Resources

Malaysia releases the safety investigation report

30 July 2018

The ICAO Annex 13 team, led by Kok Soo Chon, publishes hundreds of pages and cannot determine the cause. Diversion is judged likely from manual inputs. Third-party intervention is not excluded.

Investigation networks spear-phished the day after MH370 vanished

CyberSecurity Malaysia · ~30 PCs · disclosed 20 August 2014

Confirmed as CSM’s public account. On 9 March, officials at the Department of Civil Aviation, the National Security Council and Malaysia Airlines were sent malware disguised as a news article that the aircraft had been found. About thirty computers were infected. Outbound mail carrying confidential files, including meeting minutes and classified documents, some related to MH370, was traced to an IP in China. CSM shut the machines down and asked Chinese providers to block the traffic. Police and Interpol were involved. What exactly was stolen is still unpublished.

Safety Investigation Report — MH370

Malaysian ICAO Annex 13 Team · 30 July 2018

The official accident report. Cause undetermined. Diversion likely from manual inputs; third-party intervention not excluded; 00:19 log-on treated as fuel exhaustion. No wreckage, no recorders.

Inside the Investigation: The Search for MH370 Truth

7NEWS · Peter Foley, Joe Hattley

Former lead search officials on internal protocol, sonar-mapping mistakes, and why a debris field can still be found. An Australian operational view, not a cockpit narrative.

The radar story and the 9 March cyberattack

Working chart · tracks, delays, and a spear-phish of the investigation

Two panels. Left: civilian secondary, Malaysian military primary, Thai paint disclosed ten days later, and the 12-hour lag before the civilian rescue centre was told. Right: one day after the loss, officials on the investigation were hit with a spear-phish that CyberSecurity Malaysia later said stole classified material toward an IP in China. Presence of a hack is confirmed as that agency’s public account. What was in the take — and whether it included radar — is still open.

Kok Soo Chon

Chief inspector · Malaysian Annex 13 team

Presented the 2018 report: diversion likely from manual inputs; who made them unknown; cause undetermined.

MH370 Research Master Log

Investigation chronology · 18–20 September 2026

Running chronology of findings: cargo, 2011–2013 ISR programmes, radar disclosure on the westbound track, MAGIC budget exhibits, and the alleged-video file.

Cargo, including lithium-ion batteries

Manifest reviewed; fire hypothesis not supported

The aircraft carried cargo including lithium-ion batteries. The investigation found they were packed to regulation and did not support a cargo-fire cause.

Handshake 7 — aircraft-initiated log-on

00:19:29 UTC · probable fuel exhaustion

The SDU sends a log-on request, then a log-on acknowledge eight seconds later. The investigation treats this as power-up after dual engine flame-out.

MyCERT: MH370-themed backdoor and fake-transcript spear-phish

MA-381 · 24 March 2014 · MA-386 · 18 April 2014

Confirmed public advisories, a different campaign from the 9 March official-network intrusion. 24 March: a Facebook-app lure dropping a backdoor with remote-control (C2) capability. 18 April: emails posing as an investigation team / ICAO portal item, password-protected archive, fake MH370 transcript, command-and-control. Aimed at organisations and the public, not shown to be the DCA/NSC/MAS breach.

Two waves of MH370-themed cyberattacks

9 March official-network intrusion · March–April public malware lures

Working chart of two separate campaigns. Attack one: 9 March spear-phish of officials at the Department of Civil Aviation, National Security Council and Malaysia Airlines — CyberSecurity Malaysia’s public account, disclosed in August. Attack two: MyCERT alerts on 24 March and 18 April about MH370-themed backdoors and a fake investigation-transcript phish aimed more widely. Destination IP in China is not the same as a finding that Beijing ran the operation.

Controlled descent / ditching

Someone still flying at the end

A pilot or system flies a glide after flame-out, so the wreck lies tens of kilometres from the 7th arc. Flaperon damage is read by some independent engineers as consistent with a ditching sequence.

Freescale gyros and the laser / directed-energy race

January 2025 briefing video: twenty Freescale employees on MH370; gyroscopic sensors; a US-led race with China and Russia on precision laser directed energy; later public silence on Freescale’s role; a prime contractor with Vanguard, BlackRock and State Street as large holders, and a reported 38% profit rise in 2014 after missile-defence grants.

Jeff Wise

Aviation journalist · Finding MH370

CNN-era MH370 analyst. Author of the 2015 northern-hijack / spoofed-BFO thesis. Host of Finding MH370. Treats the default pilot-suicide search as a failed prediction because the wreck is still unfound.

Last ACARS transmission

17:07:29 UTC

The final Aircraft Communications Addressing and Reporting System message leaves 9M-MRO. Expected reports at 17:37 and 18:07 never arrive.

Last voice contact

17:19:30 UTC · “Good night Malaysian three seven zero”

Lumpur Radar transfers MH370 to Ho Chi Minh. The reply — attributed to the captain — is the last recorded voice transmission from the flight.

Malaysian summary of possible MH370 debris

ICAO Annex 13 Team · updated 2017

Itemised list of wreckage recovered on western Indian Ocean coasts, with confirmation classes: confirmed, almost certain, highly likely, likely.

Mechanical / cargo-fire failure

Official report: no identified failure mode fits

A running systems failure that also produces a coherent reverse course and six more hours of SATCOM is a poor fit. Lithium-battery cargo was reviewed and not adopted as cause.

