US Cyber Command

CNMF Malware Sharing via VirusTotal

The U.S. Cyber Command Cyber National Mission Force (CNMF) shares unclassified malware samples on VirusTotal via the CYBERCOM_Malware_Alert account. This public threat intelligence sharing program posts malware samples attributed to state-sponsored threat actors from Russia, Iran, North Korea, and other adversaries. The program launched in November 2018 to improve global cybersecurity by sharing samples with the security community. Follow @CNMF_VirusAlert on Twitter/X for alerts on new uploads.

GitHub

Documentation

📖
Documentation
CYBERCOM VirusTotal Malware Alert Feed
📖
GettingStarted
CNMF Malware Sharing Initiative Announcement

Schemas & Data

📊
JSONSchema
Malware Sample Schema
📊
JSONSchema
Threat Actor Schema

API entry from apis.yml

apis.yml Raw ↑ 
aid: us-cyber-command:cnmf-virustotal-malware-sharing
name: CNMF Malware Sharing via VirusTotal
tags:
- Cybersecurity
- Malware
- Threat Intelligence
- VirusTotal
- Federal Government
humanURL: https://www.virustotal.com/gui/user/CYBERCOM_Malware_Alert/comments
properties:
- url: https://www.virustotal.com/gui/user/CYBERCOM_Malware_Alert/comments
  type: Documentation
  title: CYBERCOM VirusTotal Malware Alert Feed
- url: https://www.cybercom.mil/Media/News/News-Display/Article/1681533/new-cnmf-initiative-shares-malware-samples-with-cybersecurity-industry/
  type: GettingStarted
  title: CNMF Malware Sharing Initiative Announcement
- url: https://raw.githubusercontent.com/api-evangelist/us-cyber-command/refs/heads/main/json-schema/uscybercom-malware-sample-schema.json
  type: JSONSchema
  title: Malware Sample Schema
- url: https://raw.githubusercontent.com/api-evangelist/us-cyber-command/refs/heads/main/json-schema/uscybercom-threat-actor-schema.json
  type: JSONSchema
  title: Threat Actor Schema
description: The U.S. Cyber Command Cyber National Mission Force (CNMF) shares unclassified malware samples
  on VirusTotal via the CYBERCOM_Malware_Alert account. This public threat intelligence sharing program
  posts malware samples attributed to state-sponsored threat actors from Russia, Iran, North Korea, and
  other adversaries. The program launched in November 2018 to improve global cybersecurity by sharing
  samples with the security community. Follow @CNMF_VirusAlert on Twitter/X for alerts on new uploads.