1. A system for tracking malware operator behavior patterns in a network environment simulated for an extended period of time, comprising: a non-transitory memory storing instructions; and a processor executing the instructions to cause the system to perform a method comprising: receiving organizational data that describes a virtual organization; obtaining additional data related to the organizational data; providing, using the processor, a simulated computer network of the virtual organization based at least partially on the organizational data; installing at least one malware on the simulated computer network; monitoring one or more interactions between the simulated computer network and an operator of the malware; and building a malware operator profile that characterizes the operator of the malware based on the one or more interactions.