In a significant development within the realm of cybersecurity, the Google Threat Intelligence Group (GTIG) has announced the rollout of a unified cryptonym-based naming system designed to categorize cyber threat actors more effectively. This initiative aims to streamline the attribution process, enhance analyst workflows, and address inconsistencies that have historically plagued various legacy tracking conventions employed by Google’s security teams.
The inception of this new naming framework comes on the heels of the successful integration of Mandiant and Google’s Threat Analysis Group (TAG) into GTIG. Prior to this merger, both entities operated their own distinct systems for identifying and tracking clusters of cyber threats. Such a fragmented approach led to persistent challenges for cybersecurity defenders, who often found themselves navigating multiple aliases for the same malicious activities and subsequently needing to reconcile overlapping terms across diverse reports, intelligence platforms, and detection workflows.
Google Unveils Unified Cryptonym-Based Naming System for Cyber Threat Actors
The newly introduced model by GTIG replaces these disparate identifiers with memorable, two-word cryptonyms that are specifically crafted to convey both a unique identity for the threat actor as well as a contextual attribution. This thoughtful structure allows for easier recognition and continuity. Under the updated schema, the first word serves as a distinct identifier for the particular threat actor, while GTIG strives to maintain any existing terminologies prevalent in public discourse regarding the group. Where no established identifier exists, Google generates a randomized name that undergoes analyst review, ensuring that bias is minimized and misleading associations are avoided.
The second word in the cryptonym plays a crucial role, as it designates the category to which the group belongs, reflecting its nation-state origin, criminal motivations, or operational characteristics. For instance, under the new naming system, state-affiliated actors like those linked to the Russian government, previously dubbed APT44 or Sandworm, are now officially tracked as SANDWORM RELIC. This change retains the public’s familiar name “SANDWORM,” while “RELIC” immediately signals the group’s assessed Russian state affiliation.
Sandworm has a storied history dating back to at least 2004 and has been associated with numerous aliases, such as Dark Basin, Frozenbarents, GreyEnergy, Hades, Inedibleochotense, and Quedagh. The introduction of this updated naming framework is positioned as a user-friendly operational reference rather than just another internal system for analysts.
Furthermore, Google asserts that this new framework is intended to align more closely with the naming conventions utilized by other security vendors in the industry. Despite this effort, GTIG openly acknowledges that achieving one-to-one comparisons across varying threat intelligence providers will still present challenges. Organizations tend to observe different infrastructures, malware distributions, victimology patterns, and operational methodologies, which can lead them to define or categorize threat clusters in distinct ways.
Given this complexity, the Google naming system should be regarded as a standardized measure designed to enhance internal processes within Google’s ecosystem, not as a comprehensive solution to the broader challenges associated with cyber threat attribution.
Initially, the new cryptonym identifiers will roll out for a selection of the most active threat groups, with plans for additional actors to be renamed in the future. To maintain continuity and support analysts accustomed to older terminologies, legacy identifiers will remain indexed and searchable within the Google Threat Intelligence platform. In addition, Google plans to retain mappings to established frameworks like the MITRE ATT&CK techniques and aliases assigned by other vendors, allowing organizations to sustain continuity in their reporting, detection content, and intelligence integrations.
In light of these changes, security teams that utilize Google Threat Intelligence feeds are urged to monitor the transition attentively. Updating internal references regarding threat actors, enriching workflows, and adjusting detection-rule documentation will be essential to mitigate any potential confusion as the new cryptonyms become integrated into alerts and dashboards.
As cybersecurity threats continue to evolve rapidly, initiatives like this one from Google signify a crucial step toward making threat intelligence more accessible and actionable for analysts and organizations alike. With a unified naming system in place, stakeholders hope to achieve greater clarity in identifying and responding to cyber threats effectively.
ALERT: Over 20 government websites have recently delivered malware to various businesses and citizens. Check full attack research to assess your own exposure.