Abstract: The present disclosure generally relates to a multi-phase malware identification and/or profiling process that can be implemented by one or more computer systems and/or computer-implemented methods. For example, one or more embodiments described herein can regard a method that includes detecting one or more cybersecurity threat indicators of malware targeting a computer device. The one or more cybersecurity threat indicators can characterize a delivery of the malware, an infrastructure of the malware, or a combination thereof. The method can also include generating an adversary profile that includes a correlation between the one or more cybersecurity threat indicators and an operation of the malware.