Cybersecurity companies have spent years giving hacking groups their own names so researchers and defenders can talk about them clearly. But the system has become crowded and inconsistent, because different organizations often label the same group in different ways.
Google recently changed its own naming approach to make that mess easier to navigate . Instead of long strings like APT numbers, its new method uses a memorable first name and a second word that signals a country of origin, such as Castle for China, Ion for Iran, Neptune for North Korea, and Relic for Russia. The goal is to make the labels easier to remember while still preserving useful context.
Shane Huntley, who leads Google Threat Intelligence Group’s hunting work, said the change was needed because the number of threat groups has grown far beyond what researchers expected in the early 2010s. Google now tracks more than 5,000 activity clusters across several countries, which makes organization and communication much harder. Huntley also said the purpose of naming groups is practical: defenders need a baseline understanding of who is attacking, how they operate, and what they have done before.
That kind of background can help a company respond faster during a breach . If security teams recognize a known actor’s patterns, they can prepare defenses, narrow investigations, and respond with more confidence . The Lazarus Group, a North Korean state-backed hacking outfit, is one example of how earlier intelligence helps defenders identify likely goals and methods. The challenge is that not all threat actors behave the same way.
State-sponsored groups are often easier to follow because their targets and tactics are more consistent, while cybercriminal gangs may split apart, change members, or shift direction. Spyware makers and hackers-for-hire can also be difficult to track because they may work for many clients in many regions . Huntley argues that no company has perfect visibility, which is why naming systems will likely remain imperfect even if Google’s new scheme is simpler than before.
