Google has announced that Google Threat Intelligence Group (GTIG) is adopting a new cryptonym-based naming convention for tracking threat actors.
According to the internet giant, the schema moves away from sequential numbers and disparate identifiers, relying instead on two-word combinations for each activity cluster.
The first word, Google explains, is a unique and memorable term that may have been used in public reporting and which is meant to represent the threat actor. A randomly generated term will be used if none exists.
The second word is meant to place each threat actor into a specific category based on motivation, attribution, or activity type.
As an example, Google will use ‘Castle’ as the second word for threat actors from China, ‘Ion’ for those from Iran, ‘Neptune’ for North Korean groups, ‘Relic’ for Russian threat actors, and ‘Comet’ for cybercrime gangs.
Under the new naming scheme, Russia’s notorious Sandworm group, which has been tracked by Google as ‘APT44’, will become ‘Sandworm Relic’. Within the community, the APT is also tracked as Blue Echidna, Electrum, FrozenBarents, G0034, Iridium, Iron Viking, Quedagh, Seashell Blizzard, TEMP.Noble, TeleBots, UAC-0082, UAC-0113, and Voodoo Bear.
“We know there are many threat actor tracking schemas in the industry, so we are intentionally seeking to keep this system as simple as possible to streamline operations and facilitate mapping to other naming taxonomies,” Google says.
According to the company, the issue that remains is the visibility that each cybersecurity organization has into the threat landscape, which prevents direct, apples-to-apples comparisons between threat actors in most cases.
“Transitioning to a convention that is simpler to follow and remember is a practical step toward managing a highly intricate tracking problem,” the internet giant notes.
To kick off the transition to the new taxonomy, Google has renamed several dozen of the most active threat actors. The process will continue on a rolling basis.
“Previous names will remain indexed and searchable in the Google Threat Intelligence (GTI) platform, with MITRE ATT&CK mappings and other vendor aliases preserved,” the company said.
Google will continue to use the UNC designation for the uncategorized threat clusters.
Related: Google DeepMind Researchers Map Web Attacks Against AI Agents
Related: Microsoft, CrowdStrike Lead Effort to Map Threat Actor Names
Related: Microsoft Will Name Threat Actors After Weather Events
Related: New Index Tracks Material Breaches — And Refuses to Add Up the Losses