Cleaner message format, add malware family extraction

content_classifier.py

@@ -84,9 +84,31 @@ class ContentClassifier:
         'apt1', 'apt28', 'apt29', 'apt32', 'apt33', 'apt34', 'apt35', 'apt37', 'apt38', 'apt39', 'apt40', 'apt41',
         'lazarus', 'kimsuky', 'andariel', 'fancy bear', 'cozy bear', 'sandworm',
         'turla', 'equation group', 'carbanak', 'fin7', 'fin6', 'fin8',
-        'conti', 'lockbit', 'blackcat', 'alphv', 'cl0p', 'clop', 'revil', 'darkside',
         'nobelium', 'hafnium', 'phosphorus', 'holmium', 'strontium',
-        'volt typhoon', 'flax typhoon', 'mustang panda', 'winnti'
+        'volt typhoon', 'flax typhoon', 'mustang panda', 'winnti',
+        'scattered spider', 'lapsus', 'lapsus$', 'unc2452', 'unc3944',
+        'ta505', 'ta577', 'ta558', 'gold southfield', 'gold dupont',
+    }
+
+    # Stored as display names; matched case-insensitively
+    MALWARE_FAMILIES = {
+        # Ransomware
+        'LockBit', 'REvil', 'BlackCat', 'ALPHV', 'Cl0p', 'Conti', 'DarkSide',
+        'Ryuk', 'BlackMatter', 'Akira', 'Black Basta', 'RansomHub', 'Rhysida',
+        'Medusa', 'Cactus', 'Play', 'Royal', 'Hive', 'Maze', '8Base',
+        'Hunters International', 'Inc Ransom', 'Monti', 'Nokoyawa',
+        # C2 frameworks / RATs
+        'Cobalt Strike', 'Mimikatz', 'Sliver', 'Brute Ratel', 'Havoc',
+        'AsyncRAT', 'Remcos', 'njRAT', 'NanoCore', 'XWorm', 'QuasarRAT',
+        'DarkComet', 'NetWire', 'Metasploit',
+        # Loaders / droppers
+        'Emotet', 'TrickBot', 'QakBot', 'IcedID', 'BazarLoader', 'Dridex',
+        'GootLoader', 'BumbleBee', 'PikaBot', 'DarkGate',
+        # Stealers
+        'AgentTesla', 'FormBook', 'RedLine', 'Vidar', 'Raccoon', 'Lumma',
+        'Rhadamanthys', 'StealC', 'Meduza', 'Aurora',
+        # APT tooling
+        'PlugX', 'ShadowPad', 'Gh0stRAT', 'PoisonIvy',
     }
 
     # MITRE ATT&CK technique pattern
@@ -125,6 +147,15 @@ class ContentClassifier:
                 found_actors.append(actor.upper())
         return list(set(found_actors))
 
+    def extract_malware_families(self, text: str) -> List[str]:
+        """Extract known malware family / tool names from text"""
+        text_lower = text.lower()
+        found = []
+        for family in self.MALWARE_FAMILIES:
+            if family.lower() in text_lower:
+                found.append(family)
+        return list(set(found))
+
     def extract_iocs(self, text: str) -> Dict[str, List[str]]:
         """Extract Indicators of Compromise from text"""
         iocs = {
@@ -285,6 +316,7 @@ class ContentClassifier:
         cves = self.extract_cves(combined_text)
         mitre_techniques = self.extract_mitre_techniques(combined_text)
         threat_actors = self.extract_threat_actors(combined_text)
+        malware_families = self.extract_malware_families(combined_text)
         iocs = self.extract_iocs(combined_text)
 
         # Classify content type
@@ -306,13 +338,14 @@ class ContentClassifier:
         article['cves'] = cves
         article['mitre_techniques'] = mitre_techniques
         article['threat_actors'] = threat_actors
+        article['malware_families'] = malware_families
         article['iocs'] = iocs
 
         # Log classification
         logger.info(
             f"Classified: {article['title'][:50]}... | "
             f"Score: {quality_score} | Severity: {severity} | "
-            f"Types: {', '.join(classifications)} | CVEs: {len(cves)}"
+            f"CVEs: {len(cves)} | Actors: {len(threat_actors)} | Malware: {len(malware_families)}"
         )
 
         return article