What this endpoint does

This endpoint returns Recorded Future's complete taxonomy of malware categories, providing a reference list of all classification types used to categorize malware families across the platform. Each category includes multilingual aliases (covering languages such as Russian, Chinese, French, and Arabic) that can help match threat intelligence references across different sources. Use this endpoint to discover valid category identifiers for filtering or classifying malware entities, and to understand the malware landscape categories available in the Malware Threat Map and Malware Threat Map (Org) endpoints.

Response data

The response contains a data array of malware category objects, each with a short alphanumeric id, a type of "MalwareCategory", and an attributes object containing the canonical name (e.g., "Ransomware", "Trojan", "Botnet") and an optional alias array of alternative names in multiple languages. A counts object provides returned and total fields indicating the number of categories. The current taxonomy includes 100 categories spanning broad types like ransomware, trojans, and botnets, as well as specialized categories such as POS malware, ICS malware, and cryptocurrency mining malware.