Google Threat Intelligence Group Introduces Unified Threat Actor Naming System
Summary
Google Threat Intelligence Group is rolling out memorable two-word names for threat actors, replacing its separate Mandiant and TAG naming systems while preserving previous names, aliases, and MITRE ATT&CK mappings.
Key points
- GTIG is introducing a unified naming system to standardize threat-actor tracking across its platforms and public reporting.
- Each cryptonym combines a distinctive first word with a second word indicating an actor’s origin, motivation, or activity type.
- Examples include COMET for cybercriminal groups, ION for Iran-linked groups, NEPTUNE for North Korea, CASTLE for China, and RELIC for Russia.
- The initial rollout renames several dozen prominent groups, with further changes planned on a rolling basis.
- Previous names will remain searchable in Google Threat Intelligence, alongside vendor aliases and MITRE ATT&CK mappings.
- GTIG will continue using UNC designations for threat clusters still under investigation; the company cautions that different organizations’ visibility makes direct comparisons difficult.
Article Details
- Event Type
- Rollout of a unified cryptonym-based threat actor naming system by Google Threat Intelligence Group (GTIG).
- Impact
- The system is intended to standardize threat actor tracking across Google and Mandiant reporting and provide memorable names categorized by motivation, attribution, or activity. Renaming is rolling out for selected groups; prior names remain searchable in the Google Threat Intelligence (GTI) platform, with MITRE ATT&CK mappings and vendor aliases preserved.
Threat Actors
APT28Previously used name listed alongside FROZENLAKE; mapped to the new name LAKE RELIC.APT29Previously used name listed alongside ICECAP; mapped to the new name ICE RELIC.APT30Previously used name mapped to the new name ISTHMUS CASTLE.APT31Previously used name mapped to the new name TIDE CASTLE.APT37Previously used name mapped to the new name PLAIN NEPTUNE.APT39Previously used name mapped to the new name CINDER ION.APT40Previously used name mapped to the new name ISLAND CASTLE.APT44Previously used name listed alongside FROZENBARENTS; mapped to the new name SANDWORM RELIC.APT5Previously used name mapped to the new name BASALT CASTLE.BASALT CASTLENew name for the previously used name APT5.BASIN CASTLENew name for the previously used name TEMP.Hex.BLEAK IONPreviously used name mapped to the new name BLEAK ION.CALANQUE IONPreviously used name listed alongside CALANQUE; mapped to the new name CALANQUE ION.CALANQUE IONNew name for the previously used names APT42 and CALANQUE.CINDER IONNew name for the previously used name APT39.COLD RELICNew name for the previously used names UNC4057 and COLDRIVER.COLDRIVERPreviously used name listed alongside UNC4057; mapped to the new name COLD RELIC.FIN11Previously used name mapped to the new name RAZOR COMET.FIN6Previously used name mapped to the new name SQUID COMET.FIN7Previously used name mapped to the new name WILD COMET.FROZENBARENTSPreviously used name listed alongside APT44; mapped to the new name SANDWORM RELIC.ICE RELICNew name for the previously used names APT29 and ICECAP.ICECAPPreviously used name listed alongside APT29; mapped to the new name ICE RELIC.ISLAND CASTLENew name for the previously used name APT40.ISTHMUS CASTLENew name for the previously used name APT30.LAKE RELICNew name for the previously used names APT28 and FROZENLAKE.LONE CASTLENew name for the previously used name Tonto Team.MIDNIGHT NEPTUNENew name for the previously used names UNC1069 and MASAN.MUDDYCOASTPreviously used name listed alongside TEMP.Zagros; mapped to the new name MUDDY ION.PUNCH COMETNew name for the previously used name FIN8.RAVINE CASTLENew name for the previously used name UNC1088.RICH IONPreviously used name mapped to the new name RICH ION.SANDWORM RELICNew name for the previously used names APT44 and FROZENBARENTS.SHORE CASTLEPreviously used name mapped to the new name SHORE CASTLE.SOLAR IONPreviously used name mapped to the new name SOLAR ION.SPIRE CASTLEPreviously used name mapped to the new name SPIRE CASTLE.TEMP.HermitPreviously used name mapped to the new name HERMIT NEPTUNE.TEMP.HexPreviously used name mapped to the new name BASIN CASTLE.TEMP.VerminPreviously used name mapped to the new name VERMIN RELIC.TEMP.ZagrosPreviously used name listed alongside MUDDYCOAST; mapped to the new name MUDDY ION.TIDE CASTLENew name for the previously used name APT31.Tonto TeamPreviously used name mapped to the new name LONE CASTLE.TURLA RELICNew name for the previously used name Turla Team.UNC1069Previously used name listed alongside MASAN; mapped to the new name MIDNIGHT NEPTUNE.UNC4057Previously used name listed alongside COLDRIVER; mapped to the new name COLD RELIC.VERMIN RELICNew name for the previously used name TEMP.Vermin.
Vendors
GoogleToday, Google Threat Intelligence Group (GTIG) will begin rolling out a unified naming schema for tracking threat actors.MandiantHistorically, Mandiant and Google’s Threat Analysis Group (TAG) maintained distinct tracking systems, relying on parallel naming schemas that grew independently over time.