Google is replacing separate Mandiant and GTAG threat-actor naming systems with one scheme.
Why it matters: Threat-intel names help companies, governments and vendors correlate incidents across reports. A shared naming system could make it easier to connect activity clusters, even when attribution is still evolving.
- Google Threat Intelligence Group announced the new naming system on July 24, 2026.
- The system uses two-word cryptonyms, with the second word signaling origin or type.
- Google says it will keep UNC labels for clusters still under investigation.
- Previous names will remain searchable in Google Threat Intelligence, with MITRE ATT&CK mappings and vendor aliases preserved.
Google says it is merging the threat-actor naming systems used by Mandiant and Google Threat Analysis Group into one unified framework. The company said the change is designed to make tracking more consistent for analysts who have to follow the same group across multiple reports and vendors. Google’s explanation
In practical terms, the update gives Google one house style for naming activity clusters. The company said the new labels use two words and that the second word signals origin or type. Google also said it is starting with several dozen of its most active tracked groups, though it did not specify an exact count.
The move follows long-running friction in threat intelligence, where one actor can appear under different names depending on the vendor or reporting body. MITRE says groups are activity clusters tracked by a common name, and that different organizations may use different names for overlapping clusters. MITRE’s group guidance
MITRE’s STIX guidance also warns that naming actors or campaigns after malware or other imprecise labels can create conflicts across information sources. STIX guidance
Google said the new system is meant to reduce that problem inside its own operations and in public reporting. The company said older names will stay indexed in Google Threat Intelligence, alongside MITRE ATT&CK mappings and vendor aliases, so analysts can still search across legacy references. That matters for incident response, vendor correlation and historical research, since teams often need to tie a fresh alert to older reporting before they can act.
Google said it will keep UNC labels for clusters that are still uncategorized. Mandiant has used UNC for activity that may later be reclassified as an APT or FIN group. Microsoft uses a different naming system of its own and says its labels are meant to help track groups before high-confidence attribution is possible. Mandiant’s UNC model Microsoft’s naming system
Google said its new categories include CASTLE for China, ION for Iran, NEPTUNE for North Korea, RELIC for Russia and COMET for cybercriminals.
Yes, but: Google’s second-word categories are naming conventions, not definitive attribution labels on their own.