Google changes how it names cyber threat actors

Google Threat Intelligence Group (GTIG) has started using a new naming system for the threat actors it tracks. The change comes after Mandiant and Google’s Threat Analysis Group (TAG) merged into one unit, leaving the company with two separate naming schemes built up over years.

Previously, Mandiant and Google’s Threat Analysis Group maintained separate naming schemes, resulting in a mix of sequential identifiers, such as APT1, and other independently developed names. GTIG says this made it harder for defenders to distinguish between the groups.

“We know there are many threat actor tracking schemas in the industry, so we are intentionally seeking to keep this system as simple as possible to streamline operations and facilitate mapping to other naming taxonomies. However, a significant caveat remains: because no two organizations have the exact same visibility into the threat landscape, direct, apples-to-apples comparisons between threat actors are rarely possible,” Google said.

“Transitioning to a convention that is simpler to follow and remember is a practical step toward managing a highly intricate tracking problem,” the company added.

The new system assigns every tracked threat actor a two-word cryptonym. The first word identifies the specific group. If a name from earlier public reporting already exists for that actor, GTIG keeps it. If not, the word is generated at random to avoid bias before being reviewed by analysts.

The second word identifies the threat actor’s category, which may reflect assessed country attribution, criminal motivation, or another activity type.

These are the category names Google will use under the new system:

• People’s Republic of China groups get CASTLE
• Iran-linked groups get ION
• North Korean groups get NEPTUNE
• Russian groups get RELIC
• Cybercriminal groups get COMET

For example, the Russian state-linked group long known as Sandworm, or APT44, now carries the cryptonym SANDWORM RELIC. The first word keeps the identifier analysts already recognise, while the second immediately indicates the group’s assessed Russian state affiliation.

Threat actor name appearance in GTI platform on initial rollout (Source: Google)

GTIG has begun renaming several dozen of the most active threat groups and says additional actors will be updated over time. Existing names will not disappear. Previous names will remain searchable in the Google Threat Intelligence platform alongside MITRE ATT&CK mappings and aliases used by other security vendors.

“We will continue to use UNC, or ‘uncategorized’ designations for threat clusters that are still in the early stages of investigation,” the company concluded.