https://cloud.google.com/blog/topics/threat-intelligence/updated-cyber-threat-actor-naming-system/ Updated Cyber Threat Actor Naming System By Google Threat Intelligence Group Published: 2026-07-24 · Archived: 2026-08-07 02:00:21 UTC Update (July 30): A table listing the new names of select prominent threat actors was appended to this post. Introduction Today, Google Threat Intelligence Group (GTIG) will begin rolling out a unified naming schema for tracking threat actors. This new naming taxonomy represents an effort to standardize tracking across platforms and public reporting. Why are we Adopting a Different Naming System? Historically, Mandiant and Google’s Threat Analysis Group (TAG) maintained distinct tracking systems, relying on parallel naming schemas that grew independently over time. The creation of GTIG has necessitated a new, fused tracking system, and a new naming system. Thinking to the future, GTIG’s new system will rely on cryptonyms. Relying on sequential numbers or disparate identifiers (e.g. APT1) fails to provide defenders the critical context needed to operate quickly. Threat tracking shouldn’t be an exercise in memorization, but rather one of intuition. The new naming convention aligns with industry standard threat actor naming systems. Our New Schema Our new schema utilizes a cryptonym-based approach, employing memorable two-word combinations for each distinct threat actor: The first word is a unique and memorable term chosen to represent the specific actor, particularly names that may have been used in prior public reporting. If no previously used term exists, this word is randomly generated to remove bias, then vetted by our analysts. The second word categorizes threat clusters by motivation, attribution, or activity type based on which category we consider to be most important for defense and response strategies. The table below provides a sample of how threat actor categories will map to the second word in each cryptonym: Origin or Type Group Name People’s Republic of China CASTLE Page 1 of 5 https://cloud.google.com/blog/topics/threat-intelligence/updated-cyber-threat-actor-naming-system/ Iran North Korea Russia Cybercriminal Table 1: Examples of Google’s new threat actor naming system categories We know there are many threat actor tracking schemas in the industry system as simple as possible to streamline operations and facilitate mapping to other naming taxonomies. However, a significant caveat remains: because no two organizations have the exact same visibility into the threat landscape, direct, apples-to-apples comparisons between threat actors are rarely possible. Transitioning to a convention that is simpler to follow and remember is a practical step toward managing a highly intricate tracking problem. A Work in Progress We have initially prioritized renaming several dozen of the most active groups, and will continue this process on a rolling basis. Previous names will remain indexed and searchable in the Google Threat Intelligence (GTI) platform, with MITRE ATT&CK mappings and other vendor aliases preserved, see Figure 1. Figure 1: Threat actor name appearance in GTI platform on initial rollout We will continue to use UNC, or “uncategorized” designations for threat clusters that are still in the early stages of investigation, as described here. Selection of Re-Named Threat Actors ION NEPTUNE RELIC COMET , so we are intentionally seeking to keep this Page 2 of 5 https://cloud.google.com/blog/topics/threat-intelligence/updated-cyber-threat-actor-naming-system/ Origin or Type Cybercriminal Cybercriminal Cybercriminal Cybercriminal Iran Iran Iran Iran Iran Iran North Korea North Korea North Korea North Korea Previously Used Names FIN11 FIN6 FIN7 FIN8 APT33 APT34 APT35 APT39 APT42, CALANQUE TEMP.Zagros, MUDDYCOAST APT37 APT45 UNC1069, MASAN Temp.Hermit Page 3 of 5 New Names RAZOR COMET SQUID COMET WILD COMET PUNCH COMET BLEAK ION SOLAR ION RICH ION CINDER ION CALANQUE ION MUDDY ION PLAIN NEPTUNE GRASS NEPTUNE MIDNIGHT NEPTUNE HERMIT NEPTUNE People’s Republic of China (PRC) PRC PRC PRC PRC PRC PRC PRC PRC PRC PRC PRC PRC PRC PRC https://cloud.google.com/blog/topics/threat-intelligence/updated-cyber-threat-actor-naming-system/ APT15 APT20 UNC1088 APT27 APT30 APT31 APT40 APT41 APT5 Tonto Team TEMP.Tick UNC2814 Naikon Team Conference Crew TEMP.Hex Page 4 of 5 RIVER CASTLE RIDGE CASTLE RAVINE CASTLE SHORE CASTLE ISTHMUS CASTLE TIDE CASTLE ISLAND CASTLE SPIRE CASTLE BASALT CASTLE LONE CASTLE TICK CASTLE DARK CASTLE NAIKON CASTLE CONFERENCE CASTLE BASIN CASTLE https://cloud.google.com/blog/topics/threat-intelligence/updated-cyber-threat-actor-naming-system/ PRC Russia Russia Russia Russia Russia Russia Table 2: Selection of Re-named Threat Posted in Threat Intelligence Source: https://cloud.google.com/blog/topics/threat-intelligence/updated-cyber-threat-actor-naming-system/ TEMP.Overboard APT28, FROZENLAKE APT29, ICECAP APT44, FROZENBARENTS UNC4057, COLDRIVER TEMP.Vermin Turla Team Actors Page 5 of 5 CAVERN CASTLE LAKE RELIC ICE RELIC SANDWORM RELIC COLD RELIC VERMIN RELIC TURLA RELIC