Loading story…
Google Threat Intelligence Group said it is rolling out a unified naming system for cyber threat actors across Google platforms and public reporting, replacing the separate schemas previously used by Mandiant and Google Threat Analysis Group. The company said the change is intended to standardize tracking, simplify reporting, and make actor names easier for defenders to understand and correlate across products and research.
The new taxonomy uses two-word cryptonyms in which the first word uniquely identifies the actor and the second denotes a category such as origin, motivation, attribution, or activity type. Google said it has started by renaming several dozen of the most active groups and will retain prior names, MITRE ATT&CK mappings, and other vendor aliases within the Google Threat Intelligence platform to preserve continuity for analysts and customers.
See the reporting duties and controls this puts on the clock.
1 event from the most recent confirmed update back to the earliest known activity.
Google Threat Intelligence Group announced that it is rolling out a unified naming system for tracking threat actors across Google platforms and public reporting, replacing the previously separate naming approaches used by Mandiant and Google Threat Analysis Group. Google said it has already begun renaming several dozen of the most active groups while preserving prior names, MITRE ATT&CK mappings, and vendor aliases in the Google Threat Intelligence platform.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See what this changes for your reporting obligations and which controls it puts on the clock.
11 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcetechcrunch.com
Open sourcescworld.com
Open sourcesecurityweek.com
Open sourcetheregister.com
Open sourcecloud.google.com
Open sourceattack.mitre.org
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google Cloud and Mandiant released frontline hardening guidance focused on **UNC3944**, a financially motivated cybercrime group known for aggressive intrusions that target enterprise environments. The advisory highlights defensive measures organizations can take proactively to reduce exposure to the group’s tactics, drawing on incident-response experience and threat intelligence gathered from real-world investigations. The guidance emphasizes practical security improvements aimed at disrupting UNC3944 tradecraft before compromise escalates, including stronger identity protections, tighter access controls, and broader enterprise hardening. By publishing the recommendations through Google Cloud’s threat-intelligence channel, the companies signaled continued concern over UNC3944’s ability to exploit weak authentication, privileged access, and operational gaps inside large organizations.
Jul 12, 2026
Google disclosed action against **GRIDTIDE**, a global cyber espionage campaign tracked by Mandiant, saying it disrupted infrastructure tied to the operation and published new threat intelligence on the actor’s activity. The campaign was described as an espionage effort with international reach, and Google said the disruption was intended to hinder the group’s ability to conduct ongoing intrusions and intelligence collection. The disclosure came through a Google Cloud threat intelligence report by Mandiant that framed GRIDTIDE as a coordinated spying operation rather than financially motivated cybercrime. While the public notice focused on the disruption and attribution effort, it also signaled that defenders should review the newly released intelligence for indicators, targeting patterns, and tradecraft associated with **GRIDTIDE** to identify possible exposure and strengthen detection coverage.
Jul 12, 2026
Google Cloud unveiled an **agentic defense** strategy that combines **Wiz**, **Gemini**, **Mandiant**, and **Google Security Operations** to automate threat detection, investigation, and remediation. The company said the approach is designed to counter attackers' growing use of AI, citing Mandiant data showing the average time from initial breach to access handoff has fallen to **22 seconds**. Google also tied the strategy to broader code and application security efforts, including **CodeMender**, an AI agent for code security, and new protections such as **Wiz AI Application Protection Platform** and **AI-BOM**. The announcement places Google more directly in the fast-growing market for AI-driven and agentic SOC platforms, where vendors including **CrowdStrike**, **Microsoft**, **Palo Alto Networks**, and **SentinelOne** are also pushing automation-heavy security operations. Google said it has integrated Wiz attack surface management with Google Threat Intelligence and added SecOps agents for triage, threat hunting, and detection engineering, while rivals such as CrowdStrike are promoting **agentic MDR** and an **agentic SOC** model to help enterprises scale managed detection and response.
Jul 17, 2026