack on iStories.media
-

Proxy providers weaponized to launch denial of service attack against Rappler
-

DDoS attacks against Hungarian media traced to proxy infrastructure “White Proxies”
-

Volatile networks as a source of Denial of Service
-

Infrastructure of VPN providers is used to launch DDoS attacks
-

Rayobyte infrastructure enabling DDoS attacks
Dark Ops Undercovered
-

Episode VIII: Eliminalia re-appears to sink unwanted content
-

Looking Inside A Website Traffic Con
-

Eliminalia behind yet another technique to silence investigative media
-

Dark Ops Undercovered: Episode V- The mysterious lawyers of Alexander Mashkevich
-

Dark Ops Undercovered: Episode IV – Reputation Control and content take down
-

Dark Ops Undercovered: Episode III – Hello Mr. Andersan
-

Dark Ops Undercovered: Episode II – Eliminalia
-

Dark Ops Undercovered: Episode I – Eliminalia







































