Google Adopts New Threat Actor Naming System

The new two-word naming convention uses a memorable term utilized in public reporting and a cluster-categorization word. The post Google Adopts New Threat Actor Naming System appeared first on SecurityWeek .

Fact: Google Threat Intelligence Group has introduced a unified, two-word cryptonym-based naming schema for threat actors, with the first word being a unique actor identifier and the second word indicating motivation, origin, or activity type.[1][3][5] Fact: This change is meant to reduce confusion from multiple vendor naming schemes and streamline cross-referencing across Google and Mandiant threat intelligence feeds.[1][3][4] RealGround analysis: For organizations consuming threat intel into AI-driven detection, triage, or autonomous response systems, this naming shift is a supply-chain issue that requires updating mappings, playbooks, and SBOM-style inventories of threat intel sources to avoid mis-correlation or gaps. Aligning internal taxonomies and AI models with Google’s new schema should be treated as a controlled change in the AI security supply chain, with verification that no legacy identifiers are silently dropped in data pipelines.