Introducing the Open-Source Malware Families Catalog: 2,903 Families Mapped to MITRE ATT&CK

#cybersecurity #opensource #infosec #malware

If you are a detection engineer, threat hunter, or machine learning researcher, you know the pain of trying to find high-quality, modern malware datasets.

For years, the industry has relied on synthetic benchmarks from 2010 or outdated Kaggle datasets from 2015. Training a modern AI model or writing an EDR (Endpoint Detection and Response) rule based on a decade-old trojan is useless against today's highly obfuscated, polymorphic threats.

The threat landscape has evolved. Our datasets hadn't. So we built a new one.

Introducing the Malware Families Catalog

We have officially open-sourced the Malware Families Catalog—a meticulously curated, interactive database documenting over 2,903 distinct malware families derived from the EMBER benchmark and enriched with real-world threat intelligence.

Unlike static CSV dumps of old MD5 hashes, this catalog is designed for actionable threat intelligence and modern detection engineering.

🎯 Deep MITRE ATT&CK Mapping

Every major malware family in the catalog (from Pikabot and AgentTesla to LockBit and BlackCat) is heavily cross-referenced against the MITRE ATT&CK Framework.

We don't just tell you what the malware is; we document how it operates. You can explore detailed breakdowns of:

Initial Access Vectors (e.g., spearphishing attachments, exposed RDP)
Execution & Persistence (e.g., registry run keys, scheduled tasks)
Defense Evasion (e.g., process injection, rootkits)
Command and Control (C2) infrastructure patterns

🛡️ Comprehensive Threat Categories

The catalog is logically structured into dedicated defensive domains to help SOC teams and researchers isolate specific threat profiles:

Why We Open-Sourced It

Cybercriminals share code, infrastructure, and tactics daily. Defenders need to do the same. By open-sourcing the catalog, we are providing the community with a centralized hub for tracking the behaviors of modern threats.

Whether you are building the next generation of LLM-powered SOC analysts, writing Sigma rules for your SIEM, or researching the evolution of specific threat actors, this database provides the ground-truth intelligence you need.

Explore and Contribute

The entire catalog is free, Apache-2.0 licensed, and permanently archived:

🌐 Explore the Interactive Searchable Catalog

💻 Star the Repository & Contribute on GitHub

📦 Dataset Mirrors on Hugging Face & Kaggle

📄 Permanent Academic DOI: 10.5281/zenodo.20515698

Explore the full interactive database at Malware Families Catalog. Open access under Apache-2.0. Datasets hosted on Hugging Face and Kaggle. Permanent citation DOI: 10.5281/zenodo.20515698.

DEV Community