Google Names Cybercrime Groups to Detail Motives and Origins

Key Takeaways

• Google is overhauling its cyber threat actor naming conventions to provide immediate context on group origins and motives.
• The new system replaces ambiguous labels with two-word cryptonyms, where the second word indicates the group’s suspected affiliation (e.g., nation-state or cybercriminal).
• This initiative aims to streamline threat intelligence reporting, enhance communication among security professionals, and reduce the burden of memorizing disparate naming schemes.
• The change is a strategic move to improve clarity in a complex threat landscape, not a response to a specific new vulnerability or attack.
• Existing threat actor names and aliases will remain searchable within Google’s threat intelligence platforms to ensure continuity during the transition.

Google Revamps Cyber Threat Actor Naming for Enhanced Clarity

Google is implementing a significant change in how it identifies and categorizes cyber threat groups, moving away from its previous diverse naming conventions. The tech giant will now assign new, descriptive names to hacker groups, aiming to convey their motives and origins more clearly at first glance. This strategic shift is designed to make threat intelligence reports more accessible and actionable for cybersecurity defenders, providing crucial context about who is behind an operation and their likely objectives. More details can be found in a report outlining the new naming system.

This initiative is not a response to a new malware threat or a specific attack campaign. Instead, it addresses a persistent challenge within the threat intelligence community: the inconsistency of naming conventions across different research organizations. Historically, various teams have used distinct identifiers for the same threat cluster, and many short labels like “APT1” provided little insight into the group’s origins, motivations, or operational patterns. This often led to confusion and hindered rapid response efforts.

The Google Threat Intelligence Group, formed from the integration of Mandiant and Google’s Threat Analysis Group, is spearheading this unified naming scheme. According to Google Cloud in a report, the primary goal is to standardize threat actor tracking across Google’s platforms and public reporting. This standardization aims to alleviate the cognitive load on security teams, allowing them to more efficiently process and act upon threat intelligence.

For organizations, clearer labels are expected to accelerate incident triage, foster more effective communication among analysts, and simplify external reporting. However, Google emphasizes that this new naming system will not replace the rigorous work of attribution. Security teams must still thoroughly assess attacker behavior, infrastructure, and targets before definitively linking a group to a government entity or a criminal enterprise. The new names are designed as a navigational aid, offering an initial understanding without implying absolute certainty in every attribution.

The New Naming Structure

Under the revised model, each threat actor will be assigned a memorable two-word cryptonym. The first word serves as a unique identifier for the group. If an established term exists from prior public reporting, it may be retained; otherwise, researchers will generate a random term and carefully review it to prevent any unintended biases. This initial word helps in distinguishing one group from another.

The second word in the cryptonym provides crucial contextual information about the group’s suspected affiliation or motivation. For instance, “CASTLE” will denote groups linked to the People’s Republic of China, “ION” for Iran, “NEPTUNE” for North Korea, and “RELIC” for Russia. Cybercriminal operations will be identified with “COMET.” This structured approach gives readers an immediate, high-level understanding of the threat actor’s likely backing, allowing for quicker assessment without overstating the certainty of attribution. Previous ambiguous identifiers, such as sequential numbers or disconnected labels like “APT1,” failed to provide this essential context for defenders needing to act swiftly.

Tracking During Transition

The rollout of this new naming system will be gradual, commencing with dozens of the most active threat groups and expanding over time. Groups still in the early stages of investigation will continue to be labeled with “UNC” (uncategorized), underscoring that definitive assessments are still pending. This cautious approach is vital; while a recognizable name can be beneficial, it should not prematurely solidify a tentative assessment.

Even with the new system, previous labels will remain searchable within Google’s threat intelligence platform, alongside MITRE ATT&CK mappings and aliases from other vendors. This continuity is critical for incident response teams who need to cross-reference older reports, monitoring rules, and case notes with new assessments during the transition period. To aid in this, a new

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.