Google Unifies Threat-Actor Names in New Two-Word System
Summary
Google Threat Intelligence Group is replacing overlapping Mandiant and internal threat-actor labels with two-word names. The rollout begins with actively tracked groups and preserves mappings to older names, MITRE ATT&CK and other vendors’ systems.
Key points
- Google’s system combines a memorable first word with a second word indicating a group’s category, such as country of origin or motive.
- The change addresses overlapping names inherited from Mandiant and Google’s Threat Analysis Group.
- The rollout starts with several dozen actively tracked groups, with more to follow.
- Older names will remain searchable, with mappings to MITRE ATT&CK and other vendors’ naming systems.
- Google’s approach resembles CrowdStrike’s two-part names; Microsoft uses weather-based names.
- Microsoft and CrowdStrike announced a joint effort in 2025 to map their names for the same groups, with Google and other security firms contributing.
Article Details
- Event Type
- Google Threat Intelligence Group introduced a unified two-word naming system for tracked threat groups, replacing its separate Mandiant and Threat Analysis Group naming systems.
- Impact
- The change is intended to reduce confusion from overlapping threat-group labels. Google says older names will remain searchable and will be mapped to MITRE ATT&CK and other vendors’ naming systems.
Vendors
CrowdStrike#GoogleThreatIntelligenceGroupGoogleGoogle Threat Intelligence Group has introduced a unified two-word naming system to replace overlapping hacker labels inherited from Mandiant and its internal Threat Analysis Group.MandiantGoogle Threat Intelligence Group has introduced a unified two-word naming system to replace overlapping hacker labels inherited from Mandiant and its internal Threat Analysis Group.Microsoft#GoogleThreatIntelligenceGroupPalo Alto Networksnames with CrowdStrike’s animal names for the same tracked groups, with Google, Mandiant and Palo Alto Networks Unit 42 also signed on to contribute.