Malware analysis CSIRT-led

Karton

Runs distributed malware processing tasks using Python workers, Redis messaging and S3 storage, with independent analysis services around the core framework.

By CERT Polska · Poland

Open primary source Compare saved tools Report a correction

CSIRT-led

Primary sources connect this project to an EU CSIRT as developer or lead.

At a glance

Recorded facts

Response workflow: Malware analysis
Developer or maintainer: CERT Polska
Recorded country: Poland
Product model: Open source
Deployment: Self-hosted
Software license: BSD-3-Clause
Upstream status: Active
Evidence class: CSIRT-led

What the sources establish

Origin note

CERT Polska publishes and maintains the upstream framework.

Reported capabilities

Distributed processing framework
Redis task routing
S3 sample exchange

Scope and limits

Count the framework once; individual Karton workers and plugins are not separate entries.

Inspect the research evidence 3 source observations

identity / origin / capabilities / deployment
README identifies distributed malware processing framework and documents Python, Redis, S3 and installation.
Read source Checked 2026-10-10
license
Actual license text is three-clause BSD and credits CERT Polska.
Read source Checked 2026-10-10
country / maintenance
Verified Polish CERT organization lists Karton with a 2026 update.
Read source Checked 2026-10-10

This profile summarizes source material. It does not include hands-on security testing, procurement review, or an assessment of fit for your environment.

Capabilities & integrations

Tags record specific documented functions. They do not establish end-to-end interoperability; check the component, edition and version in the source.

YARA Capability

The optional karton-yaramatcher service applies supplied YARA rules to pipeline files and tags matching samples. Rules are not included.

Karton YARA matcher service and configuration

Support evidence checked 2026-10-11

Documented EU funding

Connecting Europe Facility (CEF) · Advanced Threat Monitoring and Cooperation on the European and National Levels (AMCE)

Reference: 2018-PL-IA-0168

NASK identifies Karton as a tool developed under AMCE, which ran from June 2019 to December 2021. The funding record is historical.

Funding evidence checked 2026-10-11

Funding can be historical or component-specific. It does not imply EU certification, current funding or endorsement. Explore the funding collection.

Put the tool in context.

Plan suspicious-file intake, static analysis, specialist escalation and a defensible handoff. Compare the documented roles of MWDB Core, Pandora and Karton.

A malware triage workflow for suspicious files