Listen to this Post
Introduction: A New Era for Cyber Threat Attribution
One of the biggest challenges in modern cybersecurity is not detecting attackers—it is identifying them consistently. Security researchers, SOC analysts, incident responders, and governments often refer to the same threat actor by entirely different names depending on which security vendor published the report. This naming chaos has slowed investigations, complicated intelligence sharing, and created unnecessary confusion during active cyber incidents.
To solve this long-standing industry problem, the Google Threat Intelligence Group (GTIG) has introduced a completely redesigned threat actor naming framework. Following the integration of Google’s Threat Analysis Group (TAG) with Mandiant, Google is replacing fragmented identifiers with a unified cryptonym-based system that is easier to understand, easier to remember, and more practical for defenders around the world.
Rather than simply renaming threat actors, Google is attempting to modernize how cyber adversaries are classified, making attribution more meaningful while maintaining compatibility with historical intelligence.
Google Introduces a Unified Threat Actor Naming Framework
Google Threat Intelligence Group officially announced a comprehensive overhaul of its threat actor tracking methodology by introducing a standardized cryptonym naming convention.
The initiative addresses years of inconsistency that emerged after Google acquired Mandiant. Both organizations maintained independent intelligence databases, each using its own naming strategy for Advanced Persistent Threat (APT) groups, cybercriminal organizations, and nation-state operators.
As both research teams continued publishing intelligence, analysts frequently encountered duplicate identities, multiple aliases, and conflicting terminology describing identical threat groups.
The newly introduced framework aims to eliminate these inconsistencies while improving operational efficiency across the cybersecurity community.
Why Traditional Threat Names Created Problems
For decades, security vendors have relied on sequential naming systems such as:
APT1
APT28
APT29
APT44
Although these identifiers became widely recognized, they reveal almost nothing about the actor behind the number.
Different vendors further complicated attribution by assigning their own names to identical threat actors.
A single hacking group could easily accumulate six, eight, or even ten different aliases across public reports.
This created major challenges during:
Incident response
Threat hunting
Intelligence sharing
Security operations
Executive reporting
Analysts often spent valuable time confirming whether multiple reports referenced the same attacker instead of focusing on active defense.
The Sandworm Example Shows the
Perhaps the best example is the notorious Russian military cyber unit commonly known as Sandworm.
Over nearly two decades of operations, this single organization has accumulated numerous names across different vendors, including:
APT44
Sandworm
GreyEnergy
Hades
Dark Basin
Inedibleochotense
Quedagh
FrozenBarents
Although each designation referred to essentially the same organization, security professionals often needed additional research simply to understand cross-vendor reports.
Google believes this complexity unnecessarily increases investigation time during high-pressure incidents.
How
Instead of using arbitrary numbers, GTIG now assigns every tracked threat actor a memorable two-word cryptonym.
The naming structure follows a standardized format.
First Word: Unique Identifier
The first word represents the
Whenever possible, Google preserves familiar public names already widely recognized within the cybersecurity community.
If no suitable public identifier exists, GTIG generates a randomized but memorable word that undergoes analyst review to reduce unintended bias.
Second Word: Threat Classification
The second word immediately indicates the
Rather than requiring analysts to memorize dozens of unrelated names, attribution becomes instantly recognizable.
Current category labels include:
CASTLE —
ION — Iran
NEPTUNE — North Korea
RELIC — Russia
COMET — Cybercriminal organizations
This simple suffix provides immediate operational context during investigations.
APT44 Officially Becomes SANDWORM RELIC
Using the new framework, the well-known Russian threat actor APT44 has officially been renamed:
SANDWORM RELIC
Here:
SANDWORM preserves the widely recognized identity.
RELIC immediately signals Russian state attribution.
Instead of requiring analysts to remember multiple independent databases, the new naming convention communicates essential intelligence directly within the threat name itself.
Designed for Better Collaboration Across the Industry
Google emphasizes that its new schema is not intended to replace every existing vendor taxonomy overnight.
The cybersecurity ecosystem includes numerous intelligence providers, each possessing unique visibility into attacker infrastructure, malware families, and campaigns.
Because organizations observe different portions of the threat landscape, perfect alignment between naming systems remains impossible.
Instead, GTIG designed its cryptonyms to map cleanly onto existing vendor aliases while reducing ambiguity inside Google’s own intelligence platform.
This practical approach allows analysts to transition gradually without losing historical context.
Historical Threat Intelligence Will Remain Available
One of the most important aspects of
Older threat names are not disappearing.
Within the Google Threat Intelligence platform, users will continue to find:
Historical aliases
Previous Mandiant identifiers
Legacy TAG names
MITRE ATT&CK mappings
Cross-vendor references
This ensures researchers can continue using historical reports without losing attribution continuity.
Organizations with years of archived intelligence will not need to rewrite previous investigations.
Security Teams Must Prepare for the Transition
Although the naming change improves clarity, organizations will experience an adjustment period.
Security Operations Centers (SOCs) relying on Google Threat Intelligence should begin reviewing:
Detection rules
SIEM correlation logic
Threat intelligence feeds
Playbooks
Incident response documentation
Internal analyst training
Alert names appearing inside dashboards may gradually transition to the new cryptonyms.
