Glossary and limits of use

Glossary

First identify what is being counted. Then check what the source states and how far that statement extends.

Corpus

The editorial scope of CTI LATAM: malware, PhaaS, BEC, ransomware, deepfakes, KYC and the other research topics covered on the site. It has no single total. The Atlas is a subset of malware and PhaaS families, retaining the count of 67 as of 2026-09-29. Field investigations are not automatically included in that number.

Atlas LATAM · Atlas China

Separate reference collections on financial malware. Atlas LATAM organizes regional documentation; Atlas China is not merged into it. In the provenance review, the China collection retains its SIN_VERIF — unverified status. Naming both does not certify equal validation. The article on four cases and their limits explains the reservation.

Own dataset · documentary data

References, profiles and classifications assembled to study the regional scope stated by the sources. Cross-references between families, techniques and countries describe this collection at a specified date; they are not first-party telemetry. A missing entry does not rule out a threat. See the dataset citability criteria.

Dataset fronts

Organizing categories: Android; Windows, including PoS/ATM and toolkits; PhaaS; and institutional alerts. The alert front is a small sample, not a regional monitoring service. Fronts help readers navigate different kinds of references; their size does not measure attack volume.

ATT&CK profile

A family profile linking techniques described in its sources to MITRE ATT&CK. The stated approach is conservative: a technique needs documentary support. The mapping does not show that an institution observed the technique in its own telemetry.

Malware family

A name used by sources to group related samples by code or behavior and describe their connections. The site retains aliases and relationships as attributed to each source. A shared name or infrastructure alone is not enough to merge profiles; see the alias and canonical-name table.

Banking trojan

Malware whose documented function targets credentials, sessions, funds or the facilitation of banking fraud. Classification follows the source. The label does not certify a forensic incident or establish every capability associated with another banking family.

ATS (Automatic Transfer System)

The capability to initiate or manipulate transfers automatically. This dataset records it when the source describes it, not because a family is labelled banking malware. A technical capability and the number of transfers actually executed are different claims.

Overlay

A false screen placed over a legitimate application to obtain data, frequently described in the Android front. Recording an overlay requires the relevant reference; a similar interface or family name does not replace that evidence.

PhaaS (phishing-as-a-service)

Phishing panels, kits and infrastructure offered as a service. This dataset category is distinct from malware installation on a device. A kit alone does not establish victim counts or identify the operator of every campaign.

AiTM / MitM

Documented intermediation in a session to obtain credentials, cookies or other data. The specific mechanism must appear in the source; fraud after login alone does not establish it. The article on tokens and session theft explains the case and its limitations.

Smishing · vishing

Smishing means phishing through SMS or short-message channels, including iMessage or RCS when described by the source. Vishing refers to voice-based deception. An alert may document either channel without identifying a malware family; no family name should be invented.

Indicator of compromise (IOC)

A technical trace — a hash, domain, IP address or URL — published with provenance and context. The map and dataset do not replace an operational feed. Field investigations may provide first-party indicators in non-clickable form. Each indicator must be interpreted using its date, scope and stated purpose; its presence does not demonstrate a reader’s infection.

Field investigation

The author’s own observation documented in an investigation, separate from the references collected in the Atlas. Observations must remain distinct from assessments and unresolved questions. Activity during the observation does not prove that a campaign remains active when the page is read.

Prevalence · documentary coverage

Prevalence would measure frequency in victims or telemetry; it is not measured here. Documentary coverage is the presence of references in a dataset at its cutoff date. The article on countries with data and coverage gaps explains why these are not attack rankings.

Primary · secondary source

A primary source is the original report or alert contributing a finding; a secondary source summarizes or republishes it. Republication is not a second independent confirmation of the same fact. The original remains the point of comparison when available.

Claim exceeding the source

A number, geography, attribution, relationship or claim of primacy that goes beyond the cited document. Review should narrow it, exclude it or leave it pending with a reason. A local correction proposal must not be described as already published in the corrections log.

Coverage gap

A country, technique or family without evidence in the reviewed collection. This is a documentation limit, not a threat-free territory. It does not by itself assess a CERT’s coverage or effectiveness, nor allow victims to be inferred from an aggregated reference to LATAM.

Limits of use

A figure depends on its unit, reference and cutoff date. These reading rules do not certify every entry in the underlying collections.