Reading contents
The right question
Before adding a figure to a report for a SOC, CSIRT or committee, establish what it represents and where it can be checked. A list of names does not answer those questions on its own. Traceability connects a count to its source and makes the uncertain parts of a conclusion visible.
This note explains the guarantees CTI LATAM states for its dataset and their limits of use. It does not disclose the internal structure or independently audit compliance with those guarantees. Its purpose is to help readers interpret and cite the published material.
What the dataset contains
The 17 September 2026 snapshot contains 56 families: 28 Android, 24 Windows and PoS/ATM, and 4 phishing-as-a-service families. It also records 7 CERT and regulator alerts. The original article describes family records with MITRE ATT&CK techniques and cited sources.
These figures count dataset entries. They do not measure infected devices, the percentage of banks affected or which country experienced the most attacks. Country coverage and documentary gaps help readers examine the distribution of references without turning it into a risk ranking.
The text also records an update dated 29 September: 67 families, comprising 31 Android, 28 Windows and 8 PhaaS families. Both snapshots are retained because they describe different versions. A citation should identify the one it uses, rather than combining one version’s total with another version’s subtotals.
Five guarantees
- Traceability: a technical claim should point to an identifiable, dated reference. A link enables checking the source; it does not automatically validate every conclusion added by the person citing it.
- Declared uncertainty: when the material does not establish a fact, that limit must remain visible. “Undetermined” is not replaced with a deduction presented as an observation.
- Reproducible counts: published figures should be recalculable from the corresponding index. Reproducing a count checks that calculation; it does not make the collection representative of all criminal activity.
- Dated updates: each update identifies its date and additions. Readers can then distinguish a shared documentary snapshot from two different versions.
- Manual curation: the stated process includes human review before data are added. That safeguard does not remove the need to identify uncertainty or correct a reference when necessary.
What is not disclosed
The internal structure and curation criteria belong to CTI LATAM and are not described in this note. Readers have the published safeguards and entry references; the text does not promise unrestricted access to all internal materials.
When citing a figure, identify the publication, author and dataset snapshot supporting it. Keep the relevant limitation alongside it: coverage is not prevalence, missing documentation does not prove absence of a threat, and a count does not attribute actors.
This article describes editorial criteria and corpus versions. It does not supply an infection measurement or independently validate the referenced investigations.
The reference text records the increase from 56 to 67 families on 29 September 2026 and eleven additions checked against primary sources. That statement belongs to the dated snapshot; those checks are not repeated here and their date is unchanged.
Version note: the figures in this analysis reflect the dataset cut-off in effect at the time of publication; the Atlas is updated continuously.
Ezequiel Jorge La Terra · ORCID 0009-0008-1677-4218 · Text licensed under CC BY 4.0.
How to cite: La Terra, E. J. (2026). What a Financial Malware Dataset Must Guarantee to Be Citable. Cyber Threat Intelligence LATAM. Updated Sep 21, 2026. https://cyberthreatintelligence.lat/en/blog/citable-financial-malware-dataset-guarantees/
Get new notes by email
When a new note comes out, I send you an email. No promotions and no sharing of your address.
Thank you, you are on the list. I will let you know when a new note comes out.