Without preparation, analysts may initially struggle to recognize newly renamed threat actors.
Updating internal knowledge bases early will minimize operational disruption.
Industry Impact Beyond Google
Google’s decision may influence the broader cybersecurity industry.
Threat intelligence has historically suffered from inconsistent terminology across vendors such as Microsoft, CrowdStrike, Palo Alto Networks, Cisco Talos, SentinelOne, ESET, and others.
If
While a universal naming standard remains unlikely due to differing intelligence sources, greater consistency would significantly improve collaboration during global cyber incidents.
Deep Analysis
Google’s unified naming initiative represents more than a branding exercise—it is an architectural improvement for cyber intelligence workflows.
For SOC teams, consistent naming directly impacts investigation speed. During an active incident, analysts correlate indicators from multiple intelligence feeds, SIEM alerts, EDR telemetry, malware sandboxes, and MITRE ATT&CK mappings. When one attacker is represented by several aliases, correlation becomes slower and increases the chance of missed connections.
Example workflow for validating Indicators of Compromise (IOCs):
grep -Ri "SANDWORM RELIC" /opt/threat-intel/ grep -Ri "APT44" /opt/threat-intel/ grep -Ri "Sandworm" /opt/threat-intel/
Searching historical detections with Sigma rules:
sigma convert -t splunk sandworm_rules.yml sigma convert -t elastic sandworm_rules.yml
Querying MITRE ATT&CK mappings:
curl https://attack.mitre.org/groups/
Searching a SIEM for legacy and new aliases:
index=security ("APT44" OR "Sandworm" OR "SANDWORM RELIC")
Example YARA execution:
yara -r apt_collection.yar /samples/
Hunting endpoints with Velociraptor:
velociraptor query artifacts
Reviewing Suricata alerts:
grep "Sandworm" /var/log/suricata/eve.json
Operationally,
What Undercode Say:
Google’s decision is one of the most practical improvements made to threat intelligence in recent years. While new malware and zero-day vulnerabilities often dominate cybersecurity headlines, naming consistency is an overlooked problem that affects nearly every SOC worldwide.
Threat attribution has become increasingly fragmented because each security vendor develops its own intelligence independently.
A single ransomware operator may carry six different names.
A nation-state campaign may appear under four separate aliases.
This creates friction during incident response.
SOC analysts waste time matching reports.
Threat hunters duplicate investigations.
Executives become confused by conflicting intelligence.
Google’s cryptonym model addresses these operational inefficiencies.
The category suffix immediately communicates attribution.
The first identifier preserves historical familiarity.
Backward compatibility prevents organizations from losing years of accumulated intelligence.
The system also benefits automation.
AI-powered SOC platforms depend heavily on normalized datasets.
Standardized names improve machine correlation.
Threat intelligence enrichment becomes more reliable.
Detection engineering becomes cleaner.
Playbooks become easier to maintain.
Knowledge sharing improves between analysts.
Cross-team communication becomes faster.
Incident reports become more readable.
Threat briefings become easier for executives to understand.
MITRE ATT&CK mapping remains intact.
Legacy research continues to retain value.
Google wisely avoided forcing the industry into an entirely new vocabulary.
Instead, it built a bridge between historical intelligence and future investigations.
However, this initiative alone will not eliminate attribution challenges.
Different vendors still observe different infrastructure.
Threat actors constantly evolve.
Some campaigns overlap.
Others intentionally mimic rival groups.
False flags remain common.
Nation-state attribution still requires extensive intelligence.
No naming convention can completely solve that problem.
Nevertheless, reducing terminology confusion is a meaningful step.
The cybersecurity industry increasingly depends on collaboration.
Every minute saved during an investigation matters.
Google’s redesign prioritizes analyst efficiency over marketing terminology.
If additional vendors adopt similar principles, the industry could gradually move toward a more interoperable intelligence ecosystem where defenders spend less time translating names and more time stopping attackers.
✅ Fact: Google Threat Intelligence Group announced a unified cryptonym-based naming framework following the integration of Google TAG and Mandiant. This reflects Google’s effort to streamline internal and external threat attribution.
✅ Fact: Threat actors such as APT44 are being renamed using a two-word structure, with the second word indicating attribution categories like RELIC for Russia or COMET for cybercriminal groups. Legacy aliases remain searchable within Google’s Threat Intelligence platform.
✅ Fact: The new naming system is intended to simplify analyst workflows rather than establish a universal industry standard. Google explicitly acknowledges that different security vendors maintain unique visibility into cyber threats, making perfect cross-vendor attribution impossible.
Prediction
(+1) Google’s unified naming model is likely to become a reference framework for future cyber threat intelligence platforms, improving automation, accelerating incident response, and encouraging greater interoperability between security vendors. While universal adoption is unlikely in the short term, the industry’s growing reliance on AI-assisted threat analysis and collaborative defense will increase the demand for standardized, context-rich threat actor identities.
▶️ Related Video (72% Match):
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: cyberpress.org
Extra Source Hub (Possible Sources for article):
https://www.digitaltrends.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
