The foundational taxonomy of this catalog is derived from the open-source EMBER 2018 dataset, a labeled benchmark dataset of 1.1 million PE file features released by Elastic for static malware classification research. This provides us with a statistically significant baseline of 2,903 unique malware families and variants observed in the wild.
Raw telemetry data is inherently noisy. To meet our strict E-E-A-T (Experience, Expertise, Authoritativeness, and Trustworthiness) standards, all high-impact malware profiles are manually reviewed and enriched by Ricky Jordan and the SystemHelpDesk Security Research Team.
Our editorial process ensures that automated data dumps are transformed into actionable threat intelligence, including:
SystemHelpDesk MSP maintains strict editorial independence. The inclusion of a malware family, threat actor, or security vendor in our catalog is based purely on objective threat telemetry and historical observation. We do not accept payment to alter threat descriptions or remove verified IOCs.
Threat intelligence is rapidly evolving. While we strive to keep our detection rules (YARA/Sigma) and IOCs updated, we explicitly state that our published indicators are historical and intended for retrospective threat hunting—not as a primary mechanism for live production blocking.
If you identify an error in our taxonomy or wish to contribute additional context to a malware family, please contact our research team.
Our complete analytical framework, statistical distributions, and Cisco CAIRN rule engineering principles are published in our formal academic technical report: Download Technical Report (PDF) (Report ID: SHD-TR-2026-08-MF, registered with Zenodo DOI: 10.5281/zenodo.20515698).
To support open threat intelligence sharing across enterprise security tools, the entire catalog is exported as an OASIS STIX 2.1 Threat Intel Bundle for automated ingestion into SIEM, SOAR, and Threat Intelligence Platforms (TIPs).