At step 204, the electronic messaging server 130 may receive the message metadata sent at step 203. For example, the electronic messaging server 130 may receive message metadata that may be used, in addition or as an alternative to the information received at step 202, to train one or more neural networks.

At step 205, the campaign identification platform 110 may extract one or more features from the information and/or the message metadata. For example, in extracting the one or more features from the information and/or the message metadata, the campaign identification platform 110 may identify one or more data labels and/or properties corresponding to the information and/or the message metadata (e.g., a URL, a sender, a subject line, a domain name, a geographic region, a time, and/or other features).

At step 206, the campaign identification platform 110 may aggregate the extracted one or more features for each attachment, URL, file, and/or other data object being analyzed. For example, the campaign identification platform 110 may aggregate features based on their corresponding threat campaigns. In some instances, the campaign identification platform 110 may receive information identifying these corresponding threat campaigns from an employee of an enterprise organization such as a threat researcher or other network security specialist (e.g., this received and/or original data may be manually labelled, and used to train the one or more neural networks as described below).