Malware Families
Malware Families
Malware Families
Explore an extensive collection of the most popular malware families, including detailed descriptions, tactics, and insights into their connections with threat actors. This page serves as a comprehensive resource for security professionals and researchers, offering valuable information to understand, detect, and defend against malware threats.
Search...
100+ C2 Families
Tracked Live
950+ Threat Actors
In our database
Top 10 Malware Families
Top 10 Malware Families
Top 10 Malware Families
Latest Updates
Latest Updates
Latest Updates
Threat Actors
Threat Actors
Threat Actors
faq
Frequently
asked questions
Frequently
asked questions
Frequently
asked questions
What is the Malware Families database?
It’s a collection of profiles for malware families and offensive tools we see in the wild. Each one covers what the malware does, how it’s used, and which threat actors have been linked to it.
What’s in each malware profile?
A short description, the tactics it relies on, tags like platform or category (stealer, RAT, backdoor, etc.), and the threat actors connected to it. Where it makes sense, there are also tips on detection and mitigation.
Why are tools like Cobalt Strike, Metasploit or Sliver listed here?
They’re legit tools built for pentesting and red teaming, but attackers use them all the time too. We profile them because their infrastructure shows up next to real malware C2s, and defenders need to tell the two apart. Those profiles are tagged “Pen testing” so you can spot them quickly.
How does Hunt find this infrastructure?
Hunt scans the internet for malware protocols, SSL certificates, and JARM/JA4 hashes. Hosting providers that tend to attract malicious activity get extra scanning. Our research team keeps updating the signatures and validators to cut false positives and find new servers.
How fresh is the data behind these profiles?
Very. Our scanners log hundreds of thousands of C2 checks every day, and new servers show up in the platform as soon as they’re validated. The profiles explain the malware; the platform shows you where it’s running right now.
What does “100+ C2 families tracked live” mean?
It’s the number of malware and C2 families with active infrastructure detected by Hunt over the last 30 days. The number moves a bit as families come and go, so we keep it rounded down.
Can I get the actual C2 servers for a malware family?
Yes. The C2 Feed gives you the IPs, hostnames, ports, malware names and confidence scores behind these profiles. It’s updated daily, covers the last 7 days, and you access it through our API. You can also search a family directly in the Hunt platform and pivot from there.
Hunt adversary infrastructure in real time. Surface C2 servers, enrich IOCs,
and map attacker activity at scale with our unified threat hunting platform.
Hunt adversary infrastructure in real time. Surface C2 servers, enrich IOCs,
and map attacker activity at scale with our unified threat hunting platform.
Hunt adversary infrastructure in real time. Surface C2 servers, enrich IOCs,
and map attacker activity at scale with our unified threat hunting platform.