Google rolls out a new two-word naming scheme for threat actors

Intelligence Summary

Google has introduced a new standardized naming convention for threat actor groups. The scheme uses a memorable term that aligns with terms already seen in public reporting. It also adds a cluster-style categorization word to improve consistency across reporting. The goal is to make naming easier to interpret and reduce confusion between different organizations’ labels. Security teams and analysts should map old actor names to the new convention to avoid mix-ups in detection and reporting workflows.

Recommended Action

Track for context and fold into normal operational review.

Topics