Google replaces APT numbers with geography-coded threat names

Google has overhauled how it identifies hacking groups, replacing the numbered APT system that defined threat intelligence for more than a decade with a new structure built around memorable names and geographic indicators. The change unifies Google’s internal Threat Analysis Group with Mandiant—the security firm Google acquired and folded into its operation—establishing a single naming convention across one of the industry’s largest threat tracking operations.

The new system assigns each hacking group a distinctive first name paired with a second word whose initial letter reveals the suspected country of origin. China-based groups receive the prefix Castle, Iran-affiliated actors get Ion, North Korean threat teams are labeled Neptune, and Russian-origin groups use Relic. The approach represents a significant departure from the APT1, APT41 numbering scheme that Mandiant pioneered when cybersecurity firms first began publicly naming state-sponsored threat actors in the early 2010s.

Tracking 5,000 Activity Clusters

Shane Huntley, chief technology officer of Google Threat Intelligence Group, explained the urgency behind the overhaul: Google now tracks more than 5,000 “activity clusters” spanning several countries, a volume that has made the numbered system unwieldy. When security companies began publishing cyberattack reports and assigning names to threat actors in the early 2010s, nobody anticipated the scope of the threat landscape that would emerge. Huntley told TechCrunch that “we were not expecting to have as many threat groups as we do today.”

The scale of the problem

The proliferation reflects a fundamental shift in state capabilities. John Hultquist, chief analyst at Google Threat Intelligence Group, noted that very few developed nations lack their own cyber operations and affiliated hacking groups. The traditional naming scheme broke down as the number of actors multiplied—remembering whether APT28 or APT29 conducted a particular breach became difficult even for security researchers, and journalists and policymakers often struggled to track which numbered group was which.

Industry fragmentation

The problem was compounded by the fact that every security company invented its own naming taxonomy. Mandiant’s APT numbers competed with other vendors’ labels and threat nicknames, creating a fragmented landscape where the same group might be known by multiple names depending on which company’s report you read. The lack of standardization meant that organizations responding to an attack often couldn’t easily cross-reference threat intelligence from different sources or understand whether reports were discussing the same adversary.

Why Names Matter More Than Numbers

Read also: Meta Ordered to Pay $567M and Restrict Features for New Mexico Minors · Hugging Face Security Breach: Internal Data and Credentials Compromised—What Users Need to Do Now · Millions of Driver’s License Numbers Exposed in Latest Major Data Breach · Polish Researchers Expose Systemic Flaws in Government Web

The rationale for consistent threat naming extends far beyond organizational convenience. Huntley emphasized that naming and tracking threat actors consistently is essential for the cybersecurity industry to function effectively. When an organization detects or suffers a breach, knowing the attacker’s historical behavior, preferred tactics, and documented targets becomes critically important for incident response and defensive planning.

Rapid threat recognition

A defender who recognizes that a particular intrusion bears the hallmarks of a known threat group can immediately access that group’s historical patterns—preferred entry points, malware families, targets, and objectives. This baseline understanding allows security teams to respond faster, investigate incidents more methodically, and deploy countermeasures tailored to that specific adversary’s capabilities. The example of the Lazarus Group, North Korea’s state-sponsored hacking organization, illustrates the principle: knowing that Lazarus typically targets financial institutions, cryptocurrency exchanges, and defense contractors provides defenders with strategic context for their response.

Building defensive models

Consistent naming also allows security analysts to build models of adversary behavior and motivation. Understanding which groups are state-sponsored versus criminal, which pursue espionage versus financial theft, and which work on contract for other nation-states shapes how defenders prioritize their protective measures. A financial services company, for instance, would invest differently in defenses against Lazarus—known to target banks and cryptocurrency platforms—than against a cybercriminal group focused on ransomware extortion.

State Actors Versus Criminal Networks

Huntley acknowledged that tracking different classes of threat actors presents distinct challenges. State-sponsored hacking groups are relatively easier to monitor because they tend to maintain consistent targeting patterns and coherent objectives tied to their government’s strategic interests. A Chinese military-affiliated hacking unit, for example, typically pursues espionage against specific industries, whereas a Russian intelligence service may focus on infrastructure reconnaissance or influence operations.

Cybercriminal organizations and hacker-for-hire groups present a fundamentally harder tracking problem. Members of criminal syndicates come and go, groups splinter and reform under new names, and operations are often more opportunistic than state-directed. Spyware firms that sell to governments and other clients worldwide introduce another layer of complexity—a single spyware-as-a-service operator might have customers across dozens of countries, each with different targeting priorities, making it harder to attribute motivations or predict future campaigns.

The Unfixable Fragmentation Problem

A recurring criticism whenever new threat naming systems are announced is the obvious question: why can’t the entire industry just agree on one standard? Huntley’s answer reveals an uncomfortable truth about threat intelligence—there is no single source of truth.

Every major security company builds its threat models from its own set of data and telemetry. A threat actor that Google observes attacking one set of targets might be invisible to another vendor that lacks visibility into that particular industry or geographic region. Mandiant may have acquired compromised systems or source code that reveals a threat group’s infrastructure, while Google’s insights come from analyzing malware campaigns targeting their services and customers. Cybersecurity firms that operate defensive services track different slices of the attack surface.

“No one has perfect visibility,” Huntley said. “We are building our model and our best understanding, but we will never know everything about what’s going on.” This means that even if competitors shared data openly, they would still develop slightly different taxonomies because they are literally observing different threat activities. Mandiant might confidently attribute a campaign to a specific Chinese military unit based on code overlap with previous operations, while another firm seeing only the malware’s network traffic might reach a different conclusion. Neither is wrong; they are each analyzing incomplete information.

What Changes for Google and Beyond

The unification of Mandiant’s naming scheme with Google’s internal Threat Analysis Group—which Huntley previously headed—eliminates at least one source of confusion. Security researchers working inside Google will no longer need to mentally translate between two different naming conventions or reconcile conflicting designations when discussing the same threat actor across different parts of the company.

For the broader cybersecurity industry, Google’s decision may accelerate adoption of a more intuitive naming approach. Security professionals, government officials, policymakers, and journalists attempting to understand threat landscapes have long struggled with the alphabet soup of APT numbers. A memorable name like “Neptune Frost” carries more cognitive weight than “APT25,” and the geographic indicator baked into the second word immediately conveys the suspected origin without requiring a lookup. The hope, though not the certainty, is that the new system’s clarity encourages adoption elsewhere.

Yet Google’s rebranding alone cannot solve the fundamental problem: different companies will continue to observe different threat actors based on their own vantage points, and those different observations will inevitably lead to different names. The industry will need to maintain resources that map between competing naming schemes and help researchers, defenders, and policymakers understand that the same threat group may be known by multiple designations depending on the source.