Cyber Giants Unite: Microsoft, Google, & Others Push for Unified Hacker Group Naming
Do Son 
In light of the longstanding confusion caused by differing nomenclature used by nations and organizations to describe hacker groups and cybercriminal entities, Microsoft, CrowdStrike, Palo Alto Networks, and Google have announced a collaborative initiative to establish a unified naming convention for such actors. The goal is to foster clarity and consistency across the cybersecurity landscape and to encourage broader participation from industry stakeholders and governmental bodies alike.
Historically, cybersecurity firms have often employed their own unique naming schemes for the hacker groups they track. For instance, Mandiant labeled a particular threat actor as “APT1,” while Proofpoint has persistently monitored a group it refers to as “TA453.” Other notable examples include Trend Micro’s “Earth Lamia” and Kaspersky’s “Equation Group.”
Additional codenames, such as CrowdStrike’s “Cozy Bear” for a Russian threat actor, “Kryptonite Panda” for a Chinese group, and Secureworks’ “Iron Twilight”—which corresponds to the previously identified Russian group “TG-4127”—reflect this diversity in labeling. Microsoft, for its part, has traditionally employed the names of chemical elements, such as “Rubidium,” but has recently shifted to meteorological metaphors like “Lemon Sandstorm” and “Sangria Tempest.”
These disparate naming conventions, devised independently by various firms, often result in inconsistencies across different contexts and geographies, leading to fragmented understanding. To address this, Microsoft, CrowdStrike, Palo Alto Networks, and Google are spearheading efforts to formulate a standardized taxonomy for naming threat actors—urging additional companies and governmental entities to join in this collaborative framework.
However, skepticism remains within the cybersecurity community. Juan Andres Guerrero-Saade, Director of Intelligence and Security Research at SentinelOne, expressed doubts about the initiative. He noted that, amid the harsh realities of industry competition, companies often treat threat intelligence as proprietary leverage. Consequently, while a unified naming protocol may serve as a public relations gesture, it is uncertain whether it will yield any meaningful, practical impact.
Related Posts:
- MISP Unveils the Threat Actor Naming Standard
- Microsoft will use a new threat actor naming taxonomy aligned to the theme of weather
- Privilege Escalation Flaws in Cisco Unified Intelligence Center Threaten User Data Integrity
- Google Launches Unified Security Powered by Gemini AI, Enhances Enterprise Protection
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