MH370 departs Kuala Lumpur

16:42 UTC · 00:42 MYT 8 March 2014

Malaysia Airlines Flight 370, a Boeing 777-2H6ER registered 9M-MRO, takes off from KLIA runway 32R bound for Beijing Capital International Airport with 227 passengers and 12 crew.

MH370 Disappearance: Minute by Minute

Licensed 53-minute feature · 2025–26 reprints

The same ~53:13 timeline film appears under DocuReal, Spark, Wonder, Real Stories and Progress with new title cards. Content is the public night: 00:41 takeoff, 01:19 sign-off, Malacca radar, Inmarsat, African debris.

New search for Malaysia Airlines Flight 370 underway

CBC News: The National · 31 December 2025 · 2:19

Canadian network report on Ocean Infinity Phase 2 putting to sea. Matches MOT dates: 31 December 2025 to 23 January 2026.

Right flaperon — Réunion

Found 29 July 2015 · confirmed 3 September 2015 as 9M-MRO

First physical evidence. Internal part numbers traced through EADS CASA to 9M-MRO. A 777 flaperon does not drift from Kazakhstan or the South China Sea to Réunion.

Right flaperon found on Réunion

29 July 2015

A Boeing 777 right flaperon washes ashore at Saint-Denis, Réunion. French authorities later confirm it is from 9M-MRO — the first physical evidence.

Satellite data unit logs back on

18:25:27 UTC · Handshake 1

Three minutes after the last radar paint, the aircraft SDU sends a log-on request to Inmarsat. Investigators treat this as a power restoration to the SATCOM avionics.

Secondary radar lost

17:21:13 UTC

Mode S transponder returns cease. Primary (military) radar continues to paint an unidentified westbound track consistent with MH370.

Surface search begins in the South China Sea

8 March 2014

Ships and aircraft search the Gulf of Thailand / South China Sea along the filed route — the wrong ocean for several days.

Terrorism

Hijack or bomb — not adopted as a finding

Stolen passports and a residual third-party clause keep the hypothesis in the file. No claim of responsibility, no identified bomb, no identified hijack crew.

They May As Well Have Been Flying the Plane

MH370 song, February 2026

Nic Moneypenny’s MH370 song: who signed off the project; FOIA walls; families still waiting. Dedicated to the search for what is still held back as national security.

Turn back across the Malay Peninsula

17:21–17:52 UTC

Primary radar shows a left turn off the Beijing airway, a crossing of Malaysia, and a track toward the Andaman Sea. The official report calls this diversion likely the result of manual inputs.

West-track disclosure lag — ministerial 10:30, ARCC 22:30, Thai 9–10 days

8 March and 18–19 March 2014

Hishammuddin 1 May 2014: military radar playback ~08:30 MYT 8 March, Air Force ops ~09:00, minister informed ~10:30 of a possible turn-back; a military aircraft west at 10:54. KL ARCC was not informed by RMAF of the western last-known until 22:30 MYT — a roughly 12-hour operational gap. Thai Surat Thani radar disclosed 18–19 March.

Zaharie Ahmad Shah

Pilot in command · MH370

Last attributed radio call: “Good night Malaysian three seven zero.” Home simulator files exist; the 2018 report did not treat them as a reconstructed plan. Who was flying after IGARI is open.

Factual Information — MH370

Malaysian investigation team · interim releases 2014–2015

Early factual compilations: aircraft history, crew, cargo, ATC transcripts, radar, SATCOM. Released before debris and before the 2018 analysis chapters. The 8 March 2015 issue (updated 15 April 2015) is held here as a downloadable original.

Blue Devil, MAGIC, Orion, BIG SAFARI — 2014 window

Briefing collages, 18 September 2026

Nic Moneypenny published investigation collages placing Blue Devil (including an egg-shaped airship), MAGIC, Aurora Orion, BIG SAFARI, Lockheed and DARPA in the same 2013–14 spending window as MH370, with Freescale’s last gyro presentation among the plates.

CyberSecurity Malaysia

National cyber agency · publicly described the 9 March intrusion in August 2014

Confirmed. Agency under the then Ministry of Science, Technology and Innovation. CEO Amirudin Abdul Wahab is the named source for the 9 March spear-phish of investigation officials. Digital forensics support to the affected departments; work with police and Interpol.

Pouria Nour Mohammad Mehrdad

Passenger · Iranian · boarded on a stolen Italian passport

Iranian. Travelled on MH370 using an Italian passport stolen from Luigi Maraldi. Later identified by name. The official investigation treated him as a likely asylum seeker, not as a hijacker.

Seyed Mohammed Reza Delavar

Passenger · Iranian · boarded on a stolen Austrian passport

Iranian. Travelled on MH370 using an Austrian passport stolen from Christian Kozel. Later identified by name. The official investigation treated him as a likely asylum seeker, not as a hijacker.

Source archive index

18 September 2026 · source register

Index of the important sources in the ISR investigation, with a status for each: full text, targeted extract, archived copy, snapshot, lead only, or still to be upgraded.

The MH370 Mystery — Parts 1 and 2

Easy Documentary · June 2025

Two-part compilation: Part 1 the public crash/disappearance narrative; Part 2 “inside the investigation’s biggest failures.” Secondary retelling of already-filed records.

Two stolen European passports

Italian and Austrian documents · two Iranian travellers

Yes — two Iranian men were on board. They travelled on stolen European passports (Italian and Austrian), not Iranian documents. The official investigation treated them as likely asylum seekers and did not adopt a terrorism finding.