The Register reports that Google unveiled its own taxonomy for categorizing cybercrime groups, a move that appears to sideline a previous industry-wide effort led by Microsoft to standardize threat actor names.Google’s new system, developed by the Google Threat Intelligence Group following its acquisition of Mandiant, uses a two-word schema. The first word is a unique identifier for the actor, either an existing moniker or a randomly generated term to avoid bias. The second word categorizes the group by motivation, attribution, or activity type. Google has assigned specific terms such as CASTLE for China-based groups, ION for Iran, NEPTUNE for North Korea, RELIC for Russia, and COMET for non-state-sponsored actors. This approach contrasts with a 2025 initiative by Microsoft and CrowdStrike aimed at creating a unified naming convention. The proliferation of multiple naming schemas, as seen with the numerous names used for Russian threat actor APT44, complicates threat intelligence analysis for organizations using diverse security tools. Google’s decision to create its own system, despite previous indications of interest in the Microsoft-led effort, suggests a divergence in strategy. The company cited concerns about bias in naming, referencing past complaints from China regarding Western companies’ naming conventions for Chinese cybercrime groups.Source: The Register
Click Here For The Original Source.
