Google unifies hacker names to cut confusion across cybersecurity labels

Google Threat Intelligence Group began rolling out a unified naming schema for tracking threat actors on July 30, replacing the separate labels used by Mandiant and Google’s Threat Analysis Group. Google appended a table of select prominent threat actors and said the new taxonomy was meant to standardize tracking across platforms and public reporting, while making names easier to remember, more accessible and more widely adopted.

The change lands in a cybersecurity field where naming has become its own source of friction. Different companies and governments often attach different labels to the same intrusion cluster, forcing journalists, security teams and policymakers to map one actor across several names before they can even start debating responsibility. CyberScoop described Google’s move as another naming system, a sign that APT-number conventions are giving way to cryptonyms even as defenders are asked to keep up with multiple schemas at once.

That confusion has been visible for years. Reuters reported on June 2, 2025, that cyber companies were trying to untangle hacker nicknames such as Forest Blizzard and Fancy Bear, names that can obscure whether different firms are describing the same group or related activity. Microsoft still uses its own threat-actor naming scheme, adding another layer to a system that already varies by vendor and by government.

The problem is not cosmetic. Naming is one of the first steps in attribution, and attribution shapes everything that follows: whether an attack is treated as criminal, espionage or a broader national security threat; how quickly alerts are matched across organizations; and how confidently public officials can speak about who is behind an intrusion. When the label changes from one company to the next, the underlying threat may be easier to miss, and the public record becomes harder to trust.

The scale of the problem showed up in the way the U.S. government has described Russian hacking groups linked to the 2016 election. Kim Zetter noted that one government report listed 48 separate nicknames for those groups, including Sofacy and Pawn Storm. That kind of sprawl helps explain why Google is trying to consolidate its own internal labels into a single framework, and why the politics of naming has become part of the cybersecurity industry itself.