Prefix a filter with + to require it, or - to exclude it — e.g. +country:us only shows US victims, -country:us hides them. Mix several with free-text words; everything is combined with AND (so hospital +country:us -group:lockbit3 means: text "hospital", country is US, group is not lockbit3). Repeating + on the same field is OR'd together (+country:us +country:ca → US or Canada); repeating - excludes all of them. Wrap multi-word values in quotes, e.g. +sector:"public sector". infostealer, press and multipleclaims take a bare +/- with no value: +infostealer / -infostealer filter on infostealer data, while +press searches press articles only and -press hides press coverage; +multipleclaims restricts to victims claimed by more than one group (cross-referenced) and -multipleclaims keeps only single-claim victims; +campaign:fortibleed / -campaign:fortibleed filter on domains found in the FortiBleed leaked-credential dataset; +ioc:<value> searches IOCs only (no -ioc: form) and returns the group(s) that value belongs to — <value> can be a literal indicator (hash, email, wallet, IP, domain, ...) or a group's slug, and it takes over the whole search, ignoring every other term/filter; a query starting with CVE- (e.g. CVE-2023-4966, or a partial id like CVE-2024) searches vulnerabilities only and returns the group(s) known to exploit it; before:/after: take a date directly with no +/- prefix, as shown below.