In a significant shift toward standardizing the chaotic landscape of cyber-threat tracking, the Google Threat Intelligence Group (GTIG) has officially transitioned to a new, cryptonym-based naming convention for threat actors. By abandoning the cumbersome and often confusing system of sequential numbers and disparate internal identifiers, Google aims to provide the cybersecurity community with a more intuitive, memorable, and structured taxonomy for identifying the entities behind global cyber campaigns.
This strategic move reflects an industry-wide recognition that the current state of threat intelligence—characterized by fragmented naming conventions across different security vendors—poses a genuine risk to effective incident response and global defense cooperation.
The New Taxonomy: Clarity Through Categorization
The core of Google’s new schema relies on a two-word naming convention designed to balance specific attribution with broad behavioral categorization. The system is intentionally designed to be human-readable, reducing the cognitive load on analysts who must often juggle dozens of different aliases for a single threat group.
The Anatomy of a Name
The structure consists of two distinct components:
- The Primary Identifier: This is a unique, memorable term—often one already established in public reporting or industry discourse—that acts as the anchor for the threat actor. If no such moniker exists in the public domain, Google will assign a randomly generated, distinct term to ensure the actor is uniquely identifiable.
- The Categorical Suffix: This second word serves as a functional tag. It immediately signals the actor’s origin, motivation, or primary activity type. By standardizing these suffixes, Google allows analysts to instantly grasp the geopolitical or criminal context of an actor upon first mention.
Standardized Suffixes
To maintain consistency, Google has established a set of anchor terms for the most common sources of threat activity:
- Castle: Reserved for threat actors originating from China.
- Ion: Specifically denotes groups based in Iran.
- Neptune: Used for state-sponsored entities from North Korea.
- Relic: Applied to Russian threat actors.
- Comet: Designated for prolific, financially motivated cybercrime gangs.
A primary example of this transition is the infamous Russian group historically tracked by Google as "APT44." Under the new framework, the group is now officially designated as "Sandworm Relic." This change bridges the gap between Google’s internal tracking and the wider community’s recognition of the actor by its industry-standard name, while appending the "Relic" suffix to clarify its origin.
Chronology: From Sequential Numbers to Contextual Intelligence
The history of threat actor tracking is a story of rapid, uncontrolled expansion. In the early 2000s, when the industry was in its infancy, tracking a handful of "Advanced Persistent Threats" (APTs) was manageable using simple numerical sequences. However, as the digital threat landscape exploded in complexity, the "APT-X" format became a bottleneck.
The Era of "APT" Confusion
For years, security firms like Mandiant (now part of Google), CrowdStrike, and Microsoft developed their own silos of naming. A single threat actor could be identified by a dozen different names—for instance, the Sandworm group is also known globally as Blue Echidna, Electrum, FrozenBarents, G0034, Iridium, Iron Viking, Quedagh, Seashell Blizzard, TEMP.Noble, TeleBots, UAC-0082, UAC-0113, and Voodoo Bear.
This fragmentation created a "Tower of Babel" scenario for cybersecurity teams. When an incident occurred, responders would often spend precious time confirming whether a specific threat actor alias mentioned in a report matched the actor they were investigating.
The Transition Phase
Recognizing this, Google began the process of reclassifying its entire threat database. Rather than a "hard cutover," the company is executing a rolling transition.
- Initial Phase: Dozens of the most active, high-profile threat actors have already been renamed.
- Integration Phase: The Google Threat Intelligence (GTI) platform will maintain historical indexing, ensuring that analysts searching for legacy names like "APT44" are automatically redirected to "Sandworm Relic."
- Future-Proofing: Moving forward, all new, uncategorized threat clusters will continue to use the "UNC" (Uncategorized) designation until sufficient intelligence is gathered to apply a permanent, two-word cryptonym.
Supporting Data: The Complexity Problem
The necessity of this shift is supported by the sheer volume of data currently circulating in the threat intelligence ecosystem. According to Google’s internal analysis, the lack of standardized naming is not merely an aesthetic issue—it is a functional one.
