Google Unifies Threat Actor Naming Across Mandiant and TAG

Google Threat Intelligence Group said it is rolling out a unified naming system for cyber threat actors across Google platforms and public reporting, replacing the separate schemas previously used by Mandiant and Google Threat Analysis Group. The company said the change is intended to standardize tracking, simplify reporting, and make actor names easier for defenders to understand and correlate across products and research.

The new taxonomy uses two-word cryptonyms in which the first word uniquely identifies the actor and the second denotes a category such as origin, motivation, attribution, or activity type. Google said it has started by renaming several dozen of the most active groups and will retain prior names, MITRE ATT&CK mappings, and other vendor aliases within the Google Threat Intelligence platform to preserve continuity for analysts and customers.