Cybersecurity threat intelligence could become more complicated as Google introduces a new system for identifying and categorising cybercrime groups, separate from an earlier industry effort led by Microsoft.
The new taxonomy was developed by the Google Threat Intelligence Group following Google’s acquisition of Mandiant. It uses a 2-word naming structure designed to identify threat actors while also indicating their motivation, attribution or activity type.
Under the system, the first word serves as a unique identifier for a cybercrime group. It can either use an existing name or a randomly generated term, with the aim of reducing bias in how threat actors are identified.
The second word provides additional context about the group. Google has assigned terms including CASTLE for China-based groups, ION for Iran-linked actors, NEPTUNE for North Korea, RELIC for Russia and COMET for non-state-sponsored groups.
Google’s approach differs from a 2025 initiative involving Microsoft and CrowdStrike, which sought to develop a more unified naming convention for cyber threat actors.
The lack of a common naming system has already created challenges for cybersecurity teams. Russian threat actor APT44, for example, has been identified under multiple names, making threat intelligence analysis more difficult for organisations that rely on different security tools and vendors.
Google’s decision to establish its own framework also signals a shift from earlier indications that the company was interested in the Microsoft-led standardisation effort.
The company has pointed to concerns around bias in cybercrime naming. This includes previous complaints from China about naming practices used by Western cybersecurity companies when identifying Chinese cybercrime groups.
The emergence of multiple naming systems could therefore make it harder for organisations to connect threat intelligence across different cybersecurity platforms.
Also read: Viksit Workforce for a Viksit Bharat
Do Follow: The Mainstream LinkedIn | The Mainstream Facebook | The Mainstream Youtube | The Mainstream Twitter
About us:
The Mainstream is a premier platform delivering the latest updates and informed perspectives across the technology business and cyber landscape. Built on research-driven, thought leadership and original intellectual property, The Mainstream also curates summits & conferences that convene decision makers to explore how technology reshapes industries and leadership. With a growing presence in India and globally across the Middle East, Africa, ASEAN, the USA, the UK and Australia, The Mainstream carries a vision to bring the latest happenings and insights to 8.2 billion people and to place technology at the centre of conversation for leaders navigating the future.