The "Apples-to-Apples" Challenge
The primary obstacle identified by GTIG is the variance in visibility. Because different security organizations monitor the internet from different vantage points, their understanding of a specific actor’s infrastructure and TTPs (Tactics, Techniques, and Procedures) often differs.
By standardizing the nomenclature, Google is attempting to facilitate better "mapping to other naming taxonomies." When a report is published using the new schema, it becomes significantly easier for automated tools and human analysts to correlate the intelligence with existing MITRE ATT&CK framework data, which remains the industry’s "North Star" for behavioral analysis.
Official Responses and Industry Perspectives
Google’s decision has been met with cautious optimism within the cybersecurity community. Experts have long called for a "universal naming convention," though many acknowledge the immense difficulty of achieving total consensus.
Google’s Stance
"We know there are many threat actor tracking schemas in the industry," a Google spokesperson noted. "So we are intentionally seeking to keep this system as simple as possible to streamline operations and facilitate mapping to other naming taxonomies." The company emphasizes that this is a "practical step toward managing a highly intricate tracking problem."
The Broader Industry Movement
Google is not acting in a vacuum. The industry is currently experiencing a "great unification" of threat intelligence.
- Microsoft’s Weather Model: Microsoft recently transitioned to naming actors after weather events (e.g., "Blizzard," "Typhoon"), categorizing groups based on their geographic region.
- Collaborative Efforts: Industry leaders, including Microsoft and CrowdStrike, have been involved in collaborative projects aimed at mapping disparate actor names into a single, cohesive index.
This trend suggests a maturing industry. As cybersecurity moves from a niche technical field to a cornerstone of national security, the ability to communicate threat data across organizational boundaries—without the confusion of conflicting aliases—has become a top priority.
Implications: What This Means for the Future
The move to a cryptonym-based system carries significant implications for defenders, policy makers, and the broader digital ecosystem.
1. Reduced Incident Response Times
For the average Security Operations Center (SOC) analyst, the most immediate benefit is time. When an alert triggers, the time spent "de-conflicting" actor names is a direct cost. By aligning with common public terminology (like "Sandworm"), Google is ensuring that the intelligence they provide is immediately actionable without needing to consult a translation table.
2. Enhanced Geopolitical Clarity
By explicitly coding the origin of an actor into the name (e.g., "Castle" for Chinese actors), Google is making the geopolitical implications of cyber activity impossible to ignore. This supports more effective policy and diplomatic responses, as it clarifies which nation-states are responsible for specific campaigns, thereby reducing the "plausible deniability" that attackers often rely on.
3. Strengthening the "Defensive Moat"
The integration of these names into the GTI platform, while preserving MITRE ATT&CK mappings and legacy aliases, creates a "best of both worlds" scenario. It provides the accessibility of a user-friendly name with the rigor of deep, technical data. This makes it easier for smaller organizations, which may lack massive threat intelligence teams, to leverage high-level research provided by Google.
4. A Template for Standardization
Google’s initiative serves as a litmus test for the industry. If successful, it may encourage other vendors to abandon their proprietary, numerical systems in favor of this hybrid approach. While total industry consensus remains a distant dream, the move toward "Human-Readable Attribution" is a clear sign that the industry is shifting focus from data collection to data comprehension.
The Path Ahead
As Google continues to roll out these changes, the efficacy of the system will be tested in real-time. The ultimate success of this taxonomy will depend on how widely it is adopted by third-party platforms and how effectively it can be integrated into automated threat-hunting workflows.
For now, the era of the "APT" number—a relic of a simpler, less dangerous internet—is drawing to a close. In its place, a more descriptive, contextual, and human-centric language is emerging, helping defenders hold the line in an increasingly complex digital landscape. By making the unseen actors of the internet easier to name, Google is, in effect, making them easier to stop.
