Google overhauls how it tracks the world's most dangerous hackers

Under the new framework, threat actors are assigned a memorable random first name followed by a second word denoting their country of origin. For instance, 'Castle' identifies groups linked to China, 'Ion' to Iran, 'Neptune' to North Korea, and 'Relic' to Russia. Shane Huntley, CTO of Google Threat Intelligence Group, notes that the shift was essential because the industry’s initial 2010s-era naming systems were never built to handle the sheer volume of modern cyber warfare.

Beyond mere labeling, the system serves as a tactical baseline for incident response. By standardizing the identification of groups like the North Korean-linked Lazarus Group, defenders can better predict behavior and anticipate attack vectors. Huntley admits that tracking state-sponsored hackers remains more straightforward than monitoring fluid cybercriminal syndicates, whose memberships frequently shift or splinter. While critics often call for a universal, industry-wide naming standard, Huntley maintains that such a goal is unattainable. Because each security firm relies on unique telemetry and proprietary data sets, no single entity possesses perfect visibility into the digital battlefield. For Google, unifying the internal systems of its legacy Threat Analysis Group and the recently acquired Mandiant is a necessary step toward reducing the noise in an increasingly crowded threat landscape.