Google unifies names for tracked cyber threat groups

Google has begun introducing a unified naming system for cyber threat actors, replacing overlapping labels used by its security teams with two-word cryptonyms designed to give defenders clearer context about attackers and their likely objectives.

The Google Threat Intelligence Group, known as GTIG, said the taxonomy would standardise threat tracking across its platforms and public reporting. The change follows the integration of Mandiant and Google’s Threat Analysis Group, which had maintained separate naming conventions before their intelligence operations were brought together.

Under the system, each recognised threat actor will receive a two-part name. The first word will identify the specific group, while the second will indicate the actor’s country of origin, motivation or primary activity. Google expects the structure to make names easier to remember and help security teams assess threats more quickly.

Groups linked to China will be assigned names ending in “CASTLE”, while Iran-linked actors will use “ION”. North Korea-associated groups will carry “NEPTUNE”, Russia-linked groups will use “RELIC”, and financially motivated cybercriminal organisations will be identified with “COMET”.

The first word may be taken from an established name already used in public reporting. Where no suitable name exists, Google will generate a neutral term and submit it for review by threat analysts. The procedure is intended to limit bias while avoiding a return to long strings of numbers and acronyms.

Google has prioritised several dozen of the most active groups for the initial transition. Further actors will be renamed on a rolling basis as the taxonomy expands across the Google Threat Intelligence platform.

Older names will remain searchable, allowing analysts to connect new cryptonyms with Mandiant designations, Google labels, MITRE ATT&CK entries and aliases used by other security companies. This continuity is important because operational reports, malware investigations and intrusion records may refer to the same group under several identities.

The company will continue to use “UNC”, meaning uncategorised, for clusters that are still being investigated. Mandiant has traditionally assigned UNC numbers when evidence shows linked malicious activity but does not yet support a firm assessment that the activity belongs to a known organisation.

Threat actor naming has become a persistent problem for the cyber security industry. Intelligence providers often collect different evidence, observe separate parts of an operation and apply distinct standards before grouping activities together. As a result, one organisation can acquire numerous labels, while groups with similar tools or infrastructure may sometimes be mistakenly treated as the same actor.

Russia-linked operators associated with major espionage campaigns, for example, have been tracked under names such as APT29, Cozy Bear, Midnight Blizzard and UNC2452. The variations reflect differences in intelligence visibility and attribution thresholds rather than simple disagreement over branding.

Research covering thousands of cyber threat reports has identified more than 3,000 actor names across multiple commercial and public taxonomies. It found that aliases were concentrated around a smaller set of prominent groups, complicating efforts to merge intelligence databases and compare findings between vendors.

Attribution remains difficult because attackers share malware, rent infrastructure, imitate competitors and change techniques. State-sponsored units can also reorganise, collaborate with contractors or run operations through intermediary groups, making permanent classifications unreliable.

Google has acknowledged that its system will not create direct equivalence between every company’s threat labels. Two intelligence providers may use different names because each sees only part of an attacker’s operations. A group defined through malware telemetry may overlap with, but not exactly match, one identified through victim investigations or government intelligence.

The initiative comes amid a broader push to reduce confusion in threat reporting. Google, Microsoft, CrowdStrike and Palo Alto Networks announced plans in 2025 to develop a public glossary connecting names used for state-backed groups and cybercriminal organisations. Supporters argue that common mappings could improve incident response by helping defenders recognise when separate alerts describe the same adversary.

Microsoft has moved towards weather-related names, using terms such as “Blizzard”, “Sandstorm”, “Typhoon” and “Sleet” to indicate national affiliations or operational categories. CrowdStrike has long paired descriptive words with animals, including “Bear” for Russia-linked actors and “Panda” for China-linked groups.

Google’s system adopts a comparable category-based approach while retaining its own terminology. The second word is intended to provide immediate defensive value, signalling whether an actor is linked to a state or motivated primarily by financial gain.

The shift also reflects the growing volume of threat intelligence processed by security operations centres. Analysts must correlate identities across alerts, vulnerability reports, malware databases and investigations, often while responding to an active intrusion. Clearer labels could reduce duplication and prevent teams from treating several aliases as separate attackers.